4 ms·
+9999999[...] When such posts make it to the front page is shows the sheer ignorance and lack of will to even make a Google search. (purists could argue that gp
by zobzu 14y ago
+9999999[...]
When such posts make it to the front page is shows the sheer ignorance and lack of will to even make a Google search. (purists could argue that gpgme is far from perfect tho).
What's needed is actual good implementations of the clients. That's all really. The command line client is not perfect but its FINE. It's fast, it works, it does what it says.
The other clients sucks hairy balls.
People also fail to realize that to date, the PGP trust model is the only freaking viable trust model, because it's distributed, free, and the trust choice is up to the _user_ (and it happens to also have been around for more than a decade, that never hurts).
There's actual implementations of PGP/GPG for website authentication and transport encryption. There's implementations for package signing that _actually_ make use of the trust model (www.archlinux.org).
There's PGP SmartCards that are _way_ more secure than this little OTP token in your pocket, and it works for SSH too. But wait, there's more. It works for SSH authentication _using_ the trust model too (web.monkeysphere.info).
Oh, and last but not least GPG supports ECDSA, too. All this to say that PGP and the GnuPG implementation have a huge, underexploited potential, and that's probably due to ignorance.
- papaf 14y agoDoesn't GPGME still wrap the executable and parse its output? If so, I would call it a wrapper rather than a library. As an example GPG saves its keys in a file. What if you want to put them in a database? Does GPGME allow a developer to do this?
- dfc 14y agoOriginally I wrote: "Does gpg allow you to export and import keys?" Based on the comment below it seems my sarchasm was not evident. I should have written: "Are you asking if gpg can import or export keys?"
- shared4you 14y agoEDIT: Ah ok, sorry English is not my native language, so I didn't get the sarcasm at first :) Export a public key: gpg --export -a "UserName" > public.key Export a private key: gpg --export-secret-key -a "UserName" > private.key Import a public key: gpg --import public.key Import a private key: gpg --allow-secret-key-import --import private.key
- beagle3 14y ago> There's PGP SmartCards that are _way_ more secure than this little OTP token in your pocket, and it works for SSH too. But wait, there's more. It works for SSH authentication _using_ the trust model too (web.monkeysphere.info). I've been looking for those. I can only find one from g10code / kernelconcepts.de - which is fine, but is exactly ONE vendor. The other one I found is the Yubikey NEO - less than two month old, and sold out for the next 2 months at least. Are there any other implementations that I'm missing? (Don't get me wrong - I've ordered from kernelconcepts before. But I don't like to be dependent on a single vendor) > Oh, and last but not least GPG supports ECDSA, too. True. Do you know if the PGPcard standard is supposed to be updated to support ECDSA too? Some standard require signing or encryption keys to be in an independent hardware module.
- zvrba 14y agoI have played with the idea of making a GPG applet for the JavaCard platform. It's rather easy (I have a half-done prototype somewhere that used to work with an old version of GnuPG), but the lack of market didn't make it worthwhile pursuing this beyond the prototype stage.
- beagle3 14y agoEven reasonable JavaCards don't appear to be easily available. I was really surprised when I started looking into these things - I was expecting the improved security afforded by these cards to be easier to come by and use.
- morpher 14y agoSee my response to the parent. As the OP mentions iphone support in the first two sentences, so, it is a bit disingenuous to suggest that gpgme (which simply wraps the gpg executable) is a solution and that "sheer ignorance" and "lack of will" are the only reasons anyone would suggest this was an interesting article.
- Dylan16807 14y agoReally? You want to give a million points to a comment that blatantly ignores the article to propose a solution that was discussed and shot down halfway through? You disappoint me.
- nicholassmith 14y agoWhen such comments make it towards the top it shows the sheer ignorance and lack of will to fully read a linked article. Either read the article and comment on it, or don't read it and avoid commenting.
- zobzu 14y agoA million points is nice! It's like winning the lottery and giving it away is still free.