5 ms·

Nowadays is GPG/PGP-ing your emails really that hard? Thunderbird supports GPG on all platforms, Apple's default Mail works with PGP/GPG, I'm sure there are pl

by aroch 13y ago

Nowadays is GPG/PGP-ing your emails really that hard? Thunderbird supports GPG on all platforms, Apple's default Mail works with PGP/GPG, I'm sure there are plenty of windows clients that do the same. In additional, online providers like Hush are bringing PGP to the masses without them having to know what in fucks name it is. Even if you don't encrypt every mail you send, signing is a good idea. Is it unnecessary in many circumstances? Yes, but at least I find it nice to be able to verify authenticity. I don't understand why my bank (Wells Fargo) can't figure out how to sign all their emails [1]. ______ 1: https://www.wellsfargo.com/downloads/pdf/com/cps/Secure_Email_User_Guide.pdf https://www.wellsfargo.com/downloads/pdf/com/cps/Secure_Emai... Yes, they can sign some emails...but it requires someone inside WF "sponsor" you to be added to their PKI and it still won't lead to signed or even encrypted emails for online banking. WF is also particularly egregious in not offering real 2FA...they count a username AND a password as "two factor authentication". sigh

mpyne 13y ago
GPG support is actually one of the very big things that has kept me using KMail even with Akonadi's rather poor support for POP3 w/ filtering. Being able to expand that web of trust even to businesses and among the tech-savvy would be wonderful, if only to increase awareness of the idea that things which need to be secret from unintended viewers (including, but not limited to, the NSA) need to be encrypted.
- aroch 13y ago
  Why not move over to thunderbird? It supports GPG through enigmail
  - mpyne 13y ago
    I don't need extensions with Kontact, it's built-in. Also I still use Akregator and the organizer/calendaring. What I'll probably do is to switch my damn email over to IMAP at some point, apparently that's what the kdepim devs are all using... but I don't want to have to fix all my filters, and then I would have to use fetchmail and run dovecot or similar to have my email on my own computer.
    - dualboot 13y ago
      Thankfully Dovecot + Sieve makes the transition pretty easy.
betterunix 13y ago
"Nowadays is GPG/PGP-ing your emails really that hard?" Try convincing people to not use webmail and accept the fact that they cannot just check mail on whatever random computer they come across. I speak from experience: this is the biggest hurdle.
- aroch 13y ago
  Have them use Hush, or any number of the in-browser GPG/PGP extensions that will encrypt your gmail then! At least their webmail is encrypted then (and Hush integrates with most of the notable PKI servers). You have to start them somewhere, just lamenting about it isn't going to change anything. I've moved my family and friends into GPG over the lsat few years and now I receive GPG-encrypted mail more often than not.
  - greyone 13y ago
    You can also use Countermail which provides end-to-end PGP security (unlike Hushmail). Here's my article with more info: http://www.greycoder.com/how-to-stop-the-nsa-from-spying-on-you/ http://www.greycoder.com/how-to-stop-the-nsa-from-spying-on-...
  - betterunix 13y ago
    Browser plugins are good, but they do not solve the problem most people have complained about to me: that they cannot check their mail on their friend's computers, at the library, etc. Hushmail is snake oil, I would not recommend it to anyone and I doubt that it is even relevant to the problem at hand (how to communicate privately in a world of NSLs).
    - ippisl 13y ago
