3 ms·
>you probably should not do your PGP-encryption server-side PGP-encryption server-side is meaningless, even if it was done client side, there's a MITM. Eve ca
by DINKDINK 9y ago
>you probably should not do your PGP-encryption server-side
PGP-encryption server-side is meaningless, even if it was done client side, there's a MITM. Eve can replace public keys (though at the risk of exposing her MITM if people are double checking their own public keys listed on the site against their client side public keys)
>They tweaked a feature designed to automatically encrypt messages with users' PGP keys, so that it secretly logged each message's full text before encrypting it
Unless this is Wired's way of saying a MITM as described above.
- Buge 9y ago>PGP-encryption server-side is meaningless It's not meaningless, it prevents past messages from being compromised by a future breach. Future messages are still compromised, but past messages are secure. By your logic you could say that forward secrecy is meaningless. But yet security professionals recommend that you use a TLS key exchange with forward secrecy.
- DINKDINK 9y agoI said: If there’s a MITM, server side PGP is meaningless. I didn’t say that server-side PGP has no security value in all domains.