21–30 of 53 posts
Kind of nitpicky, but I'll be cautious taking clickbaity claims like "PGP is dead" from someone who makes such a mistake in their first paragraph.
It's dead for a very simple reason: it's really hard to find active PGP/GPG keyservers.
Fedora keyserver? Dead
Debian keyserver? Dead
openSUSE keyserver? Dead
SKS keyserver pool? Dead
keys.gnupg.net? Dead
keys.openpgp.org? Half-dead (HKPS access not working, it seems only web is working) etc
Very few keyservers are still online and some of then don't sync with the others (e. g. keyserver.pgp.com).
> Users have a public key and a private key – senders use the former to encrypt messages, which can only be decoded by someone who has access to the latter. Kind of nitpicky, but I'll be cautious taking clickbaity claims like "PGP is dead" from someone who makes such a mistake in their first paragraph.
The session key would be encrypted with the recipient's public key so that they (and hopefully only they) can decrypt it and then decrypt the message encrypted with the session key. The sender would use the recipient's public key.
Just because it's quicker and easier to pop it in the microwave, doesn't mean that it's healthier than a home cooked meal.
> Users have a public key and a private key – senders use the former to encrypt messages, which can only be decoded by someone who has access to the latter. Kind of nitpicky, but I'll be cautious taking clickbaity claims like "PGP is dead" from someone who makes such a mistake in their first paragraph.
It's more like they're sloppy than that they've made a mistake. The session key would be encrypted with the recipient's public key so that they (and hopefully only they) can decrypt it and then decrypt the message encrypted with the session key. The sender would use the recipient's public key.
Earlier quoted context omitted.
> PGP is literally thirty years old now, and I'm not aware of any significant changes sounds like a good thing to me
That's a bad thing. PGP has some really awful usability problems which have never been addressed. The paper "Why Johnny Can't Encrypt" described some of these issues in 1999, and a series of followups ("Why Johnny Still Can't Encrypt", "Why Johnny Still, Still Can't Encrypt"...) have come out over the years confirming that it still hasn't improved.
Edit: maybe what seems easy to me can seem hard to someone else. Not sure if I'm having a bias here.
Earlier quoted context omitted.
> PGP is literally thirty years old now, and I'm not aware of any significant changes sounds like a good thing to me
That's a bad thing. PGP has some really awful usability problems which have never been addressed. The paper "Why Johnny Can't Encrypt" described some of these issues in 1999, and a series of followups ("Why Johnny Still Can't Encrypt", "Why Johnny Still, Still Can't Encrypt"...) have come out over the years confirming that it still hasn't improved.
"Let's ditch open protocol X that has worked well for decades, in favour or closed protocol Y. Because of some transient issue with open protocol X, it's now time for open protocol X to die" Heard that before? It's as if if your doctor told you it's now time for you to die because you caught a cold.
> Let's ditch open protocol X that has worked well for decades To be fair, I really can't put PGP in the category of "open protocol X that has worked well for decades"[1]. I'd welcome a closed protocol that actually works over an "open" one that's been functionally broken for years. [1] https://latacora.micro.blog/2019/07/16/the-pgp-problem.html
Also, the heterogeneous MUA world, and the fact that users expect to be able to search their email even if encrypted, just makes end-to-end encrypted email a really tough proposition.
I could see something like OTR+PGP for email that could work, but the MUAs would have to get updates, and MUAs are "a solved problem". There's just no real work ongoing on MUAs.
> Of course, there are potential problems with allowing private companies to hold the keys to all of your sensitive conversations. But, these projects are generally less vulnerable than PGP because they are independent, says Green. > “When something goes wrong with WhatsApp, WhatsApp fixes it,” he says. “When something goes wrong in the amorphous PGP community, no one puts their hand up to fix it. This is some whacky…
The general argument is that open protocols tend to be stagnant while private ones are not, and that is true. Private protocols can iterate faster, have a vested financial interest to not lose customers, are often not required to be as backwards compatible which further slows updates and they can tightly integrate from backend to user. Open protocols always tend to be disjointed, i.e Email + PGP whereas something lik…
This is just as satisfiable - if not more so - with slick marketing and platitudes than with actual security.