31–40 of 60 posts
It'd be cool to see this without PGP. Signatures via signify/minisign are superior in every way.
> are superior in every way. Besides the fact that a signify/minisign are a raw key instead of being padded with identity information, in what way are they actually better? Similarly, minisign makes no claims at identity at all. You get a random string, and the user is responsible for knowing which key is for what user. The minisign public key contains nothing but the key. To me, that is a horrible user experience. A…
PGP also allows a host of insecure options without mandating secure ones: while it does offer good algos and distribution mechanisms (e.g. WKD), it also offers poor/deprecated algos and disasters like keyserver pools.
As for Signify: Minisign supports trusted and untrusted comments in signatures to supply metadata.
Some distributions like OpenBSD and Void Linux have finally upgraded their package signing from PGP to Signify; Debian is in the process of migrating from PGP to Ed25519 sigs (https://wiki.debian.org/Teams/Apt/Spec/AptSign). If we manage to switch enough distros off PGP, maybe we can remove the need to have PGP installed by default.
Tools like this may be useful in some instances but auth will always tend towards centralization
Earlier quoted context omitted.
The algorithms still stand 25 years later. Is it also available for iOS and Android? FreeBSD? Are there libraries for Perl and PHP?
> The algorithms still stand 25 years later. They don't, though.
What are you saying here?
I really like the fact that they don't dismiss people that want to do things differently and don't need/want what they offer.
It'd be cool to see this without PGP. Signatures via signify/minisign are superior in every way.
age doesn't support signing, keys are meant to be ephemeral. minisign/signify are not a suitable equivalent and are more suited to signing+verifying software releases.
I really like the general idea of decentralized identity. Personally I'd prefer to keep my identities on different apps/platforms mostly (99%) separate. It seems to me that giving an adversary a map (especially usernames and email identities) of your online presence is a bad idea especially if they get access to one account and get some private details they may be able to use to socially engineer their way into other…
An example user page is my page here: https://keyoxide.org/4af679d0aba0ed4b07bf7b6932ca3267c8d187d... Keyoxide is a really nice, but difficult to set up, tool
Why do some of your "profiles" have Xs?
Would the following be functionally equivalent?: - on each platform, include your pgp key id in the "bio"/"about" of your profile - in your pgp key, include your profile URLs on each platform as an identity. (In DNS, CERT RR exists for this purpose already.)