2 ms·
It's not just the UX. A very good example: what does "signing a key" mean? You've got public/private key pairs (both of which are called "keys" in some places
by mikekchar 10y ago
It's not just the UX. A very good example: what does "signing a key" mean? You've got public/private key pairs (both of which are called "keys" in some places), you have a master "key" and sub "keys". The master key is called "the key" but doesn't actually contain the sub keys (which are also called "keys". When you sign a "key" what actually gets signed? (Hint: not a key) Where does the signature go? Etc, etc, etc. The Open PGP protocol is just insanely complicated because it took many different iterations to get right and they didn't want to break backward compatibility. The documentation that tries to explain it is downright wrong because they don't want to go down the rat's nest that is the protocol. So even most technically savvy users have absolutely no idea what's going on.
Unfortunately, it can't really be fixed with UX, IMHO. I think we need to learn from Open PGP and design something that doesn't make people's heads (even programmers) explode.
- atonse 10y agoYeah honestly I'm curious as to why Keybase is using PGP – is it really that widespread, or is it that PGP is so hardened with time? I know the keybase devs lurk around here. Is there perhaps a way to use the Signal Protocol instead of PGP?
- nickpsecurity 10y agoIdk about Keybase but I recommended GPG because it was one of only three or so tech the NSA couldn't break per Snowden leaks. They were smashing most stuff. So, my recommendation was modifying proven code to put a better UI on it that ignored most of the complexity to focus on just fundamental features. Note: Keybase with with their own PGP implementation. Idk what its security is going to be like. I see why they'd use tech that's had years of auditing and attacks, though.