Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The PGP Problem

latacora.micro.blog

Post reply on HN
Print view View original

351–360 of 369 posts

Re: The PGP Problem

#351

Post by alxlaz »

newscracker wrote: post #194
alxlaz wrote: post #175

Earlier quoted context omitted.

It's just the passage of time that has rendered it misinformation. Until not so long ago, Gmail messages were actually scanned for ads -- IIRC, Google was actually pretty upfront about it when they first launched Gmail, and explained that it's how they could afford to give users 1G of inbox space in a day and age where 25 MB was pretty good and 100 MB was pretty hard to get for free. They eventually stopped, although…

> I doubt emails are an important source of advertising data today, so I think it's likely that Google doesn't rely on it that much anymore. I completely disagree with the first part of your assertion. Email is still the main medium for all organizations, especially private companies taking your money for something, to communicate with you with plenty of details. Be it ordering some product online or booking a flight…

> Be it ordering some product online or booking a flight or other travel ticket or ordering a service

That's true, but all these places already track the living hell out of you. Even the newsletters they send over email have tracking information. By the time they've sent you an email after your first purchase, they know everything they need to show you relevant ads (in fact, that's probably why you made the first purchase...). I doubt bulk analysis of emails can show anything that is not already known way before the emails got sent.

Re: The PGP Problem

#352

Post by afiori »

Natanael_L wrote: post #345
afiori wrote: post #328

Earlier quoted context omitted.

you can have contacts send you another contact. There is no way to set up a server of public identities, but you should be able to share your own contacts.

Signal won't validate the session key via that mechanism, each pair of communicating users have to do that themselves

TIL; does this also mean that you can "fake" forwarded messages?

Re: The PGP Problem

#353

Post by trabant00 »

Natanael_L wrote: post #344
trabant00 wrote: post #340

Earlier quoted context omitted.

If you blame gpg for efail you can blame anything really for a virus on one of the endpoints of any form of encryption. Next you will hold rensponsible tech for social engineering and mandate users should not know their own secrets because that causes vulnerabilities in protocols :p

By that logic we shouldn't recommend cars with high safety ratings, because we can always train users to drive motorized unicycles at 200 MPH. Clearly there's no fault with the unicycle regardless of how many people crash, it behaved as specified. Except the specification is trash.

Except cars with 5 star rating exist but a better solution than PGP doesn't.

Re: The PGP Problem

#354

Post by bennofs »

Natanael_L wrote: post #229
bennofs wrote: post #176

I understand that there are better tools for encryption, but is there anything that replaces the identity management of PGP? Having a standard format for sharing identities is necessary in my opinion. If I have a friend (with whom I already exchanged keys) refer me to some third friend, it would be nice if he can just send me the identity. Sending me the signal fingerprint isn't a solution for two reasons: - I don't…

I think that currently Keybase.io is the only thing trying to be universal, with their transparency log plus links to external profiles along with signed attestations for them. But even that's still not quite what I'm looking for. There's no straightforward way to link arbitary protocol accounts / identities to it, outside of linking plain URL:s. We need something a bit smarter than keybase that would actually allow…

Also, as I looked a little bit into Keybase I learned that they don't support any protocols that don't have public profile-like pages. So a pure messenger wouldn't be supported by Keybase.

Re: The PGP Problem

#355

Post by jedisct1 »

philips wrote: post #260
jedisct1 wrote: post #187

PGP was a game changer when it was introduced and the idea of a chain of trust was neat. Unfortunately, its implementations are difficult to use, it was never directly supported by operating systems or major applications, and its crypto agility makes it impossible to write minimal implementations. I wrote and use Piknik for small files transfer (especially with the Visual Studio extension), Encpipe for file encryptio…

Has there been any effort to integrate minisign into git?

None that I know of, but it's never too late :)

Re: The PGP Problem

#357

Post by bnf »

cyphar wrote: post #10

I would suggest using restic over TarSnap for encrypted backups -- it gives you more flexibility with where your backups will be stored since TarSnap is pretty integrated with Colin Percival's online service and is also unfortunately not free software. But it's also an as-simple-as-possible cryptosystem. Filippo did a quick lookthrough and said that it seemed sane from a crypto perspective[1]. [1]: https://blog.filip…

I wish that restic supported asymmetric keys. I'm uncomfortable storing the key alongside the backup tool, even if it just gets injected at runtime. If a nefarious party gets the key all my backups from that key are vulnerable.

I suspect that it's probably hard to add that functionality because you can't do the deduplication without decrypting the prior backups (or at least an index). That would also explain the memory usage JoshTriplett mentions.

Re: The PGP Problem

#358

Post by toxik »

fipar wrote: post #241
toxik wrote: post #129

Earlier quoted context omitted.

Which is a receiver-side setting and can be set to one year. Your point is moot.

This is unrelated to the current discussion and not meant to contradict your "Your point is moot", but instead just as a hopefully useful anecdote: In my experience, this requires the sender to choose 'Keep' too. I have been bitten several times by me sending an audio message to my wife because I was in a situation in which typing was complicated for me (outdoors, plenty of sunshine, I don't have the best eyesight),…

I also had some odd occurrences like this, and I simply stopped using voice messages over iMessage. It hasn't really penetrated the local phone culture so to speak, so it isn't a problem. Those that I do use it with happen to be on WhatsApp, which retains messages forever or something.

Re: The PGP Problem

#359

Post by geocar »

tinus_hn wrote: post #207
geocar wrote: post #161

Earlier quoted context omitted.

It may be better than nothing, but it's far from a sure thing: If you can BGP announce an IP, you can get a certificate from letsencrypt. This is a trivial attack vector not just for state-actors, but also stupid kids: in the early 2000s, I announced Microsoft's AS from my own network (AS21863) to see what would happen and got a significant amount of microsoft.com's traffic. There was no security, and there still isn…

Letsencrypt supposedly has deployed a system that makes the connections from different locations around the world to make this attack more difficult and also you can’t get a letsencrypt certificate for gmail.com or microsoft.com (or Gmail.* or microsoft.* for that matter), there’s a block list for high value targets.

I would hope letsencrypt has a number of heuristic safeguards, but I can guarantee they do not make connections from multiple routing paths: My ad server registers a certificate during the SNI hello (but before the certificate is presented), and I get a certificate after a single ping.

Re: The PGP Problem

#360

Post by lunchables »

mikorym wrote: post #83

First of all, if you are signing something and want to prove that you are the author, then PGP will allow you to do that. If you want to encrypt something and prove you are the author, PGP will still allow you to do that. Does the author mean that PGP is bad for email specifically? Excel has many of the mentioned properties, such as backwards compatibility and inefficiency, but it gets the job done and you bet it wil…

Yeah, most (all) of these arguments seem silly. The primary argument not to use it in emails because someone MIGHT improperly quote your email in a reply and then NOT encrypt their response? Well someone might screenshot your Signal app, or have malware on their phone, or a million other things. It seems like such an absurd corner case to me.

For my use case I don't have any concerns about using GPG. I encrypt files with it, and if anyone wants to put up any money that they can access my files, let me know what escrow service you want to use.

Post reply on HN