Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Why I Wrote PGP (1999)

philzimmermann.com

Post reply on HN
Print view View original

41–50 of 194 posts

Re: Why I Wrote PGP (1999)

#41

Post by JoachimSchipper »

tptacek wrote: post #29
breput wrote: post #25

Earlier quoted context omitted.

The Signal protocol is very well designed but the implementation requires a telephone number (I know it is coming). That's a step removed from PGP which can be completely offline.

That's interesting and all, but my point is just that you'll have to stop and think about how many orders of magnitude separate the userbase sizes. A simpler way to make the same point would be that relative to modern cryptography, to a first approximation, nobody uses PGP.

A good point, but one addition: nobody directly uses PGP.

While Debian and other package signing continues to use PGP (and yes, Debian may move away, and signify/minisign is preferable) there are lots of “infrastructure” uses.

Re: Why I Wrote PGP (1999)

#42

Post by jandrese »

breput wrote: post #11
alfiedotwtf wrote: post #5

Earlier quoted context omitted.

The government thinks it still is.

PGP's biggest weakness was that it was too early. There was no normal user accessible software available. No regular person was going to establish the web of trust or use command line utilities. So now we have easy, strong encryption and the keys are controlled by...someone. Definitely not the user, though. Funny story - even Phil Zimmerman can't use PGP: https://twitter.com/josephbonneau/status/638772283713060864 So…

No, PGP's weakness is that the Web of Trust is an unworkable solution for the general population for key exchange. It works fine for a you and your circle of crypto nerds, but as a general solution it's impossible.

IMHO this is a case where perfect was the enemy of good. Many possible solutions were rejected because there was a possibility that someone could MITM your first contact, even though in the real world this is unlikely. The key registries were almost a solution but none of them ever gained enough traction to be a default solution and mail clients were strangely hesitant to incorporate them even when they did implement PGP.

PGP was always half of the solution. Sadly they never figured out the other half. Microsoft almost got it working with Exchange, but even then you usually it only works on a single domain at a time. You can't use encrypt an email to someone at a different company even if they are using Exchange.

Re: Why I Wrote PGP (1999)

#43

Post by dannyw »

baby wrote: post #40
uncomputation wrote: post #27

There’s something… different about how people (techie people are most of my sample) would write before the 00’s. I’m not sure if it has to do with the medium, or the constraints of the time, but reading it always fills me with something I can best describe as peace/nostalgia. The belief that technology honestly can change the world for the better and that the most influential people driving it have good motives inste…

Very similar to the cryptocurrency field. Lots of noise nowadays.

Bitcoin was born in the aftermath of the global financial crisis and the occupy wall street movement.[1] Events where, giant banks and institutions received trillions of dollars in unprecedented bail outs while 'main street' suffered with record unemployment, foreclosures, and destruction of small businesses.

People rightfully realised that perhaps government should not have absolute and total control of the monetary supply and financial system. That a 'Plan B' may be in order.

Unfortunately, today it's 90% people trying to get rich quick.

[1]: https://en.bitcoin.it/wiki/Genesis_block

Re: Why I Wrote PGP (1999)

#44

Post by mjevans »

warkdarrior wrote: post #23
toast0 wrote: post #19

Earlier quoted context omitted.

You don't need a clipper chip to trace nuisance calls. You need an authenticated network that records the origin of calls, and hopefully passes that through when calls are forwarded and makes it simple and worthwhile to report nuisance calls and aggregates those reports and takes meaningful action against the origins. Anyway, we're getting shaken/stir or whatever RealSoonNow(TM), so we'll probably have better CallerI…

Would you want the same capability on the Internet? If not, what makes Internet communication different from POTS communication?

I would want to require:

1) That the source IP address be from a range 'controlled' by the operator of a given AS. This might be proven, semi Out of Band, for a duration by a PKI challenge with a key representing that authority. (Allows distributed services on the same IP anywhere. Fulfillment can be asynchronous if UDP.) Edit: This would also be how to securely claim an AS route; you might still need a link authorized for this level of service.

2) The mentioned feedback mechanism should be coupled with 'do not forward me anything from IP || net/mask for X time' via a similar mechanism. A reason might be provided, reasons of clear abuse MAY be aggregated and used to isolate misbehaving hosts / networks.

Re: Why I Wrote PGP (1999)

#45

Post by XorNot »

jandrese wrote: post #42
breput wrote: post #11

Earlier quoted context omitted.

