3 ms·
> but until there's been some in-depth audits you can't trust it. OTR uses AES-128 w/the Diffie–Hellman key exchange, and SHA-1 hashes to confirm integrity. So
by Someone1234 8y ago
> but until there's been some in-depth audits you can't trust it.
OTR uses AES-128 w/the Diffie–Hellman key exchange, and SHA-1 hashes to confirm integrity. So in terms of technology it is a pretty well travelled road. And the advantages of OTR over PGP make it worth seriously considering for secure messaging.
As to specific implementations I cannot say, but that's true with both OTR and PGP.
- rakoo 8y ago> As to specific implementations I cannot say, but that's true with both OTR and PGP. That's exactly the root of the problem. When you say you use pgp, there's a very high chance you're using gnupg from the command line, ie the one that has been reviewed by every security expert who has wanted any bit of recognition. When you say you're using OTR, everything depends on the specific implementation, so there are infinitely more ways your setup can be compromised. I do agree that from a purely technical point of view OTR is better than PGP (except maybe the need for both parties to be online at the same time, but that's a minor inconvenience when comparing to the additional security OTR provides). But in this case the technical merits are not really important, what is really important is the complete system, and in that view the old, crufty, hard-to-use PGP wins.
- deleted 8y ago[deleted]