> No one criticizes openPGP on the crypto point of view. Hm? Of course PGP is criticized for that, just less vocally. - Authentication is off by default in

> No one criticizes openPGP on the crypto point of view. Hm? Of course PGP is criticized for that, just less vocally. - Authentication is off by default in GPG - Even so, it's very complex, and most of the protocol isn't authenticated [ This is problematic, because ciphers tend to be more or less easily malleable, so non-signed messages can be tampered with; this is also an issue for encrypting files symmetrically ] (- Compression is on by default and makes everything super-slow for no good reason) - Widely used defaults for encryption and key derivation are rather arcane (eg. CAST5) - PGP signatures, by principle, are non-repudiatiable, unlike most modern encrypted chat applications, so they prove to _anyone_ _forever_ that your key signed that message. - PGP format announces all recipients to the world - No forward secrecy possible - ...