4 ms·

"How much do you trust the owner of this key to sign other keys properly? * I don't know * I do NOT trust * I trust marginally * I trust fully * I trust ul

"How much do you trust the owner of this key to sign other keys properly? * I don't know * I do NOT trust * I trust marginally * I trust fully * I trust ultimately" This is a real pop-up I got the last time I tried to use PGP with Thunderbird. If people still get regular pop-ups like these, I don't think PGP will ever be popular. They might have switched to PEP (pretty easy privacy) that uses TOFU (trust-on-first-use) so maybe this is thing of the past, but I don't know.

quadrifoliate 6y ago
I know it's virtually forbidden to discuss practical details of PGP on HN, but what do you think is the sticking point about that pop-up? It makes people think a little rather than trust blindly, which seems to be...good? I do agree that the marginally and fully options are useless. Wonder if adoption would be better if you just removed them, and were left with: - I don't know what PGP is (exit, opens documentation or a tutorial) - I definitely distrust this key (because it has been marked as malicious in the wild) - I trust this key (because I have verified it either in person, or through a proof like Keybase)
- shp0ngle 6y ago
  Even you misunderstood that question. It's not "how do I trust this person key", but - "how much do I trust this person to sign other people's keys ". As in "how much do I think that other person is careful in checking other people's keys". Not judging his key, or your ability to check keys. You are judging the other person capability to check another, third person keys. This is important for PGP "web of trust".
- deleted 6y ago
  [deleted]
globular-toast 6y ago
Security has a big dirty secret: it's hard. If what you're doing is easy, it ain't security. Simple as that. TOFU works if you actually do it properly. That means verifying the fingerprint of the key you just received out of band once time. Now you can trust that key. How many people do this? Even IT professionals just routinely say yes for new ssh keys without checking. That's not TOFU, that's just trusting that you are not under attack which is not security. TOFU is actually just a degenerative form of web of trust anyway where you just automatically say "I do not trust" to the above so that each new trusted key needs to be established individually. But it does make it easier. Easier to not be doing security at all.
- shp0ngle 6y ago
  When I observed people actually using Enigmail, they just do "search for that person keys" in enigmail, which did search at MIT or whatever, and picked the first (and only) result. (Again, that was before PEP/TOFU. In my former company, we had PGP as a company mandate. Everyone hated that, and it never ever worked properly for group e-mails, no matter how hard we tried to hack it. Not sure what is the experience now.)

quadrifoliate 6y ago

I know it's virtually forbidden to discuss practical details of PGP on HN, but what do you think is the sticking point about that pop-up? It makes people think a little rather than trust blindly, which seems to be...good? I do agree that the marginally and fully options are useless. Wonder if adoption would be better if you just removed them, and were left with: - I don't know what PGP is (exit, opens documentation or a tutorial) - I definitely distrust this key (because it has been marked as malicious in the wild) - I trust this key (because I have verified it either in person, or through a proof like Keybase)

shp0ngle 6y ago
Even you misunderstood that question. It's not "how do I trust this person key", but - "how much do I trust this person to sign other people's keys ". As in "how much do I think that other person is careful in checking other people's keys". Not judging his key, or your ability to check keys. You are judging the other person capability to check another, third person keys. This is important for PGP "web of trust".
deleted 6y ago
[deleted]

globular-toast 6y ago

Security has a big dirty secret: it's hard. If what you're doing is easy, it ain't security. Simple as that. TOFU works if you actually do it properly. That means verifying the fingerprint of the key you just received out of band once time. Now you can trust that key. How many people do this? Even IT professionals just routinely say yes for new ssh keys without checking. That's not TOFU, that's just trusting that you are not under attack which is not security. TOFU is actually just a degenerative form of web of trust anyway where you just automatically say "I do not trust" to the above so that each new trusted key needs to be established individually. But it does make it easier. Easier to not be doing security at all.

shp0ngle 6y ago
When I observed people actually using Enigmail, they just do "search for that person keys" in enigmail, which did search at MIT or whatever, and picked the first (and only) result. (Again, that was before PEP/TOFU. In my former company, we had PGP as a company mandate. Everyone hated that, and it never ever worked properly for group e-mails, no matter how hard we tried to hack it. Not sure what is the experience now.)