3 ms·
I think the people you are quoting live in a different world than me. I don't talk to whistle blowers that much. And sure there are still attack vectors. Howe
by riedel 7y ago
I think the people you are quoting live in a different world than me.
I don't talk to whistle blowers that much. And sure there are still attack vectors.
However I want to protect my email that may contain personal information from being leaked. Both SMIME and PGP do a reasonably good job. Until something usable and widespread appears.
Also digital signing seems to be better to me than sending scans with signatures . This is the reality.
People would call me nuts for sending them age signed content. I see really no benefit in using different keys . It seems also not formally verified . To much evangelism for me.
- joshuamorton 7y ago> However I want to protect my email that may contain personal information from being leaked. Both SMIME and PGP do a reasonably good job. Until something usable and widespread appears. PGP provides essentially no additional protection beyond SMIME, and provides a false sense of security. PGP is a bad standard that should die. Age doesn't have much to be formally verified. It uses well understood crypto primitives from the go standard library. What formal verification do you want? That the arguments are passed to the underlying libraries correctly?
- riedel 7y agoWhy would pgp need to add sth over smime cryptowise? To me the difference is trust allowing sth. like autocrypt to be implemented . For me both work when build into a client: Regarding proofs, i was just trying to comment on all the go/rust praises. Why would i need type safety if its such a thin layer. I am using openssl with bash for trivial encryption tasks. Not much can go wrong either. An Ada spark re-implementation of gpg would be still prefered by me if you just complain about too much nonauditable code.
- joshuamorton 7y agoIf it didn't add security, why use it?