11 ms·
Why I Wrote PGP (1999)
- krmboya 13y agoThis particular version doesn't seem to be from 1991 as the current title suggests since it speaks of 1994 in the past tense.
- mathattack 13y agoYes. It claims to be updated in 1999.
- sidcool 13y agoIt's scary how this all snooping thing started way back when the internet was nascent.
- mhurron 13y agoIt started before that. This has been a function of the NSA from it's beginning. http://en.wikipedia.org/wiki/Project_SHAMROCK http://en.wikipedia.org/wiki/Project_SHAMROCK
- DanBC 13y agoBritish Special Branch said they wanted an informant on every street. The BBC had political vetting. http://www.cambridgeclarion.org/press_cuttings/mi5.bbc.page9_obs_18aug1985.html http://www.cambridgeclarion.org/press_cuttings/mi5.bbc.page9... Special Branch spied on an elected member of parliament http://news.bbc.co.uk/1/hi/programmes/true_spies/2378459.stm http://news.bbc.co.uk/1/hi/programmes/true_spies/2378459.stm Unions in the 70s had extensive networks of police informants and undercover officers and agents provocateurs. https://www.wsws.org/en/articles/2002/12/spie-d10.html https://www.wsws.org/en/articles/2002/12/spie-d10.html That union scrutiny activity turned into black listing, meaning many workers were denied jobs. A secret McCarthy-esque activity. This black listing was so severe it lead to laws being brought in around data protection. Those laws originally only covered computer systems. Because the black lists were run on index cards the laws were changed to cover more forms of data retention. http://www.bbc.co.uk/programmes/b02xcn7d http://www.bbc.co.uk/programmes/b02xcn7d Abuses of surveillance are common, and long lasting.
- pconf 13y agoIt actually started with the British whose spooks taught it to the US' Herbert Hoover before WWII. Read "Enemies: A History of the FBI by Tim Weiner" <http://www.theguardian.com/books/2012/mar/30/enemies-fbi-history-weiner-review> http://www.theguardian.com/books/2012/mar/30/enemies-fbi-his... for the definitive historical overview of how domestic spying and its abuse got started. George Orwell foresaw the potential for abuse long before 1948 when he wrote "1984" <https://en.wikipedia.org/wiki/Nineteen_Eighty-Four> https://en.wikipedia.org/wiki/Nineteen_Eighty-Four>.
- noonespecial 13y agoPerhaps you think your email is legitimate enough that encryption is unwarranted. If you really are a law-abiding citizen with nothing to hide, then why don't you always send your paper mail on postcards? Why not submit to drug testing on demand? Why require a warrant for police searches of your house? Are you trying to hide something? If you hide your mail inside envelopes, does that mean you must be a subversive or a drug dealer, or maybe a paranoid nut? Do law-abiding citizens have any need to encrypt their email? What if everyone believed that law-abiding citizens should use postcards for their mail? If a nonconformist tried to assert his privacy by using an envelope for his mail, it would draw suspicion. Perhaps the authorities would open his mail to see what he's hiding. Fortunately, we don't live in that kind of world, because everyone protects most of their mail with envelopes. So no one draws suspicion by asserting their privacy with an envelope. There's safety in numbers. Analogously, it would be nice if everyone routinely used encryption for all their email, innocent or not, so that no one drew suspicion by asserting their email privacy with encryption. Think of it as a form of solidarity. I'm seriously thinking of having this printed up on business cards (1st paragraph on the front, 2nd on the back) so I can just whip them out and hand them to people. By the time they've gotten done saying, "Well, if you have nothing to hide..." it'll be in their hands.
- swinnipeg 13y agoMy go to is something along the lines of: You disapprove of mandatory cavity searches before air travel or entering a school? Sounds you are a drug dealer.
- noonespecial 13y agoI've found that this doesn't work quite as well because modesty (the desire not to be seen 'naked') tangles up with privacy and creates a "that's different..." that seems difficult to quickly dismiss.
- jsaxton86 13y agoI don't think you understand why people approve of what the NSA is doing, which is why that's usually going to be an ineffective argument. The NSA promises a safer country, and all we have to is let them do a little bit of surveillance behind the scenes. We won't even notice -- it's not intrusive in the same way that a cavity search is. An NSA supporter once asked me if I would have given up the metadata on my phone if it would have prevented 9/11 and saved ~3000 lives. I wouldn't, for reasons that have been discussed on HN repeatedly, but I think it's still a fair question. The real issue here is the power imbalance combined with the lack of oversight and accountability. When I talk to NSA supporters, that's what I try to emphasize.
- hipaulshi 13y agoWow.. the whole article seems so relevant to today
- eplanit 13y agoIt was never irrelevant. The problem has simply scaled up over time.