      Use a USB key with everything installed on it in a portable fashion. The Tor Browser Bundle is something like this. Two issues with this method are that TOR is 80% funded by the us government, using a computer opens you to backdoors. But at least that's a good start.
- 13y ago
LiamMcCalloway 13y ago
Set-up can be daunting, but I always found that entering one's password every time a new mail comes in is unbearable. They should highlight that the pgp password timeout can be changed to something less intrusive.
- aroch 13y ago
  The default timeout, at least for gpg, is 3600sec (1 hour) which should be more than enough for the majority of people's emailing habits (Sitting down and checking / emailing once or twice a day). Recently setup has become super easy[1], especially on the OSX or *nix side of things. OSX probably has the easiest flow, all you have to do is install one thing[2] and you're off. It will walk you through everything[3] and it supports the built in Mail.app. _________ 1: http://www.gnupg.org/related_software/frontends.html http://www.gnupg.org/related_software/frontends.html 2: https://gpgtools.org/ https://gpgtools.org/ 3: http://support.gpgtools.org/kb/how-to/first-steps-where-do-i-start-where-do-i-begin http://support.gpgtools.org/kb/how-to/first-steps-where-do-i... >When you run GPG Keychain Access for the first time, the window will be empty or contain only the GPGTools Project Key (delivered via the GPGTools Installer). >If you don't have a private key, you'll be prompted to create a new key pair.
  - LiamMcCalloway 13y ago
    I think most people respond to their mails pretty much as they come in. I'd add that in corporate settings a norm of near immediate response has developed. I've set my timeout at 9999sec -- mutt throws in an error if I add a digit. I don't use OSX, but can you comment on how easy key exchange is nowadays? I have to admit that I have it set up and ready to roll, but pretty much no one I know is willing to take the plunge.
    - aroch 13y ago
      >I think most people respond to their mails pretty much as they come in Maybe when at work, but at home most people (Especially of the older generation) seem to check their email a few times a day. Corporate users should never be using webmail on their work computer...If they're MS Exchange based, they should be using Outlook and their exchange policy should allow (and prefer) S/MIME. There are a variety of plugins for Outlook that support GPG and S/MIME is already signed and encrypted. Pubkey's should always be make available through the existing online PKI services. I personally send all my keys through pgp.mit.edu to be mirrored world-wide. Key-exchange (For High to Ultimate trust scenarios) is simple and easy. Send someone your pubkey by signing it with their pubkey and email it in a signed email (with signed attachments) to them. Have them do the reverse.
xtrumanx 13y ago
> they count a username AND a password as "two factor authentication" I was so flabbergasted by that I had to look it up and it seems like you're wrong. This page[0] describes a feature called Advanced Access that sends a code to your phone whenever you do certain actions on the website. [0] https://www.wellsfargo.com/privacy_security/online/advancedaccess https://www.wellsfargo.com/privacy_security/online/advanceda...
- aroch 13y ago
  That's only for things like online money transfers, and not account related. They maybe have pulled the particular document I'm referring to, but at one point they had the same / similar text to what Schneier quotes. https://www.schneier.com/blog/archives/2007/04/bank_botches_tw_1.html https://www.schneier.com/blog/archives/2007/04/bank_botches_...

