6 ms·

I have sooooo many lost emails due to lost pgp configurations. Encrypted blobs in my mail spools.

by cowmix 5y ago

nolok 5y ago
The fact that you couldn't restore no matter what without the key speaks for pgp rather than against, in my book. By comparison I have very little trust in modern IM software.
- approxim8ion 5y ago
  Do you think I could restore an encrypted signal backup without the key?
  - nolok 5y ago
    You missed my point which was not about whether you could, but about whether someone else could, either from your backup or from a entirely different copy they could have acquired during the original transmission. Same way I wouldn't trust a gmail/outlook/whatever-apple-named-theirs automatic mail encryption the way I can trust a bulky weird to use pgp one.
    - approxim8ion 5y ago
      > but about whether someone else could... Why would they be able to? I haven't heard of any such exploits for Signal, and their crypto as well as their app-related code is open, well-documented, and repeatedly audited.
      - nolok 5y ago
        You're focusing on signal for some reason, ignoring the larger point being made Also: > their crypto as well as their app-related code is open, well-documented, and repeatedly audited. And since nobody builds their executable from source, it doesn't at all guarantee anything about the version I have on my phone right now, unless I do a lot of extra check that virtually no one will do on every update. If whatever entity* aiming for me chose to target a specific update at me on the store that did a clear copy send on the side, I would never know. * Say, China aiming for a chinese user on whatever chinese app store is popular at the moment, to take the most obvious (but clearly not only) exemple
        approxim8ion 5y ago
        > And since nobody builds their executable from source How many people build gnupg or gpg-agent from source? > Whatever entity Seems like something your local apt/pacman repository mirror host could do too. It's a fair concern. I'm not trying to be disingenuous, sorry if it comes off that way. I'm just focusing on Signal because you wrote "modern IM software".
        nolok 5y ago
        > How many people build gnupg or gpg-agent from source? More people than those build signal from source > Seems like something your local apt/pacman repository mirror host could do too. Which is why I focus on build from source, and more people fo it for pgp than any im software out there.
IanClarke 5y ago
Today's analogy is bitcoin... Will all Bitcoin just be lost one day, because all keys get lost? I am aware that "there are solutions", but are they (really) enough? Isn't "breaking in" required at some point? Another endgame for Bitcoin is that all Bitcoin are stolen through the one tool which helps with (unbreakable) encryption: Hacking / social engineering. Besides that we hab substantial discussions about why PGP isn't really cutting it for use with email (to cumbersome, at one point you lose your private key, recipient struggles to decrypt, etc.).
Gradient-Ascent 5y ago
Today's analogy is bitcoin... Will all Bitcoin just be lost one day, because all keys get lost? I am aware that "there are solutions", but are they (really) enough? Isn't "breaking in" required at some point? Another endgame for Bitcoin is that all Bitcoin are stolen through the one tool which helps with ("unbreakable") encryption: Hacking / social engineering. Besides that we hab substantial discussions about why PGP isn't really cutting it for use with email (to cumbersome, at one point you lose your private key, recipient struggles to decrypt, etc.).
- artursapek 5y ago
  More and more Bitcoin is going to be held by custodians, like crypto exchanges, retail trading apps like Robinhood, and even traditional banks. Handling your own Bitcoin keys will end up being a niche cypherpunk thing, like using command-line PGP. It's actually a perfect analogy, because most popular "E2EE" chat apps are also custodial with your keys.
  - Gradient-Ascent 5y ago
    You don't own your bitcoin then (if you are not the only one who has the key) - Elon Musk pointed that out. The custodian owns your Bitcoin (and can run away with them or also lose the key).
    - artursapek 5y ago
      No shit, but the successful custodians are the ones who have insurance on deposits and enough reputation that people are not afraid of them exit scamming. You don’t physically hold your stocks and cash either.
      - Gradient-Ascent 5y ago
        "No shit" - It's a bit over the top to denounce me here as "Mr. Obvious", but funny, so this shall be forgiven to you. Musk is hot and at the forefront and he said it the other day. There is a lot of running away with bitcoins still/currently (Mt. Gox) and they are not insured. Probably the endgame of Bitcoin: All Bitcoin get lost or stolen, but were reimbursed/payed out via an insurance :-D - The full value of all Bitcoin payed by the insurance.

