4 ms·

I have a canned response to this hoary old chestnut: * https://articles.59.ca/doku.php?id=pgpfan:tpp https://articles.59.ca/doku.php?id=pgpfan:tpp

encryptluks2 5y ago
I think most people complaining about GPG just don't want to be bothered with figuring anything out. They'd rather input their phone number into some cloud app that says it is secure and feel more secure than actually be bothered with understanding security in the first place.
- akerl_ 5y ago
  This is pretty wild. I’ve spent a decade working in the industry, most of it unwinding complex infrastructure and codebases. I don’t hate GPG because I can’t be bothered to figure it out. I understand it and it’s bad at handling the problems it claims to solve.
  - encryptluks2 5y ago
    Such as? Can you provide any examples?
    - akerl_ 5y ago
      https://latacora.micro.blog/2019/07/16/the-pgp-problem.html https://latacora.micro.blog/2019/07/16/the-pgp-problem.html
      - encryptluks2 5y ago
        I really don't have time to go through every item in the biased article, but you can hide recipients, you can use Ed25519. Seriously, if I was influenced by every blog post I read then I would probably be using Windows 7 still and trusting everything Gartner says.
        akerl_ 5y ago
        It seems a bit rude to ask me for examples, have me provide one, and then just shrug it off that you don’t have time to address the items. “You can use ed25519” kindof flies in the face of the point being made in the post, which is that sure, you can use modern crypto, but you’re bounded by the lowest common denominator, and GPG’s lowest common denominator is horrible broken crypto selections.
        encryptluks2 5y ago
        Yet the article is just making baseless accusations and so are you.
tptacek 5y ago
You also have a lot of weird cryptographic beliefs, like "authenticated encryption is a misfeature for tools like PGP, because unauthenticated ciphertext helps with data recovery", or "GPGME definitely doesn't just execute the GPG binary in order to perform PGP operations", or "forward secrecy is overrated because people keep all their old messages around" (also: "people should keep all their old messages around"). People that also believe these weird things will find your canned reply convincing. Cryptography engineers generally will not. The word "hoary" means "grey-haired". "Stop Using Encrypted Email" was published in 2020; even in dog years, it's not "hoary".

encryptluks2 5y ago

I think most people complaining about GPG just don't want to be bothered with figuring anything out. They'd rather input their phone number into some cloud app that says it is secure and feel more secure than actually be bothered with understanding security in the first place.

akerl_ 5y ago
This is pretty wild. I’ve spent a decade working in the industry, most of it unwinding complex infrastructure and codebases. I don’t hate GPG because I can’t be bothered to figure it out. I understand it and it’s bad at handling the problems it claims to solve.
- encryptluks2 5y ago
  Such as? Can you provide any examples?
  - akerl_ 5y ago
    https://latacora.micro.blog/2019/07/16/the-pgp-problem.html https://latacora.micro.blog/2019/07/16/the-pgp-problem.html
    - encryptluks2 5y ago
      I really don't have time to go through every item in the biased article, but you can hide recipients, you can use Ed25519. Seriously, if I was influenced by every blog post I read then I would probably be using Windows 7 still and trusting everything Gartner says.
      - akerl_ 5y ago
        It seems a bit rude to ask me for examples, have me provide one, and then just shrug it off that you don’t have time to address the items. “You can use ed25519” kindof flies in the face of the point being made in the post, which is that sure, you can use modern crypto, but you’re bounded by the lowest common denominator, and GPG’s lowest common denominator is horrible broken crypto selections.
        encryptluks2 5y ago
        Yet the article is just making baseless accusations and so are you.

tptacek 5y ago

You also have a lot of weird cryptographic beliefs, like "authenticated encryption is a misfeature for tools like PGP, because unauthenticated ciphertext helps with data recovery", or "GPGME definitely doesn't just execute the GPG binary in order to perform PGP operations", or "forward secrecy is overrated because people keep all their old messages around" (also: "people should keep all their old messages around"). People that also believe these weird things will find your canned reply convincing. Cryptography engineers generally will not. The word "hoary" means "grey-haired". "Stop Using Encrypted Email" was published in 2020; even in dog years, it's not "hoary".