

Encryption with Gnu Privacy Guard (GPG) - triberian
http://digital-era.net/encryption-with-gnu-privacy-guard-gpg/

======
jmnicolas
On all the encryption tutorials I found they always assume 2 and only 2 people
trying to talk privately.

I wonder how would one encrypt a conversation between say 15 people.

~~~
mike-cardwell
Multiple -r's:

gpg -e -r recipient1@example.com -r recipient2@example.com

That products some ciphertext which can be decrypted by either recipient.

~~~
roberto
I learned this the hard way when using gpg+mutt back in 2001. All my Sent mail
was being encrypted only with the recipient's key, so I couldn't read it
myself. There's an option to also encrypt outgoing email with your own GPG
key.

~~~
clogston
In case anyone is wondering how to make this the default behavior:

"encrypt-to YOUR_KEY_ID"

in your gpg.conf

------
schroedinger23
This article also suggests that you should use a 2048 Bit key, and you really
shouldn't. Better to go with 4096 Bit. And I guess every CPU is fast enough.

------
calibwam
This does not go into the Web of Trust and having your key signed, maybe the
most complicated part of PGP, and perhaps also its most important feature.

~~~
eli
Web of Trust isn't too useful if you don't know how to sign a message or check
a signature.

~~~
cyphunk
Specifically "check a signature". Even everyone that knows how to sign fail to
really check anything. Honestly, if it aint boiled down to a green or red icon
then people are going to misuse, assume security when its not, or just click
"yes".

If you get a new public key for someone, and it's signed by someone else you
don't know (most of the time this is the case) are you going to bother to
utilise that signature to increase the trust? No. Are you going to assume
increased trust somehow regardless? Yes. FAIL.

Modify it further, if it is signed by someone you do know what are the chances
your UI is going to give you any sort of indication that this is more trusted
that other message workflows? And if it doesn't give you any indication (most
leave it up to you to check) who's gonna bother to look just passed "your
friend <yourfiendsname@company>" ASCII and actually check the key? no one.
FAIL.

PGP WoT fails miserably.

~~~
mike-cardwell
I use PGP extensively. However, I haven't bothered with the web of trust, for
the same reason I don't publish my address book for everyone to read, privacy.

~~~
Torgo
I have already run into this at work. I have customers whose keys are publicly
available, and others who should not be, and so I cannot effectively use
keysigning internally to manage relationships. This is because I don't want to
upload every key I know about to a public keyserver.

Maybe I am mistaken or maybe there's a way to do that without having multiple
keyrings or something, but that's kind of the problem. It's really hard to
tell what I would or would not be sharing because there's no "interface" to
speak of and I am hardly an expert.

------
egeozcan
There seems to be also a windows implementation:
[http://www.gpg4win.org/](http://www.gpg4win.org/) (Wondering why the site
doesn't use ssl, though)

On a related note, I have a hard time understanding why a web site talking
about digital security also doesn't have a certificate.

~~~
IgorPartola
Lots of GPG themed sites do not. Notice that key servers provide web access
over plain HTTP as well. My best guess is that they do not want to buy into
the CA infrastructure and provide security using GPG itself. Also check out
MonkeySphere.

~~~
egeozcan
> My best guess is that they do not want to buy into the CA infrastructure and
> provide security using GPG itself.

This may be true (I really have no idea) but isn't it like travelling on a
highway at night with your normal lights turned off because you have a better
system based on infrared? After reading about the story of that guy who hacked
into a computer by MITMing the notepad++ site, I became even more convinced
that all pages must have certificates. Nowadays it's also possible to get a
basic ssl cert for free, I can't figure out what the catch is really.

~~~
IgorPartola
Don't get me wrong, I agree with you. Even my personal 100% static content
site is served over HTTPS only. I am just commenting on the pattern that any
GPG-themed sites I've seen follow.

------
kzrdude
Did anyone else see reop recently? It's a sort of simple reimagining of easy-
to-use public key crypto.
[http://www.tedunangst.com/flak/post/reop](http://www.tedunangst.com/flak/post/reop)

------
vitaluha
"To encrypt a File:"

    
    
        gpg -o encrypted_file.gpg –encrypt -r original.file  
    

# they didn't put recipient after -r ?

~~~
reedalex01
In this case it will just prompt you for for the recipient. This command is
too verbose though. You can type:

gpg -e file

The output will be file.gpg. It will ask you for a recipient unless you have
"default-recipient" or "default-recipient-selt" set in gpg.conf.

------
ausjke
Best blog on using GPG that I have seen. Thanks!

