4 ms·
There's not "one" PGP vuln: one of the things that makes PGP so pernicious is that it's a spec, a de facto implementation (GPG), an ecosystem used in different
by lvh 7y ago
There's not "one" PGP vuln: one of the things that makes PGP so pernicious is that it's a spec, a de facto implementation (GPG), an ecosystem used in different contexts (e.g. enterprise file transfer, but also e-mail) by completely different user archetypes. But yes, this post focuses on problems with email in general and why the problems are deeper than something solved with a "better PGP".
- jolmg 7y ago> one of the things that makes PGP so pernicious is that it's a spec, a de facto implementation, an ecosystem used in different contexts (e.g. enterprise file transfer, but also e-mail) Just like SSL/TLS and SSH? They're both specs via RFCs, they both have de facto implementations (openssl and openssh), and they're both used in different contexts (ssh can be used for file transfers, besides remote shells; TLS's applications are very broad like PGP's).
- lvh 7y agoGreat point! Sorry, I should have been clearer: the pernicious part is in _explaining how PGP and encrypted is bad_, which is a Herculean task because there's always another little use case broken in its own subtle way. TLS and SSH have that problem far less, because where they have issues (e.g. SSLv3, let's say), the issues are singular (e.g. the problem is that the obvious way to implement this introduces a padding oracle), not like GPG, where the issues are fractal (e.g. this isn't a real authenticator and consumers can be tricked in unauthenticated data -- a problem that requires a constellation of both GPG's broken crypto but also the specific context of e-mail and also a vulnerable client).