PGP's biggest weakness was that it was too early. There was no normal user accessible software available. No regular person was going to establish the web of trust or use command line utilities. So now we have easy, strong encryption and the keys are controlled by...someone. Definitely not the user, though. Funny story - even Phil Zimmerman can't use PGP: https://twitter.com/josephbonneau/status/638772283713060864 So…

No, PGP's weakness is that the Web of Trust is an unworkable solution for the general population for key exchange. It works fine for a you and your circle of crypto nerds, but as a general solution it's impossible. IMHO this is a case where perfect was the enemy of good. Many possible solutions were rejected because there was a possibility that someone could MITM your first contact, even though in the real world this…

Web of Trust is a perfectly fine system but UI-wise a total disaster. There's also the reality that what most people need most of the time is a web of trust that includes government agencies, banks and other major institutions.

For the vast majority of useful communications for users, your web of trust ideally goes You -> Government ID Agency fine - that's what people actually need. People get scammed or deceived by faking those credentials.

Re: Why I Wrote PGP (1999)

#46

Post by cinquemb »

dannyw wrote: post #43
baby wrote: post #40

Earlier quoted context omitted.

Very similar to the cryptocurrency field. Lots of noise nowadays.

Bitcoin was born in the aftermath of the global financial crisis and the occupy wall street movement.[1] Events where, giant banks and institutions received trillions of dollars in unprecedented bail outs while 'main street' suffered with record unemployment, foreclosures, and destruction of small businesses. People rightfully realised that perhaps government should not have absolute and total control of the monetary…

> Unfortunately, today it's 90% people trying to get rich quick.

And that is, unsurprisingly (and quite banally), used by many detractors to dismiss it all while handwaving away:

> Bitcoin was born in the aftermath of the global financial crisis and the occupy wall street movement.[1] Events where, giant banks and institutions received trillions of dollars in unprecedented bail outs while 'main street' suffered with record unemployment, foreclosures, and destruction of small businesses.

> People rightfully realised that perhaps government should not have absolute and total control of the monetary supply and financial system.

Like people still hand wave away all the metadata and other work-arounds to compromising popular crypto systems that are highly touted because they are popular/convenient/etc or all the "get rich quick" mentality/motivations that exist outside of cryptocurrencies and have always existed…

Re: Why I Wrote PGP (1999)

#47

Post by dijit »

jandrese wrote: post #42
breput wrote: post #11

Earlier quoted context omitted.

PGP's biggest weakness was that it was too early. There was no normal user accessible software available. No regular person was going to establish the web of trust or use command line utilities. So now we have easy, strong encryption and the keys are controlled by...someone. Definitely not the user, though. Funny story - even Phil Zimmerman can't use PGP: https://twitter.com/josephbonneau/status/638772283713060864 So…

No, PGP's weakness is that the Web of Trust is an unworkable solution for the general population for key exchange. It works fine for a you and your circle of crypto nerds, but as a general solution it's impossible. IMHO this is a case where perfect was the enemy of good. Many possible solutions were rejected because there was a possibility that someone could MITM your first contact, even though in the real world this…

I fundamentally disagree with you that web of trust is hard.

There are much harder problems solved in easy to use ways, there’s just very little financial gain for this problem.

Re: Why I Wrote PGP (1999)

#48

Post by skybrian »

uncomputation wrote: post #27

There’s something… different about how people (techie people are most of my sample) would write before the 00’s. I’m not sure if it has to do with the medium, or the constraints of the time, but reading it always fills me with something I can best describe as peace/nostalgia. The belief that technology honestly can change the world for the better and that the most influential people driving it have good motives inste…

One difference (in this article at least) is that there are no jokes or unnecessary cultural references.

Another might be called moral clarity. Unfortunately, it's usually an illusion. We have much more experience with technologies invented under optimistic assumptions turning out to be a moral gray area at best, when you look at how they're used.

I found this paper interesting:

The Moral Character of Cryptographic Work https://web.cs.ucdavis.edu/~rogaway/papers/moral-fn.pdf

Re: Why I Wrote PGP (1999)

#50

Post by TeeMassive »

Is there a good websites listing the ways being spied on can affect you personally?

Would be great every time a "I don't care if the NSA watch my dick picks, bro" naive person bring this to my face again.

Post reply on HN