TR Forums

I work with and teach about certificates on a nearly constant basis, but I don't actually leverage the technology at home.

Hell, I could even understand the viewpoint that such a thing isn't needed at home. With the way the world is changing I'm - personally - less inclined to believe that at this point.

I don't see where I necessarily needed to be validated by one of the massive public CAs and GPG would seem to be a great fit for the things I want to do (largely using digital signatures).

Before I install Gpg4win I was hoping someone here might have some feedback about the quality of the platform or even just that you're content with what the software provides.

GPG is pretty nice. It's mostly in disuse at my house, simply because the few people I associate with most often aren't using it, and very rarely do I need that level of security and/or identity verification.

I get a lot more mileage out of TrueCrypt, though.

For my personal email, I don't. When I was running a non-profit corp, my email for that was always signed. I only encrypted it if it had sensitive data in it. I use Thunderbird as my mail client and the gpg plugin for it worked quite seamlessly.

I also use truecrypt a bunch, though only for very important stuff right now. I'm moving towards using it for less important stuff too, mainly so the important stuff doesn't stick out like a sore thumb.

--SS

I've used it at work, but that was to satisfy a requirement for encrypting/signing software we distribute. I don't use it at home.

IMO there's a certain level of paranoia that is appropriate for personal use, and I have not yet crossed the line into believing that I need GPG in my personal life.

I do, however, tend to use encrypted tunnels to SOCKS proxies that I personally maintain if I web surf while on the road, if I'm doing anything more sensitive than looking up Google Maps directions to help me find the place I want to go to for dinner. So I suppose I'm more paranoid than your average smartphone or public WiFi user, but less paranoid than your average GPG user!

My inclination to use personally maintained SOCKS proxies has only been reinforced by the recent revelations that commercial web proxy filters/servers facilitate "man in the middle" attacks -- they are allowed to (and sometimes do!) spoof SSL certificates of other web sites. So if you access your personal bank account from a public WiFi (or from work, if this is allowed by your employer), you have no guarantee that someone at the place providing the WiFi access (or in your employer's IT department) isn't snooping on you, even if it is an HTTPS connection.

F**k that.

And yeah, my strategy isn't bullet-proof; it still assumes that your home ISP (or the provider of the hosting service you're using for the proxy) isn't compromised. But it (sort of) assumes that there isn't a targeted effort against YOU specifically... and I don't have enough money or influence to be an attractive target for that.

Online privacy is an illusion... even if you stay off of Facebook!