- hipaulshi 13y agoSo.. Anyone wants to do a PGP key signing party in San Francisco? I asked on HN before but no one seems to be interested back then. I hope some meetup organizer can pick this up.
- numlocked 13y agoNo better way than to do it yourself! Create the meet up and submit it here. I'd be up for it.
- frewsxcv 13y agoYes, I would definitely be interested
- steveklabnik 13y agoI am very interested.
- willvarfar 13y agoI'm curious, how would you verify an attendee's identity?
- hipaulshi 13y agogovernment id/picture id checking against pgp keyserver, to make sure you are who say you are. So you have to be physically present at the party with your key and id. that's how the trust network is built.
- ywyrd 13y agoYes, because pieces of paper given out by men with guns are the font of all truth. ADD: Fuck this statist cesspool.
- mirkules 13y agoWould you be more comfortable giving your fingerprint or DNA sample to prove your identity? Side note: maybe there could be a way to irreversibly hash one's fingerprint or DNA sample into an electronic signature
- MWil 13y agoI just started experimenting with PGP this week and I was amazed at how easy it was. This page was all I needed to get started http://serverfault.com/questions/489140/what-is-a-good-solution-to-encrypt-some-files-in-unix http://serverfault.com/questions/489140/what-is-a-good-solut...
- jng 13y agoIsn't that gpg?
- abemassry 13y agoYeah, the command line tool was really easy when I used it as part of my project https://github.com/abemassry/wsend-gpg https://github.com/abemassry/wsend-gpg
- jamesgeck0 13y agoIt's easy for a developer, sure. We need to make it Dropbox-easy for the general population, though.
- MWil 13y agoI'm not a developer. I just learned HTML/CSS so I'm a wannabe but there's nothing that I know less about than command-line interfaces.
- downer94 13y agoSo, no one ever dares to ask this, but I'm going to because I never see mention of it crop up in these sorts of discussions. Where do you draw the line between an individual's assertion of privacy over confidential information, and contrast it with the premise of intellectual property and the use of encryption to achieve goals traditionally perceived as less noble, such as DRM? Where does the distinction emerge, that my social security number and HIV status deserve protection, but an episode of Game of Thrones does not? I'm not asking this question because I don't understand the distinction. I'm asking this question because it's not often discussed. If information wants to be free, then what is our objective measure, to define the reason why we might choose to confine some, all or none of our information, especially when employing encryption?
- genwin 13y agoThe 4th Amendment implies that conversations about anything including the bits to Game of Thrones should be free from snooping, if only when those conversations are encrypted. Law enforcement can get a warrant when they have sufficient evidence of illegal activity.
- downer94 13y agoYeah, Phil Zimmerman's article mostly addresses intercepting vulnerable transmissions over a wire or through the air waves. Not so much about breaking encryption, and attacking a static target. I think Phil Zimmerman's assumption (at least, withing the context of this article) is that if you're attacking an sample of encrypted information, that act alone comes with the implicit understanding that you're probably acting against the interests of the person who locked the information away in the first place. Whether that person or group of people are worthy of the attack is its own judgement call.
- grahamburger 13y agoDRM and encryption aren't the same thing. I don't think anyone would complain that Game of Thrones is stored in an encrypted format on it's servers, or transmitted using encryption to broadcasting stations. Conversely, I doubt you would want your social security number or HIV status stored under DRM - you might lose access to that information in the future.
- anoncow 13y ago>Advances in technology will not permit the maintenance of the status quo, as far as privacy is concerned. The status quo is unstable. If we do nothing, new technologies will give the government new automatic surveillance capabilities that Stalin could never have dreamed of. The only way to hold the line on privacy in the information age is strong cryptography
- joering2 13y agoTo all the people and law enforcement officials that live by the "if you don't have anything to hide, you shouldn't worry about your privacy", I say that's your very own and primitive explanation. I hide/encrypt/lock my stuff because I DO NOT TRUST you in handling my private info and therefore my life. Most government org cannot keep their own stuff private, not to mention my personal info. Same applies to a lock on my house: I do not lock my door because I sit at home and build an atomic bomb and do not wont officials to know about it; I lock my door because you (LE) do a pathetic job at keeping my house safe from burglars. As I keep repeating, next 911 will not come in form of six people stealing our planes, on our airports hitting our buildings; it will come from Chinese/other government hackers stealing our own data, neatly stored and organized in our NSA's locker-rooms. And that's why its a horror idea for anyone to have all information on entire nation, within one database (I know its bit more complicated than that). As the nation and most others based its order on organized information, you can imagine entire country on a full economical lockdown, once all your credit card, all your social security info and all your data leaks out to third parties/pirates. http://en.wikipedia.org/wiki/Nothing_to_hide_argument http://en.wikipedia.org/wiki/Nothing_to_hide_argument
- nathanallen 13y agoOne of the best stories from the PGP saga is that Zimmerman worked with MIT Press to have the entire PGP source code published, in machine readable print. This allowed him to make the argument that his scary-dangerous-cryptosystem was in fact protected under the First Amendment as free speech.
