4 ms·

I think PGP should implement a centralized auto-update mechanism so that software can disable itself in cases as severe as listed (with advice to "immediately d

I think PGP should implement a centralized auto-update mechanism so that software can disable itself in cases as severe as listed (with advice to "immediately disable and/or uninstall tools that automatically decrypt PGP-encrypted email"). [I've removed an earlier longer version of this comment.]

jstanley 8y ago
The problem with a comment like this is that it's practically impossible to reply to it without sinking to the same level. You're getting downvoted with no replies because almost everybody disagrees with you but nobody can be bothered to argue your nonsensical points. EDIT: I see now what's going on. You baited people into disagreeing with your crackpottery, you then edited-down or deleted all of your comments in this thread so that we are the ones who look like crackpots. Well played, I guess, but not the kind of conduct I've come to expect on HN.
- rococode 8y ago
  Absolutely agree, although I want to give a better typewriter example. I'd say this announcement is much more similar to: ----- May 14th, 1918. Attention All Users of Typewriters: Stop Using Patented "Secret Envelopes". Recent research has demonstrated that under certain lighting conditions, "Secret Envelopes" become transparent. There are alternatives to "Secret Envelopes" and we urge you to use them instead for the time being. ----- In which case I would not only accept the announcement, but probably toss out my secret envelopes for good, or at least until it's proven to work again.
  - logicallee 8y ago
    [removed]
    - jstanley 8y ago
      > my specific firm, non-negotiable suggestion about the infrastructural changes that PGP admins need to institute. The good news is I don't think anyone is going to make the mistake of trying to negotiate your suggestion.
      - deleted 8y ago
        [deleted]
- deleted 8y ago
  [deleted]
- deleted 8y ago
  [deleted]
- deleted 8y ago
  [deleted]
klez 8y ago
Your comment presupposes that software never ever has bugs, which is clearly hard for any non trivial piece of code. Furthermore, the big is in the decryption part of pgp, so the security of the encrypted communication doesn't seem to be at risk (unless the bug can somehow be used to exfiltrate your keys).
- logicallee 8y ago
  [removed]
  - runesoerensen 8y ago
    > I don't think encrypted data at rest from the past few years can be decrypted It doesn't seem like you have the necessary knowledge about this particular bug to assert that, but the people who do are clearly stating that there's a risk of just that: "EFF has been in communication with the research team, and can confirm that these vulnerabilities pose an immediate risk to those using these tools for email communication, including the potential exposure of the contents of past messages." Also "We'll publish critical vulnerabilities in PGP/GPG and S/MIME email encryption on 2018-05-15 07:00 UTC. They might reveal the plaintext of encrypted emails, including encrypted emails sent in the past." https://twitter.com/seecurity/status/995906576170053633 https://twitter.com/seecurity/status/995906576170053633

jstanley 8y ago

The problem with a comment like this is that it's practically impossible to reply to it without sinking to the same level. You're getting downvoted with no replies because almost everybody disagrees with you but nobody can be bothered to argue your nonsensical points. EDIT: I see now what's going on. You baited people into disagreeing with your crackpottery, you then edited-down or deleted all of your comments in this thread so that we are the ones who look like crackpots. Well played, I guess, but not the kind of conduct I've come to expect on HN.

rococode 8y ago
Absolutely agree, although I want to give a better typewriter example. I'd say this announcement is much more similar to: ----- May 14th, 1918. Attention All Users of Typewriters: Stop Using Patented "Secret Envelopes". Recent research has demonstrated that under certain lighting conditions, "Secret Envelopes" become transparent. There are alternatives to "Secret Envelopes" and we urge you to use them instead for the time being. ----- In which case I would not only accept the announcement, but probably toss out my secret envelopes for good, or at least until it's proven to work again.
- logicallee 8y ago
  [removed]
  - jstanley 8y ago
    > my specific firm, non-negotiable suggestion about the infrastructural changes that PGP admins need to institute. The good news is I don't think anyone is going to make the mistake of trying to negotiate your suggestion.
    - deleted 8y ago
      [deleted]
deleted 8y ago
[deleted]
deleted 8y ago
[deleted]
deleted 8y ago
[deleted]

klez 8y ago

Your comment presupposes that software never ever has bugs, which is clearly hard for any non trivial piece of code. Furthermore, the big is in the decryption part of pgp, so the security of the encrypted communication doesn't seem to be at risk (unless the bug can somehow be used to exfiltrate your keys).

logicallee 8y ago
[removed]
- runesoerensen 8y ago
  > I don't think encrypted data at rest from the past few years can be decrypted It doesn't seem like you have the necessary knowledge about this particular bug to assert that, but the people who do are clearly stating that there's a risk of just that: "EFF has been in communication with the research team, and can confirm that these vulnerabilities pose an immediate risk to those using these tools for email communication, including the potential exposure of the contents of past messages." Also "We'll publish critical vulnerabilities in PGP/GPG and S/MIME email encryption on 2018-05-15 07:00 UTC. They might reveal the plaintext of encrypted emails, including encrypted emails sent in the past." https://twitter.com/seecurity/status/995906576170053633 https://twitter.com/seecurity/status/995906576170053633