Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I'm giving up on PGP

blog.filippo.io

Post reply on HN
Print view View original

301–310 of 350 posts

Re: I'm giving up on PGP

#301

Post by rebuilder »

eropple wrote: post #271
marssaxman wrote: post #269

Earlier quoted context omitted.

I take your point - though I was not intending to yell, but to represent my state of alarm and bafflement, as the original poster's worldview is both alien and frightening. It's as though someone were circulating one of those "modest proposals" to improve automobile security by installing a sharp metal spike on the center of every steering wheel, without realizing that these things are supposed to be jokes. A univers…

There's a power curve though, yeah? That most powerful agent can just drag you off and apply rubber-hose cryptography. Or just drone your ass. At some point, worrying about what else they can do is kind of a whateverburger.

They can do that, but it'snot cheap for them. Giving the government total, automated access to your communications - and that's what we're talking about here IMO - lets them (and you, admittedly) avoid the whole beating scene. In real terms, it would drastically change the balance of power.

Re: I'm giving up on PGP

#302

Post by rebuilder »

user5994461 wrote: post #233
spenczar5 wrote: post #220

Earlier quoted context omitted.

I think that issue is central. You're describing a scheme with a central, trusted authority distributing keys. The question is, what's a central authority we can all trust? I think many people wouldn't trust any government. At that point, the design crumbles.

Well. You trust your government to issue national ID card and e-passports already.

Those are identification. Carrying a passport doesn't let anyone listen in on my inane banter with my friends.

Re: I'm giving up on PGP

#303

Post by mnw21cam »

caf wrote: post #280
jballanc wrote: post #258

Earlier quoted context omitted.

I think a Poison distribution would be more appropriate here, so the probability of 1 man in 5 being colorblind, assuming 10% of the population on average is colorblind, is: e^-0.5*sum((i)->(0.5^i/factorial(i)), 1:5) = ~39%

I don't believe so - it's n instances of a bi-valued random variable, IID. It's exactly the case the binomial distribution covers.

Exactly. You have five chances at an event, and an event probability per chance, which is exactly what the binomial distribution is for.

The Poisson distribution is what you use when the effective number of chances is "large". The Poisson distribution is effectively a special case of the binomial distribution, where the number of chances is infinity, the probability per chance is infinitesimal, and the product of the two is the expected number of events.

Re: I'm giving up on PGP

#304

Post by anc84 »

m3ta wrote: post #99
FiloSottile wrote: post #90

Earlier quoted context omitted.

Agreed, I link to that Gist exactly in the "Moving Forward" section ;)

I must have missed that. I don't understand what the point of your blog post is, in this case. You understand why PGP is needed and how it's important, how to use it correctly, etc, yet you "give up" on it because no one you know uses it correctly. Is that it? By the way, how are you going to send someone a 5GB file securely using Signal?

Encrypted in any way, hosted anywhere safe, sending the passphrase via Signal, done.

Re: I'm giving up on PGP

#305

Post by lmm »

pdkl95 wrote: post #140
jerf wrote: post #13

Earlier quoted context omitted.

"I wonder if pgp is fundamentally flawed, or we have a deep conceptual usability issue here." I think it's the key model that's fundamentally flawed rather than pgp itself, which I believe the author of the article is also asserting. In cryptography, it is often explained that despite the fact a one-time pad is guaranteed-secure (given various conditions I'm eliding), it is not practical in the vast majority of cases…

> How do you distribute the one time pad in the first place? Something I've wanted to make for a while now, that should be possible to make with almost any cheap embedded microcontroller, is a hardware dongle that stores OTP pads. This would be a generic character device that could be integrated into existing chat programs. * Each device has a hardware RNG, e.g. [1] or similar * A port that allows two devices to conn…

I suggest implementing version 0.1 as either a frontend to GPG with key on an existing smartcard (Yubikey or similar), or at least something that uses the existing OpenPGP standard for encryption. That way you don't have to worry about doing the cryptography from scratch and can focus on the UI side (which is hard enough on its own) and the fingerprint exchange (which is what your "extra port" needs to be). You don't have to make sure your device gets critical mass, because existing PGP users can interoperate with it (there already e.g. PGP plugins for instant messenging programs that you could adapt rather than having to write your own plugin ecosystem). And you may well end up producing something that's more useful to more people.

