Cryptography Dispatches: Hello World, and OpenPGP Is Broken
buttondown.email
Cryptography Dispatches: Hello World, and OpenPGP Is Broken
1–10 of 72 posts
Re: Cryptography Dispatches: Hello World, and OpenPGP Is Broken
#2Just wanted to say thanks for making the awesome cryptography newsletter! Really enjoyed reading this.
Re: Cryptography Dispatches: Hello World, and OpenPGP Is Broken
#3Very nice article, I'll definitely subscribe!
> For example, it was never clear to me whether signing a key meant that I’d verified the person’s identity, or that I then trusted them to verify other people’s identities.
Signing means you verified identity. Trust to verify (also called ownertrust) is controlled by a different setting and you can trust someone to verify other keys fully or marginally (or not at all if you know someone is controlling given key but does not verify others well). See this excellent post for details: https://www.linux.com/learn/pgp-web-trust-core-concepts-behi...
Re: Cryptography Dispatches: Hello World, and OpenPGP Is Broken
#4Very nice article, I'll definitely subscribe! > For example, it was never clear to me whether signing a key meant that I’d verified the person’s identity, or that I then trusted them to verify other people’s identities. Signing means you verified identity. Trust to verify (also called ownertrust) is controlled by a different setting and you can trust someone to verify other keys fully or marginally (or not at all if…
I think he understands that in general. The problem is that, in practice, the "web of trust" depends on significant numbers of users trusting other users to verify still other users on their behalf, which is in practice something most people are (or should be) loath to do.
Re: Cryptography Dispatches: Hello World, and OpenPGP Is Broken
#5Can we stop saying that pgp is busted and just talk about how the keyservers are the problem with how people decides to exchange keys ?
I don't use key servers. So when I get an encrypted message from my friend I have no issues.
Allowing a third party such as a key server to play some role in veifiing the authenticity of a key is basically broken from tht start, and has nothing to do with pgp it's self.
Re: Cryptography Dispatches: Hello World, and OpenPGP Is Broken
#6To be clear: this is a subhed from Filippo's email newsletter (which you should subscribe to), relating a news item about the ridiculous SKS/GnuPG-key-handling fiasco from last week; it is not a comprehensive summary of all the ways in which OpenPGP is broken, despite the title.
Re: Cryptography Dispatches: Hello World, and OpenPGP Is Broken
#7Can we stop saying that pgp is busted and just talk about how the keyservers are the problem with how people decides to exchange keys ? I don't use key servers. So when I get an encrypted message from my friend I have no issues. Allowing a third party such as a key server to play some role in veifiing the authenticity of a key is basically broken from tht start, and has nothing to do with pgp it's self.
That's ok, pgp is also terrible to use on the command line so we can complain about that.
Re: Cryptography Dispatches: Hello World, and OpenPGP Is Broken
#8Can we stop saying that pgp is busted and just talk about how the keyservers are the problem with how people decides to exchange keys ? I don't use key servers. So when I get an encrypted message from my friend I have no issues. Allowing a third party such as a key server to play some role in veifiing the authenticity of a key is basically broken from tht start, and has nothing to do with pgp it's self.
That's ok, pgp is also terrible to use on the command line so we can complain about that.
Yes
Re: Cryptography Dispatches: Hello World, and OpenPGP Is Broken
#9Can we stop saying that pgp is busted and just talk about how the keyservers are the problem with how people decides to exchange keys ? I don't use key servers. So when I get an encrypted message from my friend I have no issues. Allowing a third party such as a key server to play some role in veifiing the authenticity of a key is basically broken from tht start, and has nothing to do with pgp it's self.
OpenPGP is broken in the sense discussed in this newsletter: the keyserver system interacts in a catastrophic way with GnuPG's naive key parsing code, and OpenPGP's deployment at scale depends on keyservers.
OpenPGP is broken in other ways! But this is a headline given to a particular current events story about OpenPGP.
Re: Cryptography Dispatches: Hello World, and OpenPGP Is Broken
#10To be clear: this is a subhed from Filippo's email newsletter (which you should subscribe to), relating a news item about the ridiculous SKS/GnuPG-key-handling fiasco from last week; it is not a comprehensive summary of all the ways in which OpenPGP is broken, despite the title.
OK, we've restored the full article title.