3 ms·

For all the flak it's received, PGP has no known flaws if you know how to use it properly. IronChat may have had some security merits (I can't say), but until t

by rakoo 8y ago

For all the flak it's received, PGP has no known flaws if you know how to use it properly. IronChat may have had some security merits (I can't say), but until there's been some in-depth audits you can't trust it. It's not about the technical features that are theoretically available, it's more about how much you can believe they actually hold in reality.

Someone1234 8y ago
> but until there's been some in-depth audits you can't trust it. OTR uses AES-128 w/the Diffie–Hellman key exchange, and SHA-1 hashes to confirm integrity. So in terms of technology it is a pretty well travelled road. And the advantages of OTR over PGP make it worth seriously considering for secure messaging. As to specific implementations I cannot say, but that's true with both OTR and PGP.
- rakoo 8y ago
  > As to specific implementations I cannot say, but that's true with both OTR and PGP. That's exactly the root of the problem. When you say you use pgp, there's a very high chance you're using gnupg from the command line, ie the one that has been reviewed by every security expert who has wanted any bit of recognition. When you say you're using OTR, everything depends on the specific implementation, so there are infinitely more ways your setup can be compromised. I do agree that from a purely technical point of view OTR is better than PGP (except maybe the need for both parties to be online at the same time, but that's a minor inconvenience when comparing to the additional security OTR provides). But in this case the technical merits are not really important, what is really important is the complete system, and in that view the old, crufty, hard-to-use PGP wins.
- deleted 8y ago
  [deleted]
throwawaymath 8y ago
Saying PGP has no known flaws "if you know how to use it properly" is like saying it's easy to safely use AES GCM as long as you never reuse a nonce with the same key. Sure, it's true. But that reasoning kinda obviates everything. Some things are easier to use safely than others. Your second paragraph is basically the essence of criticisms against PGP.
- rakoo 8y ago
  This was all in the context of Edward Snowden allegedly praising ironchat over pgp. I trust the man to be able to use the latter properly and thus being able to use it for secure communications, more than ironchat.

by rakoo 8y ago

Someone1234 8y ago

> but until there's been some in-depth audits you can't trust it. OTR uses AES-128 w/the Diffie–Hellman key exchange, and SHA-1 hashes to confirm integrity. So in terms of technology it is a pretty well travelled road. And the advantages of OTR over PGP make it worth seriously considering for secure messaging. As to specific implementations I cannot say, but that's true with both OTR and PGP.

rakoo 8y ago
> As to specific implementations I cannot say, but that's true with both OTR and PGP. That's exactly the root of the problem. When you say you use pgp, there's a very high chance you're using gnupg from the command line, ie the one that has been reviewed by every security expert who has wanted any bit of recognition. When you say you're using OTR, everything depends on the specific implementation, so there are infinitely more ways your setup can be compromised. I do agree that from a purely technical point of view OTR is better than PGP (except maybe the need for both parties to be online at the same time, but that's a minor inconvenience when comparing to the additional security OTR provides). But in this case the technical merits are not really important, what is really important is the complete system, and in that view the old, crufty, hard-to-use PGP wins.
deleted 8y ago
[deleted]

throwawaymath 8y ago

Saying PGP has no known flaws "if you know how to use it properly" is like saying it's easy to safely use AES GCM as long as you never reuse a nonce with the same key. Sure, it's true. But that reasoning kinda obviates everything. Some things are easier to use safely than others. Your second paragraph is basically the essence of criticisms against PGP.

rakoo 8y ago
This was all in the context of Edward Snowden allegedly praising ironchat over pgp. I trust the man to be able to use the latter properly and thus being able to use it for secure communications, more than ironchat.