5 ms·

Offtopic, but what's with all the PGP signatures? One message is literally just "this message is signed with my key", followed by a key and a previous key. Is t

Offtopic, but what's with all the PGP signatures? One message is literally just "this message is signed with my key", followed by a key and a previous key. Is this a meta joke, automated signing (like signed emails), or am I tripping?!

FDSGSG 6y ago
PGP means it's serious!
sneak 6y ago
No, they're cosplaying security/encryption experts, in an effort to have their attempt at seeking attention seem less like the farce that it is.
- lionkor 6y ago
  My first reaction was that surely this must be satire, because the last thing I ask myself reading that post is "but how do I know these 2FA GitHub accounts are not hacked?!" ...
danparsonson 6y ago
This is a community with a strong focus on security - they're proving their identity when they post to add their agreement.
- lionkor 6y ago
  I don't mean to argue, but I believe github's account system with 2FA should be more than secure enough. If it's not, then why even start a bbs there? Why not just use a signed & encrypted email chain? Seems trivial, especially for what wants to appear to be security professionals.
  - smeej 6y ago
    I work in account security, not for GH, but another platform. Account security with 2FA is a long way from foolproof. Accounts get compromised all the time, especially by phishing or malware. That's why my company's internal emails are all PGP encrypted and signed, even with managed accounts and YubiKey authentication. When it really, really matters, you need more than 2FA.
    - lionkor 6y ago
      Yes, of course, I agree! Where I disagree is the notion that putting some PGP keys in a github issues comment is going to prevent anything :/ Edit: Like, if I had hacked one of their accounts, what's keeping me from commenting there and just copy-pasting the key they used before, or generating a new one? Are they going to check?
      - ylyn 6y ago
        It's proof that it IS them who posted that comment.
        maqp 6y ago
        It is proof that someone with a copy of the private key posted that comment. Also this https://xkcd.com/1181/ https://xkcd.com/1181/
      - smeej 6y ago
        They easily could if they wanted to, which is the point. If at any point in the future, someone wanted to say, "Well, so-and-so may not really have been the one who posted it," or, on the other hand, one of the signers later wanted to renege and say they didn't really sign it, it's going to be a lot harder for anyone to buy that the account credentials and PGP privkey were stolen and used than just that someone somehow spoofed a post from an account. It's like the difference between posting a +1 retweet and having a signed document notarized. One of those is a lot harder to claim was faked/unauthorized later.
  - pera 6y ago
    But that's exactly the point isn't it? I mean, using pgp because you don't trust the communication channel. And you would still have the same issue with a mailing list.
- FDSGSG 6y ago
  It's a LARP, not about a strong focus on security. These people do not normally sign their comments.
- proactivesvcs 6y ago
  And many of them providing digitally-signed statements such as "I agree with this article" which anyone can simply copy and paste into any other discussion, at any time. I'd suggest that implies a dangerous level of understanding of the tools they're using.
maqp 6y ago
It's useful when e.g. Roger Dingledine who represents the entire Tor Project wants to make a public statement. It's pseudo-intellectual BS when some random GitHub account with edgy repos like https://github.com/studentmain/fuck-signal-tls-proxy https://github.com/studentmain/fuck-signal-tls-proxy does it.
throwawayffffas 6y ago
Here's how moxie feels about people using PGP. https://moxie.org/2015/02/24/gpg-and-me.html https://moxie.org/2015/02/24/gpg-and-me.html
woodruffw 6y ago
This threw me off too. PGP in these contexts isn't a proof of any meaningful properties, and reads mostly as theater/additional drama. Using a non-repudiatable signing system to promote claims about how a proxy is easy to detect comes off as very hinky to me, to use a technical term.

FDSGSG 6y ago

PGP means it's serious!

sneak 6y ago

No, they're cosplaying security/encryption experts, in an effort to have their attempt at seeking attention seem less like the farce that it is.

lionkor 6y ago
My first reaction was that surely this must be satire, because the last thing I ask myself reading that post is "but how do I know these 2FA GitHub accounts are not hacked?!" ...

danparsonson 6y ago

This is a community with a strong focus on security - they're proving their identity when they post to add their agreement.

lionkor 6y ago
I don't mean to argue, but I believe github's account system with 2FA should be more than secure enough. If it's not, then why even start a bbs there? Why not just use a signed & encrypted email chain? Seems trivial, especially for what wants to appear to be security professionals.
- smeej 6y ago
  I work in account security, not for GH, but another platform. Account security with 2FA is a long way from foolproof. Accounts get compromised all the time, especially by phishing or malware. That's why my company's internal emails are all PGP encrypted and signed, even with managed accounts and YubiKey authentication. When it really, really matters, you need more than 2FA.
  - lionkor 6y ago
    Yes, of course, I agree! Where I disagree is the notion that putting some PGP keys in a github issues comment is going to prevent anything :/ Edit: Like, if I had hacked one of their accounts, what's keeping me from commenting there and just copy-pasting the key they used before, or generating a new one? Are they going to check?
    - ylyn 6y ago
      It's proof that it IS them who posted that comment.
      - maqp 6y ago
        It is proof that someone with a copy of the private key posted that comment. Also this https://xkcd.com/1181/ https://xkcd.com/1181/
    - smeej 6y ago
      They easily could if they wanted to, which is the point. If at any point in the future, someone wanted to say, "Well, so-and-so may not really have been the one who posted it," or, on the other hand, one of the signers later wanted to renege and say they didn't really sign it, it's going to be a lot harder for anyone to buy that the account credentials and PGP privkey were stolen and used than just that someone somehow spoofed a post from an account. It's like the difference between posting a +1 retweet and having a signed document notarized. One of those is a lot harder to claim was faked/unauthorized later.
- pera 6y ago
  But that's exactly the point isn't it? I mean, using pgp because you don't trust the communication channel. And you would still have the same issue with a mailing list.
FDSGSG 6y ago
It's a LARP, not about a strong focus on security. These people do not normally sign their comments.
proactivesvcs 6y ago
And many of them providing digitally-signed statements such as "I agree with this article" which anyone can simply copy and paste into any other discussion, at any time. I'd suggest that implies a dangerous level of understanding of the tools they're using.

maqp 6y ago

It's useful when e.g. Roger Dingledine who represents the entire Tor Project wants to make a public statement. It's pseudo-intellectual BS when some random GitHub account with edgy repos like https://github.com/studentmain/fuck-signal-tls-proxy https://github.com/studentmain/fuck-signal-tls-proxy does it.

throwawayffffas 6y ago

Here's how moxie feels about people using PGP. https://moxie.org/2015/02/24/gpg-and-me.html https://moxie.org/2015/02/24/gpg-and-me.html

woodruffw 6y ago

This threw me off too. PGP in these contexts isn't a proof of any meaningful properties, and reads mostly as theater/additional drama. Using a non-repudiatable signing system to promote claims about how a proxy is easy to detect comes off as very hinky to me, to use a technical term.