181–190 of 197 posts
Now may be a good time to plug a project we worked on at my last gig. KeySpace uses IPFS to store PGP keys in a decentralized file system. We used a smart contract on the Ethereum blockchain to store an address-hash lookup. What this achieves is fully decentralized peer-to-peter encrypted communication. We used it to facilitate trustless OTC negotiation and trading. https://medium.com/fluidity/keyspace-end-to-end-enc…
Ooh er, missus
Earlier quoted context omitted.
It's not the silver bullet we need, but I really like Keybase's approach. I think any PGP replacement should take notes from their architecture.
I love their approach, but it is still PGP based. Moreover, it is a bit too centralized. Thing is, a non-centralized system is really hard to monetize. There might be space for some long-form (as opposed to whatsapp, etc) encrypted messaging. But a solution for portable encrypted files (using either symmetric or asymmetric crypto) is hard to monetize. Note that, while portable encrypted files could be used for encryp…
To use Keybase, one doesn't even need to know what PGP is. It all "just works". I have successfully introduced non-technical people to Keybase and what's more, these people use it actively and appreciate what it can do for them. Can't really say that about PGP.
> Thing is, a non-centralized system is really hard to monetize
Until our government supports such infrastructure, the only solution is trust funds / non-profit organizations which released all of their R&D for free.
Earlier quoted context omitted.
You asked (among other things) how to send messages securely without PGP. Don't use PGP to send secure messages; use a secure messenger, like Signal or Wire. Someone else asked how to email securely without PGP. Email isn't secure with PGP. Don't use PGP to send encrypt emails, and don't use email to send secure messages; use a secure messenger, like Signal or Wire. I acknowledge there are use cases not well covered…
[matrix] and Riot.im are alternatives to Signal and Wire.
Earlier quoted context omitted.
Do you have more info about this? As far as I understand if you use e2e encryption with riot/matrix you should be quite safe.
I imagine the GP is talking about https://news.ycombinator.com/item?id=20178267 . We've spent the last few weeks going through fixing the issues which this highlighted; there'll be a blog post later today (or tomorrow) giving an update on how we've addressed the points in question.
Earlier quoted context omitted.
> This isn't the first time the GnuPG ecosystem has responded this way to attacks. Hmmmm, I think this is a bit of squeaky wheel situation going on. Remember that the sks keyserver pool is mostly a decentralized group of volunteers running a server as a hobby. So you can have all types of people operating keyservers in the pool. For instance, I've been running a keyserver in the pool for several years. However, I don…
The fact that it is simultaneously a "hobby" and an "attempt to help activists communicate securely" is emblematic of the whole problem here. Either way, the time for Hansen to have warned people about the keyservers was when he first became aware of the vulnerability ("well over a decade" ago), not right after it got exploited on him personally . Everything about this response, from the personal offense he's taken t…
gpg is good, but the infrastructure (keyservers) and tooling (S/MIME / enigmail etc) around GPG are a nightmare. Bootstrapping trust and managing the lifecycle of trust is an unsolved problem, and PGP/GPG has some of the worst assumptions for users (imvho e.g. as long as users are expected to understand threat models and manage these things it's really hard).
Earlier quoted context omitted.
Hmmmm, isn't that an inherent property of any for-public-use database? By your definition, any public pki (keybase.io, keys.openpgp.org, etc.), social network (Twitter, Facebook, Mastodon, etc.), and more are vulnerable to someone just writing a script and bloating their database. What mitigation strategies do other ecosystems use? Why can't they be tried in the keyserver pool?
They certainly are vulnerable. The solutions for social networks are in client/behaviour analysis: Are you trying to create 10th account from the same IP? Are you creating multiple accounts with the same browser fingerprint? Have you got any personal details attached? (That's one reason they started pushing phone verification) Is the action automated? (CAPTCHA) Is your friend graph a clique of fresh accounts? A lot o…
Earlier quoted context omitted.
[matrix] and Riot.im are alternatives to Signal and Wire.
sorry no. riot and matrix are both NOT e2e. I wish people would stop repeating as facts what is somewhere on the roadmap
My attempt to understand this - please correct liberally Things I know today that I did not know yesterday - The GnuPG (GPG) ecosystem seems to suffer from pre-heart bleed-OpenSSL levels of not enough investment and people - The GPG ecosystem has a trivial DOS attack that can be mounted against it, with bad actors able to append thousands of keys to any users "account" effectively making it impossible to read that ac…
Earlier quoted context omitted.
> - This may or may not mean that major distributions binary packages will simply stop being verifiable - it depends on who uses what key server in what chain of trust. We probably won't find out till more bad actors poison more wells Debian keys come from keyring.debian.org, so ??? I'm guessing that chains of trust from there go through the SKS keyservers. If that's so, Debian updates will likely be hosed at some po…
Wrong: Debian installations come with preinstalled keyring with the archive signing keys. Upgrades to that keyring are provided via packages, which are signed with the previous archive key. The same for Fedora and rpm. Public keyservers or web of trust are not involved. On the internet you can obviously find all sorts of bad guides written by random people.
But what about package build chains? Are there ever (or at least commonly) calls to SKS keyservers?
Earlier quoted context omitted.
[matrix] and Riot.im are alternatives to Signal and Wire.
sorry no. riot and matrix are both NOT e2e. I wish people would stop repeating as facts what is somewhere on the roadmap