Encryption is a political topic. Get it off HN.
I'm giving up on PGP
281–290 of 350 posts
Re: I'm giving up on PGP
#282Re: I'm giving up on PGP
#283Summary: The author decided that being connected to long term keys does more harm than good, partly due to the pressure to stay with potentially compromised keys due to the difficulty of starting over. The author will instead focus on secure IM using short term keys bootstrapped by social media accounts. 1) As others have pointed out, I really think the author is overestimating the effort required to compromise a twi…
Kind of off topic: I really like iMessage. Not to be an Apple fanboi, but it really is one of those things where It Just Works(tm). Encryption shouldn't have to be something the end user has to worry about; it should be transparent to the user while still being as secure as possible (HTTPS and TLS are a great example of this). For the user who cares about encryption, they don't have to configure anything. For the use…
> By baking it into the OS, Apple ensures that anyone with an iDevice benefits from it.
But only people with iDevices benefit from it. I prefer Signal to iMessage because iMessage is iOS only, and I'm disappointed with Google for not including an iMessage equivalent with secure messaging by default.
> Compare that to having to download an app that may change depending on possible compromises.
If you mean what I think you mean, using iMessage will not save you/them from this any more than using Signal would, the only benefit to iMessage is that it's already installed on iDevices when you buy them and has secure-messaging enabled by default.
Which is still a step above Android currently - which has no default-installed secure messaging app at all.
I'm lookin at you Google!
Re: I'm giving up on PGP
#284I find very interesting the point about the split between what WoT was supposed to be, in theory, and what little it represents, in practice, in terms of practices about key verification. It has been said many times that the lack of adoption of pgp in mail was due to the average user not being able to grasp the concepts behind the proper operation for key management, but the article points to common practices among "…
Is there anything that enables key exchange via smartphones? Ideally it should be as easy as a meatbag handshake. Basically, if you can swap contacts via NFC then the pgp keys should go along with it. It may have some theoretical weaknesses such as the exchange being MITMable if the users don't verify something on their screens, but I think having many more edges in the graph would make up for it since you might alre…
https://www.cylab.cmu.edu/safeslinger/ does simple handshake exchange and works w/iOS/Android but unsure if still maintained
Re: I'm giving up on PGP
#285[deleted]
Re: I'm giving up on PGP
#286Earlier quoted context omitted.
99% of crypto would work just fine if you appended an OTR-like protocol over the top of email. First email is "hey we're interested in blah..." and is sent in the clear. Then have the message window change color as subsequent emails get the protocol more secured.
I hate color coding. I'm in the 8-12% of men that have red-green deficient vision. You can use 10% as a rule of thumb. If I'm not mistaken in my probability math, that means in a group of 5 men, there is a 50% chance one of them is "color blind." Yet the world insists on using red/green as bad/good indicators. Drives me nuts.
>Yet the world insists on using red/green as bad/good indicators. Drives me nuts.
Well, it has to use something, and other people would be colorblind in other colors, plus some will be blind too.
In this case, one would expect there'd be some OS-wide color utility to alter colors to the ones the user can discern.
Re: I'm giving up on PGP
#287Years ago I worked with a guy who literally wrote a book about how to use PGP. I asked him if he could help me set it up and he said "I don't use it, it's too hard."
It's not too hard, at least not on Linux and for anyone with some familiarity with the terminal. Getting started can be done like this...
Install GPG:
sudo apt-get install gnupg
gpg --gen-key
gpg --armor --export $your_uid > your_public_key.gpg
gpg --import my_public_key.gpg
gpg --edit-key $my_uid
gpg --output message.gpg --encrypt --recipient $my_uid message.txt
gpg --output response.txt --decrypt response.gpg
Re: I'm giving up on PGP
#288Earlier quoted context omitted.
Not to be glib, but this is true in much the same way as secure http. Really the only way to do it properly is to control the root key for your organization. The chain of trust starting with the vendor you got the computer from is bonkers.
It's pretty bonkers that you trust a computer vendor to control the firmware on your PC but not the CA chain. If Dell is determined to listen to your conversations, they can spy from the hardware, keylog beneath the OS, or literally listen through an embedded microphone.
People don't trust their hardware vendors because they're trustworthy, they trust them because they don't have any real choice.
If my preferred OEM offered me the choice between a locked-down opaque system, and an /equivalent/ system that is completely open and verifiable, I'd choose the second option every single time. I expect many would as well.
Re: I'm giving up on PGP
#289PGP may have broken down for the author, but it's still used in a lot of places . For example, to communicate with our bankers at work, every email has to be properly encrypted and signed - or it goes into a blackhole. The only way to exchange public keys(initially) is in person. Once that is done, new keys are provided from that person, and the WoT expands. tldr; it doesn't work for the author, but it does work for…
He doesn't say that it's useless but that it's too much hassle to use even for someone that works in security.
It works in companies because you don't get a choice if you did most people wouldn't use it.
Re: I'm giving up on PGP
#290Earlier quoted context omitted.
I hate color coding. I'm in the 8-12% of men that have red-green deficient vision. You can use 10% as a rule of thumb. If I'm not mistaken in my probability math, that means in a group of 5 men, there is a 50% chance one of them is "color blind." Yet the world insists on using red/green as bad/good indicators. Drives me nuts.
> Yet the world insists on using red/green as bad/good indicators. Drives me nuts. Well, it has to use something, and other people would be colorblind in other colors, plus some will be blind too. In this case, one would expect there'd be some OS-wide color utility to alter colors to the ones the user can discern.
Yes, but these other ones are far more rare. Also there are shades that make it so much assessable for people. Almost every day I will ask someone what color something is because of poor selection. Chances are you have a color blind person in you office, just run visualizations by them really quick.