Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Why I Wrote PGP (1999)

philzimmermann.com

Post reply on HN
Print view View original

171–180 of 194 posts

Re: Why I Wrote PGP (1999)

#171

Post by jandrese »

UncleMeat wrote: post #134
XorNot wrote: post #45

Earlier quoted context omitted.

Web of Trust is a perfectly fine system but UI-wise a total disaster. There's also the reality that what most people need most of the time is a web of trust that includes government agencies, banks and other major institutions. For the vast majority of useful communications for users, your web of trust ideally goes You -> Government ID Agency fine - that's what people actually need. People get scammed or deceived by…

Web of Trust mixes two kinds of trust. If my mom gives me her public key, I trust that it is her public key. If my mom signs some other person's public key - I really don't know how much I trust that. Trusting that somebody is who they say they are is not the same as trusting them to properly vouch for another person.

This is the reason Frendster failed. Friending someone automatically made you a friend with all of their friends, even the ones that were jerks or you had never met.

Re: Why I Wrote PGP (1999)

#172

Post by upofadown »

breput wrote: post #14

Matthew Green does a pretty good job picking apart PGP's issues, although he completely fails at suggesting alternatives and also completely ignores non-email use cases. https://blog.cryptographyengineering.com/2014/08/13/whats-ma...

OpenPGP implementations suck for usability. All the other messaging implementations also suck for usability.

Having obscure arguments about the underlying cryptography is fun and all, but doesn't really make the world a better place.

Re: Why I Wrote PGP (1999)

#173

Post by ipaddr »

user3939382 wrote: post #100
vbezhenar wrote: post #89

Earlier quoted context omitted.

Tor is the anonymous net. It might be not perfect against targeting state-level attackers, but generally it works and delivers its promise.

> it works Does it? Dragnet surveillance might not easily inspect all Tor traffic, but it can easily see who is using it, flag those identities, and put them on a list for increased scrutiny. Unless a major web browser has it enabled by default, I don’t see it delivering on its promise.

Don't leave the onion network. It's the exit nodes where 1/3 are hostile.

Re: Why I Wrote PGP (1999)

#174

Post by XorNot »

UncleMeat wrote: post #134
XorNot wrote: post #45

Earlier quoted context omitted.

Web of Trust is a perfectly fine system but UI-wise a total disaster. There's also the reality that what most people need most of the time is a web of trust that includes government agencies, banks and other major institutions. For the vast majority of useful communications for users, your web of trust ideally goes You -> Government ID Agency fine - that's what people actually need. People get scammed or deceived by…

Web of Trust mixes two kinds of trust. If my mom gives me her public key, I trust that it is her public key. If my mom signs some other person's public key - I really don't know how much I trust that. Trusting that somebody is who they say they are is not the same as trusting them to properly vouch for another person.

This is still a UI problem though more then any other: Web of Trust stored and it could have displayed the actual verification chains, and set up some decent defaults based on that - i.e. "Government", "Bank", "Personally Verified", "Friend of a Friend" - all of this would be easy to communicate via what keys signed what exactly who you were dealing with.

This even leads to a logical DNS integration: debian.org advertises the core group of keys which should verify people on that address via DNS, and it shows up as "DNS-only" or something.

Good crypto frequently undermines itself by trying to be adversarial to the whole concept of government or big companies (look at TLS - it succeeded because it's the antithesis of this) but those the primary users and coordinators that can drive adoption.

I have this complaint with Signal right now: if Signal wanted a legitimate funding source, they should sell a "verified Signal" service to let companies subscribe to use Signal as an alternative to SMS providers - my father wants to do this for his small business right now, to replace the SMS bulk sender and be able to send larger files to people securely.

Instead we've got whatever cryptocurrency ridiculousness.

Re: Why I Wrote PGP (1999)

#175

Post by artursapek »

Gradient-Ascent wrote: post #166
artursapek wrote: post #139

Earlier quoted context omitted.

More and more Bitcoin is going to be held by custodians, like crypto exchanges, retail trading apps like Robinhood, and even traditional banks. Handling your own Bitcoin keys will end up being a niche cypherpunk thing, like using command-line PGP. It's actually a perfect analogy, because most popular "E2EE" chat apps are also custodial with your keys.

You don't own your bitcoin then (if you are not the only one who has the key) - Elon Musk pointed that out. The custodian owns your Bitcoin (and can run away with them or also lose the key).

No shit, but the successful custodians are the ones who have insurance on deposits and enough reputation that people are not afraid of them exit scamming. You don’t physically hold your stocks and cash either.

Re: Why I Wrote PGP (1999)

#176

Post by Gradient-Ascent »

artursapek wrote: post #175
Gradient-Ascent wrote: post #166

Earlier quoted context omitted.