by aroch 13y ago

mpyne 13y ago

GPG support is actually one of the very big things that has kept me using KMail even with Akonadi's rather poor support for POP3 w/ filtering. Being able to expand that web of trust even to businesses and among the tech-savvy would be wonderful, if only to increase awareness of the idea that things which need to be secret from unintended viewers (including, but not limited to, the NSA) need to be encrypted.

aroch 13y ago
Why not move over to thunderbird? It supports GPG through enigmail
- mpyne 13y ago
  I don't need extensions with Kontact, it's built-in. Also I still use Akregator and the organizer/calendaring. What I'll probably do is to switch my damn email over to IMAP at some point, apparently that's what the kdepim devs are all using... but I don't want to have to fix all my filters, and then I would have to use fetchmail and run dovecot or similar to have my email on my own computer.
  - dualboot 13y ago
    Thankfully Dovecot + Sieve makes the transition pretty easy.

betterunix 13y ago

"Nowadays is GPG/PGP-ing your emails really that hard?" Try convincing people to not use webmail and accept the fact that they cannot just check mail on whatever random computer they come across. I speak from experience: this is the biggest hurdle.

aroch 13y ago
Have them use Hush, or any number of the in-browser GPG/PGP extensions that will encrypt your gmail then! At least their webmail is encrypted then (and Hush integrates with most of the notable PKI servers). You have to start them somewhere, just lamenting about it isn't going to change anything. I've moved my family and friends into GPG over the lsat few years and now I receive GPG-encrypted mail more often than not.
- greyone 13y ago
  You can also use Countermail which provides end-to-end PGP security (unlike Hushmail). Here's my article with more info: http://www.greycoder.com/how-to-stop-the-nsa-from-spying-on-you/ http://www.greycoder.com/how-to-stop-the-nsa-from-spying-on-...
- betterunix 13y ago
  Browser plugins are good, but they do not solve the problem most people have complained about to me: that they cannot check their mail on their friend's computers, at the library, etc. Hushmail is snake oil, I would not recommend it to anyone and I doubt that it is even relevant to the problem at hand (how to communicate privately in a world of NSLs).
  - ippisl 13y ago
    Use a USB key with everything installed on it in a portable fashion. The Tor Browser Bundle is something like this. Two issues with this method are that TOR is 80% funded by the us government, using a computer opens you to backdoors. But at least that's a good start.
13y ago

LiamMcCalloway 13y ago

Set-up can be daunting, but I always found that entering one's password every time a new mail comes in is unbearable. They should highlight that the pgp password timeout can be changed to something less intrusive.

aroch 13y ago
The default timeout, at least for gpg, is 3600sec (1 hour) which should be more than enough for the majority of people's emailing habits (Sitting down and checking / emailing once or twice a day). Recently setup has become super easy[1], especially on the OSX or *nix side of things. OSX probably has the easiest flow, all you have to do is install one thing[2] and you're off. It will walk you through everything[3] and it supports the built in Mail.app. _________ 1: http://www.gnupg.org/related_software/frontends.html http://www.gnupg.org/related_software/frontends.html 2: https://gpgtools.org/ https://gpgtools.org/ 3: http://support.gpgtools.org/kb/how-to/first-steps-where-do-i-start-where-do-i-begin http://support.gpgtools.org/kb/how-to/first-steps-where-do-i... >When you run GPG Keychain Access for the first time, the window will be empty or contain only the GPGTools Project Key (delivered via the GPGTools Installer). >If you don't have a private key, you'll be prompted to create a new key pair.
- LiamMcCalloway 13y ago
  I think most people respond to their mails pretty much as they come in. I'd add that in corporate settings a norm of near immediate response has developed. I've set my timeout at 9999sec -- mutt throws in an error if I add a digit. I don't use OSX, but can you comment on how easy key exchange is nowadays? I have to admit that I have it set up and ready to roll, but pretty much no one I know is willing to take the plunge.
  - aroch 13y ago
    >I think most people respond to their mails pretty much as they come in Maybe when at work, but at home most people (Especially of the older generation) seem to check their email a few times a day. Corporate users should never be using webmail on their work computer...If they're MS Exchange based, they should be using Outlook and their exchange policy should allow (and prefer) S/MIME. There are a variety of plugins for Outlook that support GPG and S/MIME is already signed and encrypted. Pubkey's should always be make available through the existing online PKI services. I personally send all my keys through pgp.mit.edu to be mirrored world-wide. Key-exchange (For High to Ultimate trust scenarios) is simple and easy. Send someone your pubkey by signing it with their pubkey and email it in a signed email (with signed attachments) to them. Have them do the reverse.

xtrumanx 13y ago

> they count a username AND a password as "two factor authentication" I was so flabbergasted by that I had to look it up and it seems like you're wrong. This page[0] describes a feature called Advanced Access that sends a code to your phone whenever you do certain actions on the website. [0] https://www.wellsfargo.com/privacy_security/online/advancedaccess https://www.wellsfargo.com/privacy_security/online/advanceda...

aroch 13y ago
That's only for things like online money transfers, and not account related. They maybe have pulled the particular document I'm referring to, but at one point they had the same / similar text to what Schneier quotes. https://www.schneier.com/blog/archives/2007/04/bank_botches_tw_1.html https://www.schneier.com/blog/archives/2007/04/bank_botches_...