Re: encrypt.el in No Gnus 0.7

    RS> I just looked at encrypt.el.  It appears to
support just GnuPG
    RS> and "Built-in simple XOR".  And
built-in simple XOR is just an
    RS> example, not for real use.

    The idea is to allow users to supply their own ciphers,
and to support
    other external utilities as users find it necessary.

It is a sensible feature, but is it worth including in
Emacs?  I am
not convinced this is sufficiently useful to be worth
including.

Is there any sign that users use it?

    1) users don't have to install GnuPG to use simple
obfuscation ciphers
    (yes, this is sometimes useful).

If you mean Rot13, aren't there other interfaces for that? 
It seems
to me that we don't want to use the same command for Rot13
as we use
for GPG, because it is inconvenient to have to select one or
the other
each time.  We want two different commands.

    3) other external utilities can be supported.

Are there any that are useful to support?

    4) ciphers, being Emacs Lisp code, can do almost
anything: SSH to a
    remote machine, use BBDB, use IMAP, use version
control...

I really don't like the idea of labeling such things as
"encryption".

All in all, encrypt.el still looks like unnecessary
complexity which
doesn't pull its weight.


_______________________________________________
Emacs-devel mailing list
Emacs-develgnu.org
htt
p://lists.gnu.org/mailman/listinfo/emacs-devel

On Mon, 05 Nov 2007 03:47:04 -0500 Richard Stallman
<rmsgnu.org> wrote: 

RS> I just looked at encrypt.el.  It appears to support
just GnuPG
RS> and "Built-in simple XOR".  And built-in
simple XOR is just an
RS> example, not for real use.

RS>     The idea is to allow users to supply their own
ciphers, and to support
RS>     other external utilities as users find it
necessary.

RS> It is a sensible feature, but is it worth including
in Emacs?  I am
RS> not convinced this is sufficiently useful to be worth
including.

In my experience, giving users creative freedom is always
worth it.
Emacs is built around the idea of letting users do what they
want, isn't
it?  I am surprised you are OK with locking Emacs users into
GnuPG,
which is nice software but certainly not the only way to do
encryption.

RS> Is there any sign that users use it?

The package was in Gnus, and I don't have bug reports.  I
have not
advertised the library so far, except for brief notes to
Gnus users.  So
I don't have a sample big enough to answer your question.

RS>     1) users don't have to install GnuPG to use
simple obfuscation ciphers
RS>     (yes, this is sometimes useful).

RS> If you mean Rot13, aren't there other interfaces for
that?  It seems
RS> to me that we don't want to use the same command for
Rot13 as we use
RS> for GPG, because it is inconvenient to have to select
one or the other
RS> each time.  We want two different commands.

I don't mean ROT13 specifically.  I keep repeating this: the
users will
come up with interesting ciphers.  Instead of anticipating
their needs,
the API should support them by being simple and flexible.

In any case, the user wouldn't select a cipher each time. 
The
encrypt-find-model function will determine the encryption
model,
currently from an alist.  The user chooses, for example,
that
~/.authinfo is encrypted with GnuPG, but ~/emacs/*.el will
use cipher X
because it's more appropriate.  Perhaps cipher X is the XOR
cipher
because the user is OK with simple obfuscation.

RS>     3) other external utilities can be supported.

RS> Are there any that are useful to support?

I found a few GPL ones (just a sample list) with a simple
web search:

MCrypt http://mcrypt.sourcefo
rge.net/
AxCrypt http://www.axantum.co
m/AxCrypt/
ScramDisk 4 Linux http://sourcefo
rge.net/projects/sd4l/
Several steganography tools (hide data inside an image, for
example)

They all do things GnuPG doesn't as far as I can tell,
though some
functionality may overlap.

RS>     4) ciphers, being Emacs Lisp code, can do almost
anything: SSH to a
RS>     remote machine, use BBDB, use IMAP, use version
control...

RS> I really don't like the idea of labeling such things
as "encryption".

External functions may be involved in customizing the
encryption process
Here are some examples (again, I'd rather let the users
implement what
they need, this is just my list of things I might find
interesting):

- use BBDB to store shared keys or public keys

- get shared or public keys from an IMAP server (stored in a
message)

- on a CVS/SVN/etc. checkin/checkout, use another file in
the repository
  to modify the shared key or as the shared key

- pure Lisp ciphers for quick experimentation and sharing

Ted


_______________________________________________
Emacs-devel mailing list
Emacs-develgnu.org
htt
p://lists.gnu.org/mailman/listinfo/emacs-devel

On Mon, Nov 05 2007, Richard Stallman wrote:

>     RS> I just looked at encrypt.el.  It appears to
support just GnuPG
>     RS> and "Built-in simple XOR".  And
built-in simple XOR is just an
>     RS> example, not for real use.
>
>     The idea is to allow users to supply their own
ciphers, and to
>     support other external utilities as users find it
necessary.
>
> It is a sensible feature, but is it worth including in
Emacs?  

Some thoughts...

I think it would be useful to have at least one builtin
encryption
(without requiring external programs) in Emacs, if
possible.

The cipher should be significantly better than obfuscation
(ROT13) but
it doesn't need to be as GPG's ciphers.  I'm thinking of
protection of
for not-too-valuable stuff like email and NNTP passwords
(e.g. passwords that are stored completely unprotected on
disk by many
users up to now) against (accidentally?) exposing it to
your
administrator, colleagues, family members, etc.

How strong or week are the builtin ciphers compared to e.g.
the
algorithm used in Firefox/Thunderbird's password manager (I
couldn't
find out which cipher the use)?  How long does it take on a
"standard
PC" to break an ~/.authinfo file protected with a
password of say 8
chars?

> Is there any sign that users use it?

As it was not part of any released Gnus version, so I can't
be in
widespread use.

Bye, Reiner.
-- 
       ,,,
      (o o)
---ooO-(_)-Ooo---  |  PGP key available  |  http://rsteib.home.pages
.de/


_______________________________________________
Emacs-devel mailing list
Emacs-develgnu.org
htt
p://lists.gnu.org/mailman/listinfo/emacs-devel