News for hackers. Stuff that matters.
Re:Modern Alternatives to PGP by lucb1e on Friday February 15, 2019 @04:11PM (#19174756)
> No one was sending you encrypted emails anyway

Guess what! Since I moved to Germany (from the Netherlands), I noticed that people send a lot of encrypted mail. Not random Germans, sure, but where in the Netherlands the security and broader hacker community was hard to convince, in Germany it's quite widespread. My colleagues (security firm) and friendly security firms (when we collaborate) expect nothing less, and even customers supporting it is not rare (it was very rare (like, one customer in dozens) when I worked in NL).

It depends on your peers whether you find PGP is usable or not, it seems.

Then again, in Germany quite a few websites used OpenStreetMap before it was cool^W^W google raised their prices, and Linux is also more widespread. I wonder what it's caused by and how we can encourage it, since I think we (HN) would generally consider those things to be good, at least for fellow hackers, even if the tech has some edges too rough for the general population.

Re:Modern Alternatives to PGP by ForHackernews on Friday February 15, 2019 @04:35PM (#19174956)
> I wonder what it's caused by and how we can encourage it

Probably because many Germans have a relatively recent memory of the Stasi in the DDR.

Re:Modern Alternatives to PGP by lucb1e on Friday February 15, 2019 @04:39PM (#19174976)
The Dutch probably do to a similar extent. We were quite involved in the war, unfortunately, and burning records to avoid involving jews/romas/homos/etc.

But yeah it's the only thing I can think of as well. I still can't pinpoint what argument it is that they are implicitly taught that we aren't.

Re:Modern Alternatives to PGP by codetrotter on Friday February 15, 2019 @05:05PM (#19175144)
I think they are taught the same that the rest of us are, but their country has the first hand experience that enables them to see and understand on a deeper level just how important civil liberties and privacy is.

Nazi Germany passed laws restricting the public and private lives of “non-aryans” and other groups of people that they deemed lesser. With such laws, they turned the country from a democracy to a dictatorship. The nazis proceeded to kill millions of people, most of them Jewish.

And after that, there was like the parent commenter said the Stasi in East Germany, who was subjecting millions of people to mass surveillance.

And like I said, they have the first hand experience, so it certainly is more ingrained and near to life for the people of Germany than it is to everyone else.

Re:Modern Alternatives to PGP by Krasnol on Friday February 15, 2019 @05:05PM (#19175141)
Stasi is not that long ago.

People tend to forget what the problem was during WW2.

See rise of right wing parties (also in Germany...).

Re:Modern Alternatives to PGP by robotrout on Friday February 15, 2019 @05:30PM (#19175325)
Censorship seems to be coming from the left. I think it makes sense for everybody to maintain as much privacy from .gov as possible.
Re:Modern Alternatives to PGP by eropple on Friday February 15, 2019 @06:05PM (#19175577)
So...you are aware that "saying that makes you an asshole" and "you can't say that" are different things, yes?
Re:Modern Alternatives to PGP by int_19h on Friday February 15, 2019 @08:53PM (#19176481)
In Germany, it's "you can't say that", which is I think what he's talking about. Germany is probably the most extreme in the Western world in that regard - they have e.g. a court that can ban political parties if their platform is "counter to the free democratic basic order". Not to mention minor censorship, like excising swastikas and mentions of Hitler (ironically, a recent example was with a game about how Nazis are bad and you should fight them).

https://en.wikipedia.org/wiki/Streitbare_Demokratie

Re:Modern Alternatives to PGP by robotrout on Friday February 15, 2019 @07:27PM (#19176087)
Attacks on free speech in USA and Europe have nothing to do with offensive language and everything to do with control. Be careful what precedents you set and what things you celebrate. Pendulums swing.

Are you referring to this? I don't think anybody tried to censor her for this, even though it was incredibly offensive. https://talkingpointsmemo.com/news/tlaib-going-to-impeach-mo...

