←back to thread

61 points harporoeder | 1 comments | | HN request time: 0s | source
Show context
politelemon ◴[] No.41874187[source]
This feels like perfect being the enemy of good enough. There are examples where the system falls over but that doesn't mean that it completely negates the benefits.

It is very easy to get blinkered into thinking that the specific problems they're citing absolutely need to be solved, and quite possibly an element of trying to use that as an excuse to reduce some maintenance overhead without understanding its benefits.

replies(2): >>41874198 #>>41874289 #
creatonez ◴[] No.41874198[source]
Its benefits are very much completely negated in real-world use. See https://blog.yossarian.net/2023/05/21/PGP-signatures-on-PyPI... - the data suggests that nobody is verifying these PGP signatures at all.
replies(2): >>41874468 #>>41874473 #
dig1 ◴[] No.41874468[source]
I stopped reading after this: "PGP is an insecure [1] and outdated [2] ecosystem that hasn't reflected cryptographic best practices in decades [3]."

The first link [1] suggests avoiding encrypted email due to potential plaintext CC issues and instead recommends Signal or (check this) WhatsApp. However, with encrypted email, I have (or can have) full control over the keys and infrastructure, a level of security that Signal or WhatsApp can't match.

The second link [2] is Moxie's rant, which I don't entirely agree with. Yes, GPG has a learning curve. But instead of teaching people how to use it, we're handed dumbed-down products like Signal (I've been using it since its early days as a simple sms encryption app, and I can tell you, it's gone downhill), which has a brilliant solution: it forces you to remember (better to say to write down) a huge random hex monstrosity just to decrypt a database backup later. And no, you can't change it.

Despite the ongoing criticisms of GPG, no suitable alternative has been put forward and the likes of Signal, Tarsnap, and others [1] simply don't cut it. Many other projects running for years (with relatively good security track records, like kernel, debian, or cpan) have no problem with GPG. This is 5c.

[1] https://latacora.micro.blog/2019/07/16/the-pgp-problem.html

[2] https://moxie.org/2015/02/24/gpg-and-me.html

[3] https://blog.cryptographyengineering.com/2014/08/13/whats-ma...

replies(3): >>41874529 #>>41874549 #>>41874604 #
1. ◴[] No.41874549[source]