4 ms·

While I do agree with you on the IBM truck remarks, I find myself heavily disagreeing with the "PGP / SMTP over TLS" is LARPing" gentleman. For one, he makes t

While I do agree with you on the IBM truck remarks, I find myself heavily disagreeing with the "PGP / SMTP over TLS" is LARPing" gentleman. For one, he makes the argument that it's all a theater. Is it broken ? Yes. Does it provide some non-negligeable level of confidentiality ? Absolutely. Is it "broken" in some way or another ? Yes. But that doesn't mean we should just fall back to regular plain unencrypted email when PGP MAKES MORE SENSE. I myself don't use PGP when it doesn't really make sense. But when sending a security vulnerability, I'd say it's pretty safe to assume you're not LARPing at that point. Sure, maybe they know you're sending a PoC. But that will at least delay them for a couple of days (or hours if you're a high value target). A comment on that thread expressed exactly what I feel and what I assume what most of security minded people feel: Sure, it is not perfect. But if I want perfect-secrect (as perfect as it theoretically gets anyway), I'm going to use Signal. But when your company has e-mail as the main communication form, it doesn't make much sense to use another form of communication, it will hinder productivity and obstruct your company's processes. All in all, LARPing is a strong word. If anything, we should applaud the effort confidentiality-minded people put up, and push for better protocols.

iudqnolq 7y ago
You're probably aware, but the obvious counterargument people make to what you've said is that for some people such as activists under repressive regimes they would rather not be able to email than email under the mistaken belief what they were sending is highly secure. TFA on that article said the risk is non-technical users seeing technical users use PGP and assuming it's a good option when there are high stakes.
- aneutron 7y ago
  I hadn't thought about that possibility. But I think it's arguably more of a cultural and informational, rather than a technical thing. But I do agree that when the stakes are high, mistakes like these can mean life or death. But again, that can be solved by trying to better the general understanding of confidential communication systems.
  - iudqnolq 7y ago
    I agree with most of that, which is why I think LARPing is a fair metaphor. It succinctly gets across that this is a cool thing for techies but not for general usage when it's safety critical.

iudqnolq 7y ago

You're probably aware, but the obvious counterargument people make to what you've said is that for some people such as activists under repressive regimes they would rather not be able to email than email under the mistaken belief what they were sending is highly secure. TFA on that article said the risk is non-technical users seeing technical users use PGP and assuming it's a good option when there are high stakes.

aneutron 7y ago
I hadn't thought about that possibility. But I think it's arguably more of a cultural and informational, rather than a technical thing. But I do agree that when the stakes are high, mistakes like these can mean life or death. But again, that can be solved by trying to better the general understanding of confidential communication systems.
- iudqnolq 7y ago
  I agree with most of that, which is why I think LARPing is a fair metaphor. It succinctly gets across that this is a cool thing for techies but not for general usage when it's safety critical.