Re:Modern Alternatives to PGP by Krasnol on Friday February 15, 2019 @07:43PM (#19176177)
And here we go with the currently popular victim game which also brings the famous "censorship vs. moderation" trope and the "das wird man doch wohl noch sagen dürfen" classic.

Please...this is ridiculous. Nobody falls for that besides the right wingers themselves.

Nobody wants the right circle jerk in their comment section. The same way the right doesn't want any criticism of their behavior within their own bubble portals.

Re:Modern Alternatives to PGP by afiori on Saturday February 16, 2019 @08:54AM (#19178547)
both the left and the right are in a bubble. Generally speaking assume that between your in-group there are as many bad people as in your out-group.

It is hard to make example that would not further polarize this thread, but I can promise you that the same intolerance and bubbles are present on both side of the political spectrum (for sure in the US, even if I live in Germany now I don't know much about this country...)

Re:Modern Alternatives to PGP by Krasnol on Saturday February 16, 2019 @09:54AM (#19178760)
I don't complain about bubbles.

I brought the bubble up to demonstrate that the right is moderating all kinds of not fitting content where they are able to.

The big conspiracy the right wants to paint here based about moderation of their hate speech or pure insulting language is something that is being reinforced through their political figureheads and sold as censorship. I did not see anything like that on the other side (yet).

It's a disgusting and ridiculous play, especially in regard of real censorship which is really out there today.

Re:Modern Alternatives to PGP by sowbug on Friday February 15, 2019 @05:20PM (#19175260)
See https://en.wikipedia.org/wiki/The_Lives_of_Others if you don't personally have that memory but would like to understand it.
Re:Modern Alternatives to PGP by lower on Friday February 15, 2019 @05:32PM (#19175340)
While this is a good movie, one should be aware that it does not reflect the reality in Eastern Germany all that well. It's not a documentary.

In preparation for the film, the director asked Christoph Hein, an Eastern German writer, to describe the typical life of a writer in Eastern Germany (which is what the film is about). At the premiere, Hein's name was included in the opening credits, but he asked to have it removed, because he couldn't see his story in the film. He described the film as being more of a dark fairy tale than a depiction of life in 80s Eastern Germany.

Re:Modern Alternatives to PGP by everybodyknows on Friday February 15, 2019 @10:39PM (#19176908)
>he couldn't see his story in the film ...

Published comments, just last month. In German -- would any bilinguals care to summarize?

https://www.sueddeutsche.de/kultur/donnersmarck-hein-das-leb...

Re:Modern Alternatives to PGP by Zeratoss on Saturday February 16, 2019 @06:37AM (#19178197)
He describes the movie as an overly dramatic dark fairy tale and says he doesn't recognize himself in the main character. As far as specific criticism goes, he says the way the main character has to write in secrecy and is suppressed by the Stasi is inaccurate. He says his room was bugged in the 60s but the 80s in the DDR were supposedly much more liberal than what the film shows.
Re:Modern Alternatives to PGP by sowbug on Saturday February 16, 2019 @07:29AM (#19178293)
I read only the automatic Google translation to English, so this might be a misreading, but he does seem to recognize that he was being a little too pedantic in expecting historical accuracy in a dramatic work.
Re:Modern Alternatives to PGP by sowbug on Saturday February 16, 2019 @05:15AM (#19178014)
A friend recommended it to understand why people in certain areas of the world feel more strongly about mass surveillance. For that purpose it's a good movie -- not because of its historical accuracy, but because of its plausibility. The motivations of the characters were straightforward, and the technology unremarkable. No psychos or unobtanium needed.
Re:Modern Alternatives to PGP by tptacek on Friday February 15, 2019 @07:34PM (#19176123)
That's nice and all, and I don't doubt it, but in this instance, that cultural memory is (ironically) leading Germans to use inferior cryptography, and isn't serving them well.
Re:Modern Alternatives to PGP by lucb1e on Saturday February 16, 2019 @01:17AM (#19177371)
Care to substantiate? What inferior encryption are you talking about?
Re:Modern Alternatives to PGP by e12e on Saturday February 16, 2019 @08:46AM (#19178516)
Presumably old encryption/sign constructs used by pgp/gpg coupled with issues with serialization/de-serialization of data/cipher text?
Re:Modern Alternatives to PGP by afiori on Saturday February 16, 2019 @08:59AM (#19178565)
you know what is worse than inferior cryptography? no cryptography. security is a human problem and people like me needs a well supported tool with lots of tutorial and plugins for almost every application and a manageable sets of quirks.

