3 ms·
The discussion of the original article (The PGP Problem) got a lot of comments on HN 2 years ago: https://news.ycombinator.com/item?id=20455780 https://news.yc
by kyrra 5y ago
The discussion of the original article (The PGP Problem) got a lot of comments on HN 2 years ago: https://news.ycombinator.com/item?id=20455780 https://news.ycombinator.com/item?id=20455780
(googler, opinions are my own)
Over at payments in Google, we still use PGP for communicating with the financial world (JWE supported too)[0]. The one advantage of PGP is that it's been around so long, many companies already have it set up in their systems when communicating with them. Be it files or application level communications, support is already there.
PGP definitely has it's rough edges. Tools with simplified APIs like Tink[1] seems to be the way security researches want to go, as PGP definitely makes it easy to do things wrong (just due to how much legacy support it has out there).
[0] https://developers.google.com/standard-payments/guides/connectivity/security/application-layer https://developers.google.com/standard-payments/guides/conne...
[1] https://github.com/google/tink https://github.com/google/tink
- themulticaster 5y agoI'm curious about the communication with the financial world you mention. Could you elaborate what kind of interface or API you're talking about, or at least which area of finance is involved?
- kyrra 5y agoI really should say payments world. Banks use PGP regularly for file transfer (bank statements and the like). Payment processors use PGP for settlement statement transferring. The page I linked uses PGP for application layer encryption. If you poke around the reference page[0], you see a bunch of different specs that 3rd party platforms can build against and be hooked up into Google as a form-of-payment (ie: used by people to pay for Ads, Play, Cloud, etc...). We encrypt each message passed between Google and a payment process with PGP. These are just normal server-to-server calls over HTTPS with JSON payloads (with the json payload being PGP encrypted). [0] https://developers.google.com/standard-payments/payment-integrator-tokenized-fop-api-v1 https://developers.google.com/standard-payments/payment-inte...