5 ms·
You're absolutely correct. But unless the tools are designed so the average user can easily manage their own keys, it's basically PGP again. I think U2F/WebAut
by breput 5y ago
You're absolutely correct. But unless the tools are designed so the average user can easily manage their own keys, it's basically PGP again.
I think U2F/WebAuthn dongles actually could solve this problem but there are all sorts of new problems now like "how do I use this with my iPhone and also with my PC" or "what happens when lose my (physical) keychain with my dongle".
- toastal 5y agoNot necessarily an endorsement (although I do own one), OnlyKey lets you store and use PGP keys in this way as well as U2F, OTP, etc.
- tptacek 5y agoThis is an especially funny thing to say when you compare the number of daily users Signal --- itself a niche cryptosystem --- has to PGP.
- breput 5y agoThe Signal protocol is very well designed but the implementation requires a telephone number (I know it is coming). That's a step removed from PGP which can be completely offline.
- tptacek 5y agoThat's interesting and all, but my point is just that you'll have to stop and think about how many orders of magnitude separate the userbase sizes. A simpler way to make the same point would be that relative to modern cryptography, to a first approximation, nobody uses PGP.
- breput 5y agoMaybe only the right people use PGP.
- tptacek 5y agoI honestly have no trouble believing that's what PGP's userbase believes about themselves, which is absolutely part of the problem.
- UncleMeat 5y agoSafe communication should be available to everybody. Given how many professional engineers botch PGP at some point, it isn't exactly a great option for people like journalists who may need to depend on it with their lives. "Don't worry, these few thousand techies are the only ones that need secure communication" is sheer arrogance.
- approxim8ion 5y agoThat's fine, but even the "right" people need to interact with the "unwashed masses" sometimes. If your cryptosystem isn't readily accessible to everyone, it's kind of useless.
- JoachimSchipper 5y agoA good point, but one addition: nobody directly uses PGP. While Debian and other package signing continues to use PGP (and yes, Debian may move away, and signify/minisign is preferable) there are lots of “infrastructure” uses.
- aborsy 5y agoFunny term, “niche cryptosystem” It’s like a frog, which is about to beat a frog with a wand, frog says, come on, I am already a frog!