I agree that the illusion of security has drawbacks, but so does using too many tools that you don't properly understand.

Re:Modern Alternatives to PGP by rakoo on Sunday February 17, 2019 @05:48AM (#19183788)
Actually inferior (aka broken) cryptography is worse than no cryptography, because it makes you feel safe when you should at least know you aren't.
Re:Modern Alternatives to PGP by blattimwind on Friday February 15, 2019 @05:04PM (#19175137)
I have PGP keys on the keyservers but don't actively look random people up and send encrypted mail on first contact (perhaps something that can be automated). I'm surprised how often the reply I receive when contacting some German (.de) open source person is PGP encrypted.
Re:Modern Alternatives to PGP by fefe23 on Saturday February 16, 2019 @06:26AM (#19178168)
Please sign your outgoing mails if you have a key.

Of the PGP mails I get, most are just encrypted to me. That is cryptographically not a sound idea, but it also means that I cannot encrypt back, because I don't know which key to encrypt to.

The keyservers do not validate anything. They are just a storage medium. In fact, for my personal e-mail address, a prankster has uploaded a rogue key. There is no process by which I can ask for its removal. People who just take the key from the keyserver have a 50% chance to send me data I cannot decrypt.

This is not a PGP weakness. It has been quipped that cryptography is a method to reduce a generic problem to a key exchange problem. There is some truth to that.

Re:Modern Alternatives to PGP by Squithrilve on Saturday February 16, 2019 @07:15AM (#19178268)
> Please sign your outgoing mails if you have a key.

It's interesting that even Edward Snowden made this mistake of sending only encrypted email.

For more elaboration about this subject K-9 resources are quite good:

https://k9mail.github.io/2017/01/30/OpenPGP-Considerations-P...

Re:Modern Alternatives to PGP by dgrove on Friday February 15, 2019 @05:07PM (#19175167)
> perhaps something that can be automated

This is solved using WKD. Thunderbird already supports this with enigmail enabled

Re:Modern Alternatives to PGP by Boulth on Saturday February 16, 2019 @03:56AM (#19177813)
Yes, WKD works well for people in control of their own domain (e.g. kernel.org uses it).

For other people there is also https://autocrypt.org/

Re:Modern Alternatives to PGP by pjmlp on Friday February 15, 2019 @05:17PM (#19175241)
Everyone at the office sends encrypted emails when referring to sensitive data.

It helps that encrypting emails is one button away on Outlook.

Re:Modern Alternatives to PGP by paulryanrogers on Friday February 15, 2019 @11:16PM (#19177028)
Are you referring to an Outlook PGP add-on or SMIME?
Re:Modern Alternatives to PGP by pjmlp on Sunday February 17, 2019 @05:44AM (#19183777)
I am referring at out of the box support support, whatever that may be, as we are an MS Office shop regarding office tooling.
Re:Modern Alternatives to PGP by Boulth on Saturday February 16, 2019 @03:57AM (#19177816)
I'm also interested in it.

For the record there is GpgOL plugin installed with gpg4win.

Re:Modern Alternatives to PGP by thecleaner on Saturday February 16, 2019 @04:29AM (#19177890)
You may be surprised. At some companies i have worked, people passes access keys without encryption.
Re:Modern Alternatives to PGP by AceJohnny2 on Friday February 15, 2019 @06:04PM (#19175572)
Noting that GPG's main maintainer, Werner Koch, is German too.