I have sooooo many lost emails due to lost pgp configurations. Encrypted blobs in my mail spools.

by cowmix 5y ago

I have sooooo many lost emails due to lost pgp configurations. Encrypted blobs in my mail spools.

The fact that you couldn't restore no matter what without the key speaks for pgp rather than against, in my book. By comparison I have very little trust in modern IM software.

approxim8ion 5y ago
Do you think I could restore an encrypted signal backup without the key?
- nolok 5y ago
  You missed my point which was not about whether you could, but about whether someone else could, either from your backup or from a entirely different copy they could have acquired during the original transmission. Same way I wouldn't trust a gmail/outlook/whatever-apple-named-theirs automatic mail encryption the way I can trust a bulky weird to use pgp one.
  - approxim8ion 5y ago
    > but about whether someone else could... Why would they be able to? I haven't heard of any such exploits for Signal, and their crypto as well as their app-related code is open, well-documented, and repeatedly audited.
    - nolok 5y ago
      You're focusing on signal for some reason, ignoring the larger point being made Also: > their crypto as well as their app-related code is open, well-documented, and repeatedly audited. And since nobody builds their executable from source, it doesn't at all guarantee anything about the version I have on my phone right now, unless I do a lot of extra check that virtually no one will do on every update. If whatever entity* aiming for me chose to target a specific update at me on the store that did a clear copy send on the side, I would never know. * Say, China aiming for a chinese user on whatever chinese app store is popular at the moment, to take the most obvious (but clearly not only) exemple
      - approxim8ion 5y ago
        > And since nobody builds their executable from source How many people build gnupg or gpg-agent from source? > Whatever entity Seems like something your local apt/pacman repository mirror host could do too. It's a fair concern. I'm not trying to be disingenuous, sorry if it comes off that way. I'm just focusing on Signal because you wrote "modern IM software".
        nolok 5y ago
        > How many people build gnupg or gpg-agent from source? More people than those build signal from source > Seems like something your local apt/pacman repository mirror host could do too. Which is why I focus on build from source, and more people fo it for pgp than any im software out there.

IanClarke 5y ago

Today's analogy is bitcoin... Will all Bitcoin just be lost one day, because all keys get lost? I am aware that "there are solutions", but are they (really) enough? Isn't "breaking in" required at some point? Another endgame for Bitcoin is that all Bitcoin are stolen through the one tool which helps with (unbreakable) encryption: Hacking / social engineering. Besides that we hab substantial discussions about why PGP isn't really cutting it for use with email (to cumbersome, at one point you lose your private key, recipient struggles to decrypt, etc.).

Gradient-Ascent 5y ago

Today's analogy is bitcoin... Will all Bitcoin just be lost one day, because all keys get lost? I am aware that "there are solutions", but are they (really) enough? Isn't "breaking in" required at some point? Another endgame for Bitcoin is that all Bitcoin are stolen through the one tool which helps with ("unbreakable") encryption: Hacking / social engineering. Besides that we hab substantial discussions about why PGP isn't really cutting it for use with email (to cumbersome, at one point you lose your private key, recipient struggles to decrypt, etc.).

artursapek 5y ago
More and more Bitcoin is going to be held by custodians, like crypto exchanges, retail trading apps like Robinhood, and even traditional banks. Handling your own Bitcoin keys will end up being a niche cypherpunk thing, like using command-line PGP. It's actually a perfect analogy, because most popular "E2EE" chat apps are also custodial with your keys.
- Gradient-Ascent 5y ago
  You don't own your bitcoin then (if you are not the only one who has the key) - Elon Musk pointed that out. The custodian owns your Bitcoin (and can run away with them or also lose the key).
  - artursapek 5y ago
    No shit, but the successful custodians are the ones who have insurance on deposits and enough reputation that people are not afraid of them exit scamming. You don’t physically hold your stocks and cash either.
    - Gradient-Ascent 5y ago
      "No shit" - It's a bit over the top to denounce me here as "Mr. Obvious", but funny, so this shall be forgiven to you. Musk is hot and at the forefront and he said it the other day. There is a lot of running away with bitcoins still/currently (Mt. Gox) and they are not insured. Probably the endgame of Bitcoin: All Bitcoin get lost or stolen, but were reimbursed/payed out via an insurance :-D - The full value of all Bitcoin payed by the insurance.