131–140 of 281 posts
Never seen a timestamp on the web that said "20 years ago". Wow. Reminds me of a tiny blog post I put up years ago about the future of archaeology. Forgive the silly site title. https://meaninglessdreams.wordpress.com/2014/09/26/156/
I was born 20 years ago...
> For reasons associated with U.S. export restrictions, no cryptographic security of any kind is likely to be included in the original sources https://bugzilla.mozilla.org/show_bug.cgi?id=22687#c1 Creepiest thing with seeing this ticket (again?) is noticing that the first comment is about that is used to be illegal to write anything with cryptographic security in the US and sell/give it to the outside world. https://…
Wow, now I feel dated, I remember tons of discussion around this at the time and I remember that T-shirt from the Wikipedia article very well.
Earlier quoted context omitted.
My high school friends and I settled for using Gain and Pidgin to enable the "secure" icon. :)
For awhile you could use Pidgin and OTR to even have secure messages through facebook's messenger. I'm not sure if they decrypted it or not, but it sure was fun.
Back when I liked my messenger app on the Mac.
Apple has tried hard to degrade the experience of their built in messenger.
Earlier quoted context omitted.
The OpenPGP community would do more for security if they listened to serious cryptographers and began recommending better solutions. See https://latacora.micro.blog/2019/07/16/the-pgp-problem.html for more on that. And it isn't hard to find lots and lots of cryptographers agreeing with the thesis.
People in this industry use OpenPGP because it's flexible and amendable to almost any usecase you can think of. "Better solutions" are usually indeed better but are also so specialized for their purpose to the point that they can't be easily used for any other purpose. OpenPGP is used to secure everything from simple messages and email to authenticating OS updates for most servers today. Should they use something mor…
At least with PGP email, you can make the argument that PGP sticks around because people don't want to recreate contact lists. But even that argument doesn't apply to update.
Earlier quoted context omitted.
Any signatory to the Wassenaar Arrangement, which includes the entirety of North America, Europe (including Russia), Australia, India, and Pacific Asia (minus China) must consider cryptographic technologies to be munitions for the purposes of export. Now, these restrictions have been considerably loosened to the point that the export isn't really controlled, but international law still considers it a munition. The US…
Relevant xkcd: https://xkcd.com/504/
Earlier quoted context omitted.
Any usecase forwhich no specialized solution already exists. Source code signatures and Apt/RPM packages are good examples of this.
What does OpenPGP bring there? At least GnuPG has the benefit of being a tool that's present on many system and which is capable of verifying signatures. If you're not using GnuPG, you can pick any format you want! What does OpenPGP add? Everything I can think of is a negative.
I wonder if Nvidia would like to buy them...
Earlier quoted context omitted.
What does OpenPGP bring there? At least GnuPG has the benefit of being a tool that's present on many system and which is capable of verifying signatures. If you're not using GnuPG, you can pick any format you want! What does OpenPGP add? Everything I can think of is a negative.
OpenPGP is the standard, gnupg is a implementation.
If you want an explanation of why GnuPG is dangerous for anything besides email, let me know. But parent post was very specifically NOT about GnuPG- it was about OpenPGP.
Earlier quoted context omitted.
That is the single most common misconception around PGP, and it comes up every time: (Open)PGP is first and foremost a flexible packet format (and other specs), and GnuPG is more of a CLI "library" to interface with it -- all of it. You can build something that hides metadata, you can have forward secrecy, and encryption always-on by default with PGP (and GnuPG). You can use it for whatever trust model you want, neit…
> Moxie even openly argues against standards [x] and still calls himself an "anarchist". On the face of it, that sounds like exactly the position an anarchist would take...
"How much do you trust the owner of this key to sign other keys properly? * I don't know * I do NOT trust * I trust marginally * I trust fully * I trust ultimately" This is a real pop-up I got the last time I tried to use PGP with Thunderbird. If people still get regular pop-ups like these, I don't think PGP will ever be popular. They might have switched to PEP (pretty easy privacy) that uses TOFU (trust-on-first-use…
I do agree that the marginally and fully options are useless. Wonder if adoption would be better if you just removed them, and were left with:
- I don't know what PGP is (exit, opens documentation or a tutorial)
- I definitely distrust this key (because it has been marked as malicious in the wild)
- I trust this key (because I have verified it either in person, or through a proof like Keybase)