Re: I'm giving up on PGP

#306

Post by mnw21cam »

module0000 wrote: post #92

PGP may have broken down for the author, but it's still used in a lot of places . For example, to communicate with our bankers at work, every email has to be properly encrypted and signed - or it goes into a blackhole. The only way to exchange public keys(initially) is in person. Once that is done, new keys are provided from that person, and the WoT expands. tldr; it doesn't work for the author, but it does work for…

Oh, how I would love it if my (personal) bank/utility/isp would send me PGP-encrypted/signed emails, instead of emails saying "There is some updated information for you on our web site, please log in to see it".

But given the general competence demonstrated by such organisations, it's something I will never see.

Re: I'm giving up on PGP

#307

Post by mnw21cam »

vacri wrote: post #205
devilsavocado wrote: post #107

People who use PGP keys, can you give examples of your use? I'm genuinely curious. Who are you contacting, or who is contacting you? The author says he only receives 2 encrypted emails a year. Not only do I not have a PGP key, I don't think I've ever found myself in a situation where it was even an option to use one.

Signing .deb packages. Debian and its derivatives are core users of gpg as it's basically a requirement to sign installation packages - if the user doesn't have the key in their trust store, they get a big fat warning when they try to install said package.

Debian package managers comprise a surprisingly large proportion of the strongly-connected set.

Re: I'm giving up on PGP

#308

Post by mnw21cam »

milge wrote: post #14

I've been thinking a lot about PGP and other encrypted messengers lately. It's incredibly hard to get a lot of people to agree on one messaging app besides default SMS. I wish there was an open source suite of tools for mobile/desktop that easily layered PGP on top of SMS/email experience and would fall back in the absence of keys. Perhaps bluetooth for swapping keys with friends. It's something that needs to be seam…

> ...bluetooth for swapping keys...

First rule of PGP keysigning parties - don't bring a computer. (Or at least if you do, don't turn it on.)

Re: I'm giving up on PGP

#309

Post by TheGrumpyBrit »

runn1ng wrote: post #103
module0000 wrote: post #92

PGP may have broken down for the author, but it's still used in a lot of places . For example, to communicate with our bankers at work, every email has to be properly encrypted and signed - or it goes into a blackhole. The only way to exchange public keys(initially) is in person. Once that is done, new keys are provided from that person, and the WoT expands. tldr; it doesn't work for the author, but it does work for…

PGP is also used very heavily on darknet on drug marketplaces. OTR (or even Signal) is not possible there, so people stick to good-and-tried PGP.

I think darkweb marketplaces are a slightly different use case though. The requirements for a darkweb transaction are the ability to tell the vendor your address so they can send you illegal goods, while hiding it from the marketplace itself in case their servers are seized. A random PGP key with no real name and no verification is entirely adequate for this purpose - indeed, any kind of identity validation would probably be seen as a negative for such a situation.

Re: I'm giving up on PGP

#310

Post by user5994461 »

rebuilder wrote: post #301
eropple wrote: post #271

Earlier quoted context omitted.

There's a power curve though, yeah? That most powerful agent can just drag you off and apply rubber-hose cryptography. Or just drone your ass. At some point, worrying about what else they can do is kind of a whateverburger.

They can do that, but it'snot cheap for them. Giving the government total, automated access to your communications - and that's what we're talking about here IMO - lets them (and you, admittedly) avoid the whole beating scene. In real terms, it would drastically change the balance of power.

> Giving the government total, automated access to your communications

Hello no. Absolutely not.

We're talking here about a state distributing USB keyz with a certificate to each citizen. The certificate is 'vouched' by the CA, it confirms the name of the citizen and it can be used to sign stuff thanks to private key cryptography.

One usage could be to access public websites, and use that USB key to log in and confirm your identity.

Post reply on HN