- furyg3 13y agoIt gets better, they not only printed it out but also scanned it! http://www.pgpi.org/pgpi/project/scanning/ http://www.pgpi.org/pgpi/project/scanning/ Cryptography software was subject to export-control at the time... so they printed it out, and scanned it in Europe to create a 'clean' version of the software for use abroad (PGPi ). They continued to do this for new releases of PGP until the export controls were released. Must have made for a nasty devops relationship...
- jmtame 13y agoWow, that's one scenario I didn't even consider: the government making it illegal to use encryption. Blows my mind that you could some day be considered a criminal for using PGP.
- jrvarela56 13y agoCould there be an encryption mechanism that outputs valid sentences? If anyone tries to ban encryption they'd have to argue your text is encrypted because it doesn't make much sense to them.
- rcxdude 13y agoSuch steganography is sort of possible, though it's hard to make it not look like the output of a markov babbler.
- pestaa 13y agoI and my friends regularly sound exactly like the output of a markov babbler. "Hey, look, this is not encryption, we're just dumb!"
- jdiez17 13y agoYes, there even was such a tool posted on HN some time ago. I can't remember its name, but basically it got its corpus from twitter data. Maybe someone else can post a link?
- handsomeransoms 13y agoOne example is Bananaphone [0], which is designed to help Tor traffic look more like normal traffic to evade DPI. [0] https://lists.torproject.org/pipermail/tor-dev/2013-November/005737.html https://lists.torproject.org/pipermail/tor-dev/2013-November...
- cookiecaper 13y agoComputer-based steganography is destined to failure in the same way DRM is destined to failure. If a computer program can interpret the data, someone else can reverse engineer the formats until the solution is found. It might slow something down slightly, but is not likely to be effective alone. The reason computers and networks are useful to us is because they can instantaneously create perfect copies of long strings of numbers, which programs interpret to have specific meanings. If we have a use case where perfect, rapid proliferation may be problematic, computational digitization should be considered a suspect mechanism for the implementation of that use case. tl;dr: implement [at least most of] your steganography the old-fashioned way.
- jwr 13y ago…and yet so many of us (yes, even the tech geeks) do not use it. There's always a reason: it's too bothersome, we find the password prompts annoying, our friends don't use it, "it's not worth it for the unimportant stuff", "they'll get me anyway if they really want to". We complain about the NSA snooping, but we can't be bothered to properly encrypt our E-mail, even though the tools are right there, in front of us. For free. If you're on a Mac, use https://gpgtools.org https://gpgtools.org — there is really no excuse, it's so simple and straightforward to use. I'm sure there are even easier solutions on Windows and Linux.
- kingnight 13y agogpgtools is great. It integrates very nicely with Mail.app. Any suggestions for what to do on an mobile device to pair with desktop mail?
- ak86 13y agoI was just starting out with PGP today - and found iPGMail to be useful on iOS.
- bad_user 13y agoFor Linux there's Seahorse, the Gnome app for managing PGP and SSH Keys. It comes installed by default on Ubuntu. Generating a key and synchronizing it with a key server couldn't be more painless. For email clients, you can use Thunderbird or Evolution, both of which can handle PGP. There's also a new Chrome/Firefox extension that brings PGP to Webmail interfaces, such as GMail: http://www.mailvelope.com/ http://www.mailvelope.com/ ... because of a Firefox limitation, it's kind of slow on Firefox right now, but should get fixed in 27 and it also lacks advanced features (e.g. PGP Mime, or syncing with key servers), but those features are coming. Linux in general have the best security related tools. Ubuntu's graphical installer for example gives you the option to encrypt either your $HOME directory or your entire hard-drive (with dmcrypt). When formatting an USB Drive, you also have the option to encrypt it. And if you synchronize your files on DropBox or Google Drive, you can quickly create an encrypted folder by means of Encfs / gnome-encfs. And personally, I went full on with encryption. My hard-drive, my USB drives, my Dropbox, my Google Drive storage, all encrypted. I also link to my PGP public key in my email signature, which is cool, as my personal website serves links only through HTTPS.
- pasbesoin 13y agoMy heartfelt thanks, Phil, if you happen to be/visit here. Not just for the software, but for the accompanying philosophy and enlightenment, and dedication to same. The impact upon me, personally, has been significant. It is something I in turn attempt to share with those who matter to me, personally and professionally. Regards
- diasp 13y agoPGP isn't trivial but thanks to https://encrypt.to/ https://encrypt.to/ now everybody can send encrypted PGP messages.