5 ms·

Does this mean we will finally have key signing parties? I'm gonna make so many friends.

klabb3 4y ago
Yes. You bring your dongle and put it in everyone’s laptops. Others put their dongles in yours. On a more serious note, I think even the author of GPG said that it was too complicated to use. It’s unfortunate, because we need e2ee auth & encryption more now than any time before.
- deleted 4y ago
  [deleted]
- mr_mitm 4y ago
  Phil Zimmermann, inventor of PGP, couldn't figure out how to make it work on his mac. https://www.vice.com/en/article/vvbw9a/even-the-inventor-of-pgp-doesnt-use-pgp https://www.vice.com/en/article/vvbw9a/even-the-inventor-of-...
  - __MatrixMan__ 4y ago
    Ever played wingspan? I have been, and I'm soaking up all of this information about birds that I never thought I'd know, and having fun too. I'd like to make a board game that teaches web-of-trust hygiene in the same way. Then there can be an app that feels like playing the game, but really it's just a wrapper around PGP.
- __MatrixMan__ 4y ago
  Actually, it's a pen-and-paper kind of shindig: https://security.stackexchange.com/questions/126533/why-shouldnt-i-bring-a-computer-to-a-key-signing-party https://security.stackexchange.com/questions/126533/why-shou...
brundolf 4y ago
Jokes/nostalgia aside, you don't really even need fancy encryption mechanisms. All that's important is that you only use the internet to interact with trusted parties, vs treating it as a public square where you can ~generally tell whether someone is a real person. A domain name, an email address, a social media username, etc are all as trustworthy as they are right now as long as you've verified the person is real through some non-digital channel first (or someone you trust has) I think the public social internet will die (for anything other than entertainment), but the direct-communication internet will look largely the same as it does today
- __MatrixMan__ 4y ago
  > as long as you've verified the person is real through some non-digital channel first (or someone you trust has) At some point though, we're going to want to see how far we can take transitive trust. I'm not sure what the case will be, but sometimes you wanna say "who's with me?" and hear more than your handful of meatspace friends.
  - brundolf 4y ago
    Yeah. I can see web-of-trust mechanisms similar to the ones Google uses to try and determine quality sites, or how Facebook used to be for friends, friends-of-friends, etc. There's some territory to explore here. But for the core, IRL connections, online communication should still mostly work as-is Interesting idea: a social network that attempts to verify that two people actually met as real humans in-person, to increase the trust you have in friends' extended trust networks
    - mr_mitm 4y ago
      Speaking of which, why doesn't Threema or Signal use the web of trust? They already have the key verification feature. Is it due to privacy concerns?
      - __MatrixMan__ 4y ago
pharmakom 4y ago
I think if you invited a random to a key signing party they might think it’s something else :)

Yes. You bring your dongle and put it in everyone’s laptops. Others put their dongles in yours. On a more serious note, I think even the author of GPG said that it was too complicated to use. It’s unfortunate, because we need e2ee auth & encryption more now than any time before.

deleted 4y ago
[deleted]
mr_mitm 4y ago
Phil Zimmermann, inventor of PGP, couldn't figure out how to make it work on his mac. https://www.vice.com/en/article/vvbw9a/even-the-inventor-of-pgp-doesnt-use-pgp https://www.vice.com/en/article/vvbw9a/even-the-inventor-of-...
- __MatrixMan__ 4y ago
  Ever played wingspan? I have been, and I'm soaking up all of this information about birds that I never thought I'd know, and having fun too. I'd like to make a board game that teaches web-of-trust hygiene in the same way. Then there can be an app that feels like playing the game, but really it's just a wrapper around PGP.
__MatrixMan__ 4y ago
Actually, it's a pen-and-paper kind of shindig: https://security.stackexchange.com/questions/126533/why-shouldnt-i-bring-a-computer-to-a-key-signing-party https://security.stackexchange.com/questions/126533/why-shou...

brundolf 4y ago

Jokes/nostalgia aside, you don't really even need fancy encryption mechanisms. All that's important is that you only use the internet to interact with trusted parties, vs treating it as a public square where you can ~generally tell whether someone is a real person. A domain name, an email address, a social media username, etc are all as trustworthy as they are right now as long as you've verified the person is real through some non-digital channel first (or someone you trust has) I think the public social internet will die (for anything other than entertainment), but the direct-communication internet will look largely the same as it does today

__MatrixMan__ 4y ago
> as long as you've verified the person is real through some non-digital channel first (or someone you trust has) At some point though, we're going to want to see how far we can take transitive trust. I'm not sure what the case will be, but sometimes you wanna say "who's with me?" and hear more than your handful of meatspace friends.
- brundolf 4y ago
  Yeah. I can see web-of-trust mechanisms similar to the ones Google uses to try and determine quality sites, or how Facebook used to be for friends, friends-of-friends, etc. There's some territory to explore here. But for the core, IRL connections, online communication should still mostly work as-is Interesting idea: a social network that attempts to verify that two people actually met as real humans in-person, to increase the trust you have in friends' extended trust networks
  - mr_mitm 4y ago
    Speaking of which, why doesn't Threema or Signal use the web of trust? They already have the key verification feature. Is it due to privacy concerns?
    - __MatrixMan__ 4y ago

pharmakom 4y ago

I think if you invited a random to a key signing party they might think it’s something else :)