You don't own your bitcoin then (if you are not the only one who has the key) - Elon Musk pointed that out. The custodian owns your Bitcoin (and can run away with them or also lose the key).

No shit, but the successful custodians are the ones who have insurance on deposits and enough reputation that people are not afraid of them exit scamming. You don’t physically hold your stocks and cash either.

"No shit" - It's a bit over the top to denounce me here as "Mr. Obvious", but funny, so this shall be forgiven to you. Musk is hot and at the forefront and he said it the other day. There is a lot of running away with bitcoins still/currently (Mt. Gox) and they are not insured. Probably the endgame of Bitcoin: All Bitcoin get lost or stolen, but were reimbursed/payed out via an insurance :-D - The full value of all Bitcoin payed by the insurance.

Re: Why I Wrote PGP (1999)

#177

Post by krageon »

danielschonfeld wrote: post #97
uncomputation wrote: post #27

There’s something… different about how people (techie people are most of my sample) would write before the 00’s. I’m not sure if it has to do with the medium, or the constraints of the time, but reading it always fills me with something I can best describe as peace/nostalgia. The belief that technology honestly can change the world for the better and that the most influential people driving it have good motives inste…

I am with you. But I think I know what it is, you touched on it and almost had it. It was indeed peace, we almost had it, world peace - feeling utopian and all loving in the 90s. Then came 9/11. It’s the single point in history where just about everything to do with American society can be defined to be before and after. Doesn’t matter what you think about the event and it’s authenticity as described, the fact of the…

> Then came 9/11

> American

Yes, except the world is large and frankly in most parts of the world 9/11 doesn't factor very large in memory. As such, I doubt it was the single most important factor in changing this feeling of world peace which again, definitely didn't exist outside of the US. All you need to think about to see that is look at why 9/11 happened and think of all the murdered people those folks must have seen to get that angry.

Re: Why I Wrote PGP (1999)

#178

Post by krageon »

vbezhenar wrote: post #86
Zababa wrote: post #65

Earlier quoted context omitted.

I'd put "jokes" and "cultural references" together under "tone". Recent articles often feel like they're trying to catch the attention of children. There are lots of "candies" to make you read: pictures, GIFs, jokes, an attention grabbing title, colors, emojis, a friendly tone, lots of exclamation marks. On the other hand, that article is mostly black on white text, that's plain in a good way.

That's because young people have very short attention span and they must be fed with instant gratifications all the time to continue reading. Those "candies" are targeted at them.

> [...] young people have [...]

I hope you will forgive me for saying this but every generation leverages criticism on preceding generations for some perceived flaw. When you look back at other similar criticisms it generally can be seen as very overblown. I think in this case it's fair to say that this is not something that must be done to them, it's just something that is done to them. When you get used to something, that's what you like - it's not an intrinsic trait like you're making it seem.

Re: Why I Wrote PGP (1999)

#179

Post by throwaway210222 »

krageon wrote: post #177
danielschonfeld wrote: post #97

Earlier quoted context omitted.

I am with you. But I think I know what it is, you touched on it and almost had it. It was indeed peace, we almost had it, world peace - feeling utopian and all loving in the 90s. Then came 9/11. It’s the single point in history where just about everything to do with American society can be defined to be before and after. Doesn’t matter what you think about the event and it’s authenticity as described, the fact of the…

> Then came 9/11 > American Yes, except the world is large and frankly in most parts of the world 9/11 doesn't factor very large in memory. As such, I doubt it was the single most important factor in changing this feeling of world peace which again, definitely didn't exist outside of the US. All you need to think about to see that is look at why 9/11 happened and think of all the murdered people those folks must have…

> and think of all the murdered people those folks must have seen to get that angry.

Come now don't be naïve: those same folk get just as rabidly homicidal over a silly little cartoon.

Some societies are just not compatible with legal systems that a) limits the use of force to the government alone, b) place the rules and rights of men above religions.

Never the two shall meet.

Re: Why I Wrote PGP (1999)

#180

Post by tarsinge »

danielschonfeld wrote: post #97
uncomputation wrote: post #27

There’s something… different about how people (techie people are most of my sample) would write before the 00’s. I’m not sure if it has to do with the medium, or the constraints of the time, but reading it always fills me with something I can best describe as peace/nostalgia. The belief that technology honestly can change the world for the better and that the most influential people driving it have good motives inste…

I am with you. But I think I know what it is, you touched on it and almost had it. It was indeed peace, we almost had it, world peace - feeling utopian and all loving in the 90s. Then came 9/11. It’s the single point in history where just about everything to do with American society can be defined to be before and after. Doesn’t matter what you think about the event and it’s authenticity as described, the fact of the…

Or alternatively, then came Internet for the masses. Before that a lid was kept on a huge part of the population, the dream of raw global information sharing turned out to be a nightmare our societies/species is no ready for.
Post reply on HN