3 ms·

The link you've given is good, but I think it misses two major aspects that the suggested alternatives don't deal with: identity management+verification and eas

The link you've given is good, but I think it misses two major aspects that the suggested alternatives don't deal with: identity management+verification and ease of key management. The former being something entire countries are struggling with, how do we know the correct person is actually receiving the content, how can I be sure? WoT, PKI, whatever. You fail this, the rest is in practice IMHO less than useless. There's things like https://keybase.io https://keybase.io that did try to solve this to a reasonable extent, PGP but more modern. It looked hopeful, but Zoom seems to only keep it on life support. Maybe someone will continue, anyways, I digress. The second aspect is IMHO what determines how usable it is for a single person over long period of time. Maintaining backups of minisig keys, chat keys (or even not being able to do so), file encryption keys is difficult to say the least. It's unlikely you'll even be able to use a HSM for your secrets like a YubiKey. The same negatives listed against PGP apply to other systems suggested in the article. For example how do I communicate to people sending me encrypted messages that I lost and migrated to a new key/subkey? It's a very hairy problem. (This reminds me, does anyone here know how to get PGP paper keys that use only english words e.g. "brunch pineapple house crow ..."? And does anyone know why we aren't using english words to compare PGP key IDs yet?) I agree with a lot what the article lists, but the alternatives suggested really aren't compelling when looking at the actual problem. Judging based on the market share, I think I'm not the only one that thinks so.

uryga 6y ago
> This reminds me, does anyone here know how to get PGP paper keys that use only english words e.g. "brunch pineapple house crow ..."? maybe BIP39? (afaik it's used for paper keys in bitcoin-adjacent things) https://github.com/bitcoin/bips/blob/master/bip-0039.mediawiki https://github.com/bitcoin/bips/blob/master/bip-0039.mediawi...
- Avamander 6y ago
  Yep, that's what I'm looking for, but for PGP/GPG. I'd like to avoid homebrew key recovery schemes because I don't want it to become a pain to recover.
lmm 6y ago
> (This reminds me, does anyone here know how to get PGP paper keys that use only english words e.g. "brunch pineapple house crow ..."? And does anyone know why we aren't using english words to compare PGP key IDs yet?) PGP invented that, and if you use actual PGP it will tell you your key fingerprint in English words, using https://en.wikipedia.org/wiki/PGP_word_list https://en.wikipedia.org/wiki/PGP_word_list . Someone submitted a patch to GPG to do the same, but it got rejected for being non-localisable and bikeshedded to death.
- Avamander 6y ago
  > Someone submitted a patch to GPG to do the same, but it got rejected for being non-localisable and bikeshedded to death. Oh for fsck sake. Do they understand how much of a hassle it is currently?
Boulth6 6y ago
> There's things like https://keybase.io https://keybase.io that did try to solve this to a reasonable extent, PGP but more modern. It looked hopeful, but Zoom seems to only keep it on life support. Maybe someone will continue It seems there's already Keybase like solution using OpenPGP only (no centralized infrastructure needed): https://keyoxide.org/ https://keyoxide.org/
- Avamander 6y ago
  Interesting, cool to see someone building a similar service to Keybase's account proofs. Hopefully they'll also build something like Keybase's proof integration https://book.keybase.io/guides/proof-integration-guide https://book.keybase.io/guides/proof-integration-guide as well. If you have any suggestions as to which E2E (group) messaging+fileshare+git platform I could use as a replacement for Keybase I'm all ears.
  - Boulth6 6y ago
    > Hopefully they'll also build something like Keybase's proof integration https://book.keybase.io/guides/proof-integration-guide https://book.keybase.io/guides/proof-integration-guide as well. As far as I've seen the proof integration is used only for Mastodon insurances and Keyoxide supports all of them by default: no need to ask for permission, no weird conditions to enter like, instance has to be bigger than N people. I see this as a way to control who gets into Keybase. A perfect example of centralized control. The idea of programmable proofs looks good though. > If you have any suggestions as to which E2E (group) messaging+fileshare+git platform I could use as a replacement for Keybase I'm all ears. Sadly I won't help you with that. There are a number of services that want to eat Keybase's cake now but neither of them hits all points on my scale. So I'm using mostly several different services to get a semblance of the Keybase experience.
    - Avamander 6y ago
      > As far as I've seen the proof integration is used only for Mastodon insurances Just Mastodon a very narrow view of what could be implemented though. I saw alpha implementation for Discourse as well, before Zoom acquired them. > no need to ask for permission, no weird conditions to enter like, instance has to be bigger than N people. Yep that sounds reasonable, as long as we're not going to end up with a DoS because of too many proofs.

