4 ms·
The Signal protocol is very well designed but the implementation requires a telephone number (I know it is coming). That's a step removed from PGP which can be
by breput 5y ago
The Signal protocol is very well designed but the implementation requires a telephone number (I know it is coming). That's a step removed from PGP which can be completely offline.
- tptacek 5y agoThat's interesting and all, but my point is just that you'll have to stop and think about how many orders of magnitude separate the userbase sizes. A simpler way to make the same point would be that relative to modern cryptography, to a first approximation, nobody uses PGP.
- breput 5y agoMaybe only the right people use PGP.
- tptacek 5y agoI honestly have no trouble believing that's what PGP's userbase believes about themselves, which is absolutely part of the problem.
- UncleMeat 5y agoSafe communication should be available to everybody. Given how many professional engineers botch PGP at some point, it isn't exactly a great option for people like journalists who may need to depend on it with their lives. "Don't worry, these few thousand techies are the only ones that need secure communication" is sheer arrogance.
- approxim8ion 5y agoThat's fine, but even the "right" people need to interact with the "unwashed masses" sometimes. If your cryptosystem isn't readily accessible to everyone, it's kind of useless.
- JoachimSchipper 5y agoA good point, but one addition: nobody directly uses PGP. While Debian and other package signing continues to use PGP (and yes, Debian may move away, and signify/minisign is preferable) there are lots of “infrastructure” uses.