Hacker News Reader

Comment by StreamBright | Hacker News Reader

First off PGP is not a great security tool, second of all the EU can just stop the GPG encrypted messages at the service provider level.

The ultimate solution against government stupidity like this is a full mesh based “internet” that is based on connections between homes without using an ISP. It is not going to happen for obvious reasons (90% of population is non-technical for starting).

View on HN

> The ultimate solution against government stupidity like this is a full mesh based “internet” that is based on connections between homes without using an ISP.

Completely agree. Communications infrastructure has always been centralized. Service providers are easy targets for governments. We'll never be free from their tyranny until we have completely decentralized networks.

> service provider level

I think the parent comment was going to mail such drives, and good luck getting the EU to agree on blocking anything on their independent providers level.

They've been pretty good at banning things at the provider level. Sites in the UK seemingly get banned by everyone as soon as the government requests it. Similar in Germany, and they go out of their way to analyze most or enough torrent data going through I believe all ISPs to detect what you pirate. Doing the same for detecting encryption doesn't seem farfetched.

> Sites in the UK seemingly get banned by everyone as soon as the government requests it

I live in the UK this is not correct, these are voluntary agreements by ISP's and you can opt out of the default filtering.

I think the only time something has been blocked here it was due to a Court Order: https://www.virginmedia.com/help/list-of-court-orders

I mean that's still a fair amount of sites. I recognize and have used plenty of those.

Great is subjective but GPG is pretty good and could be argued as great. It was based on “Pretty Good Protection.”

EU can’t stop GPG encrypted messages at the service provider level because the content looks like any other base64 traffic or can easily be made like that.

Well, depends how it's sent. The header information in an encrypted message is unencrypted. Using an MUA, the body of the message will be sent as an inline attachment. The contend definition of the boundary for the attachment is Content-Type: application/pgp-encrypted, which is trivial to detect. A encrypted attachment that uses a generic application/binary or text/plain starts with -----BEGIN PGP MESSAGE----- or 2d 2d 2d 2d 2d 42 45 47 49 4e 20 50 47 50 20 4d 45 53 53 41 47 45 2d 2d 2d 2d 2d, which again is trivial to detect.

Edit: I'm not suggesting PGP itself is bad because of this. There are many other reasons why you should consider other methods of sending messages securely that aren't email or PGP.

What I meant is it’s trivial to change the content type and to change the attachment format so it doesn’t match specific GPG formats.

The content type is done now for convenience, but there’s nothing stopping me from using GPG to generate a message and send it with the content type of a text file or zip or whatnot.

Of course there are other methods, but GPG is free, stable and works as expected.

Email on the wire is mostly all TLS encrypted these days. Generally offline encryption like PGP encrypted email is moe secure than, say, instant messaging:

* https://articles.59.ca/doku.php?id=em:emailvsim

Reply on news.ycombinator.com