uryga 6y ago

> This reminds me, does anyone here know how to get PGP paper keys that use only english words e.g. "brunch pineapple house crow ..."? maybe BIP39? (afaik it's used for paper keys in bitcoin-adjacent things) https://github.com/bitcoin/bips/blob/master/bip-0039.mediawiki https://github.com/bitcoin/bips/blob/master/bip-0039.mediawi...

Avamander 6y ago
Yep, that's what I'm looking for, but for PGP/GPG. I'd like to avoid homebrew key recovery schemes because I don't want it to become a pain to recover.

lmm 6y ago

> (This reminds me, does anyone here know how to get PGP paper keys that use only english words e.g. "brunch pineapple house crow ..."? And does anyone know why we aren't using english words to compare PGP key IDs yet?) PGP invented that, and if you use actual PGP it will tell you your key fingerprint in English words, using https://en.wikipedia.org/wiki/PGP_word_list https://en.wikipedia.org/wiki/PGP_word_list . Someone submitted a patch to GPG to do the same, but it got rejected for being non-localisable and bikeshedded to death.

Avamander 6y ago
> Someone submitted a patch to GPG to do the same, but it got rejected for being non-localisable and bikeshedded to death. Oh for fsck sake. Do they understand how much of a hassle it is currently?

Boulth6 6y ago

> There's things like https://keybase.io https://keybase.io that did try to solve this to a reasonable extent, PGP but more modern. It looked hopeful, but Zoom seems to only keep it on life support. Maybe someone will continue It seems there's already Keybase like solution using OpenPGP only (no centralized infrastructure needed): https://keyoxide.org/ https://keyoxide.org/

Avamander 6y ago
Interesting, cool to see someone building a similar service to Keybase's account proofs. Hopefully they'll also build something like Keybase's proof integration https://book.keybase.io/guides/proof-integration-guide https://book.keybase.io/guides/proof-integration-guide as well. If you have any suggestions as to which E2E (group) messaging+fileshare+git platform I could use as a replacement for Keybase I'm all ears.
- Boulth6 6y ago
  > Hopefully they'll also build something like Keybase's proof integration https://book.keybase.io/guides/proof-integration-guide https://book.keybase.io/guides/proof-integration-guide as well. As far as I've seen the proof integration is used only for Mastodon insurances and Keyoxide supports all of them by default: no need to ask for permission, no weird conditions to enter like, instance has to be bigger than N people. I see this as a way to control who gets into Keybase. A perfect example of centralized control. The idea of programmable proofs looks good though. > If you have any suggestions as to which E2E (group) messaging+fileshare+git platform I could use as a replacement for Keybase I'm all ears. Sadly I won't help you with that. There are a number of services that want to eat Keybase's cake now but neither of them hits all points on my scale. So I'm using mostly several different services to get a semblance of the Keybase experience.
  - Avamander 6y ago
    > As far as I've seen the proof integration is used only for Mastodon insurances Just Mastodon a very narrow view of what could be implemented though. I saw alpha implementation for Discourse as well, before Zoom acquired them. > no need to ask for permission, no weird conditions to enter like, instance has to be bigger than N people. Yep that sounds reasonable, as long as we're not going to end up with a DoS because of too many proofs.