The PGP problem (2019)

Post by bgwalter » Sat, Jan 03, 2026, 6:55 AM UTC

some_furry wrote: post #40

bgwalter wrote: post #39

Earlier quoted context omitted.

Of course you omit the QR code issue in your response, just like tptacek tried to deflect in the other subthread after his Cryptocat objection was refuted.

> Of course you omit the QR code issue in your response, What? You mean a vulnerability that was mitigated in February of last year? In what sense am I obligated to comment on such a thing? You use the verb "omit" as if such an obligation exists. This is delusional rhetoric. First you complain about tptacek choosing to comment about a tangent, and then you get upset that I didn't entertain your tangent. Pick a lane.…

Post by some_furry » Sat, Jan 03, 2026, 6:58 AM UTC

bgwalter wrote: post #41

some_furry wrote: post #40

Earlier quoted context omitted.

> Of course you omit the QR code issue in your response, What? You mean a vulnerability that was mitigated in February of last year? In what sense am I obligated to comment on such a thing? You use the verb "omit" as if such an obligation exists. This is delusional rhetoric. First you complain about tptacek choosing to comment about a tangent, and then you get upset that I didn't entertain your tangent. Pick a lane.…

I no longer respond if you use Simple Sabotage Field Manual tactics. EDIT: The submission was flagged from the front page seconds after this reference.

Post by Diti » Sat, Jan 03, 2026, 9:26 AM UTC

stackghost wrote: post #25

felipelalli wrote: post #4

Even though I read so many posts criticizing PGP, it's still difficult for me to find an alternative. He states in the article that being a "Swiss Army Knife" is bad. I understand the argument, but this is precisely what makes GPG so powerful. The scheme of public keys, private keys, revoke, embedded WOT, files, texts, everything. They urgently need to make a "modern version" of GPG. He needs a replacement, otherwise…

The so-called web of trust is meaningless security theatre. >They urgently need to make a "modern version" of GPG. Absolutely not.

Post by tptacek » Sat, Jan 03, 2026, 4:10 PM UTC

bgwalter wrote: post #35

tptacek wrote: post #31

Earlier quoted context omitted.

I don't care that it's a tangent, I care that it's incoherent and wrong.

The tangent explicitly talks about generic messaging services. Whatsapp and Signal have more money than gpg. Thinking about it more, it is not even a tangent, because TFA says: "Use Signal. Or Wire, or WhatsApp, or some other Signal-protocol-based secure messenger."

Post by some_furry » Sat, Jan 03, 2026, 9:54 PM UTC

zenethian wrote: post #48

Diti wrote: post #45

Earlier quoted context omitted.

> The so-called web of trust is meaningless security theatre. Ignoring your comment’s lack of constructive criticism, I’m going to post this meaningful implementation that an excellent cryptographer, Soatok Dreamseeker, is working on: [1]. You may also search for his posts in this HN thread, his nickname is “some_furry”. [1]: https://github.com/fedi-e2ee/public-key-directory-specificat...

Keyservers already “solved” this problem without needing federation because we only needed one keyserver anyway. Federating them isn’t going to do anything. Web of trust is a broken system that sounds super cool until you try to really use it. It has so many flaws that there’s really no way to revive it. Keybase tried to do something about it and also failed.