3 ms·
PGP is possibly the only workflow worse than SMS based 2FA for humans.
by 35fbe7d3d5b9 5y ago
PGP is possibly the only workflow worse than SMS based 2FA for humans.
- testific8 5y agoHow so?
- 35fbe7d3d5b9 5y agoI don't even know where to start: backwards compatibility to 90s era crypto, no forward secrecy, a web of trust model that encourages you to have a long-lived key – because with short-lived keys your trust has to be rebuilt after expiry, a cryptosystem that violently leaks metadata... PGP should've died years ago; there are far better options today.
- yjftsjthsd-h 5y agoDepends on how you mean "worse"; PGP is very secure with poor UX, SMS is less secure but honestly decent UX.
- 35fbe7d3d5b9 5y agoSeparating UX and "security" from a cryptosystem is impossible. Poor UX leads directly to security vulnerabilities. Heck, we've seen that in library code: your AES implementation may be sound, but if the library interfaces make it easy to reuse an IV, or use a null IV[1], you have a broken cryptosystem. [1]: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-5408 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-5408