3 ms·

I've reported some bugs and one thing that I always hate is the GPG Key. It is always a huge hassle to use for some reason and for half of the time it doesn't e

I've reported some bugs and one thing that I always hate is the GPG Key. It is always a huge hassle to use for some reason and for half of the time it doesn't even seem correct or the other party isn't even using it themselves anymore. If you are an average person and you notice that changing the ID in the URL to another number gives you access to data you should not see; you aren't some elite hacker as many of the news articles try to portray you. So expecting from them to use a GPG Key while they only have their ISP provided webmail will be near impossible for them to do under half a days work. Especially as most GPG tools are very unfriendly to use.

oneeyedpigeon 3y ago
Even the dependency on email is looking a little outdated — at least that's not a requirement of security.txt though.
- GTP 3y ago
  I think email is a good standard that you can safely assume will be there for the forseeable future. Many communication platforms come and go, email staied thare from Internet's beginning to today and shows no sign of disappearing. Plus you can safely assume that a person on the Internet has at least one email account (exeptions are extremely rare, often is even your ISP that gives you an email account), the same doesn't hold true for other plarforms like Discord.
mattpallissard 3y ago
> If you are an average person This isn't for the average person.
- 878654Tom 3y ago
  Why not? Many security issues are detected by people who just happened to do a series of actions in a way nobody expected them to do.
  - mywittyname 3y ago
    I clicked this "sudo" button and it changed my name in the app to "root".
- anaganisk 3y ago
  Just yesterday there was a thread here, where a random user was added as admin for multiple accounts for GCP accidentally, and he couldn't talk to a human on Google to get it resolved. He was neither actively looking out for nor was not anything other than the average user. OP is correct PGP, is a hassle, and needs explicit knowledge to use it correctly. Keybase somewhat solved it then got unpopular, but thinking about it again even Keybase never went mainstream.
  - franga2000 3y ago
    s/got unpopular/acquihired by Zoom and killed/ While I wouldn't call it "mainstream", Keybase got a lot of computer-literate but not IT people into PGP, which hasn't really happened before. It had a good chance to go mainstream, but I guess this ending was inevitable since it was a for-profit company after all...
  - mattpallissard 3y ago
    I understand that the average Joe isn't going to be using pgp. But the kind of folks that go looking for a security.txt file will be able to figure it out.
    - JohnFen 3y ago
      Or, more likely, ignore it.
      - mattpallissard 3y ago
        Touche
- sn_master 3y ago
  You're underestimating how many average people or below-average hackers find/stumble-upon serious vulnerabilities all the time.
Zamicol 3y ago
>Is it weird that I expected proof to be a PGP-signed message? >I have not used PGP for many years, because it does not run on my iPhone[.] - Phil Zimmermann, author of PGP https://old.reddit.com/r/IAmA/comments/x3b3gj https://old.reddit.com/r/IAmA/comments/x3b3gj
the_jesus_villa 3y ago
>Especially as most GPG tools are very unfriendly to use. Install FlowCrypt (or Mailvelope) and it will become the easiest thing in the world. At least, that was my experience!

oneeyedpigeon 3y ago

Even the dependency on email is looking a little outdated — at least that's not a requirement of security.txt though.

GTP 3y ago
I think email is a good standard that you can safely assume will be there for the forseeable future. Many communication platforms come and go, email staied thare from Internet's beginning to today and shows no sign of disappearing. Plus you can safely assume that a person on the Internet has at least one email account (exeptions are extremely rare, often is even your ISP that gives you an email account), the same doesn't hold true for other plarforms like Discord.

mattpallissard 3y ago

> If you are an average person This isn't for the average person.

878654Tom 3y ago
Why not? Many security issues are detected by people who just happened to do a series of actions in a way nobody expected them to do.
- mywittyname 3y ago
  I clicked this "sudo" button and it changed my name in the app to "root".
anaganisk 3y ago
Just yesterday there was a thread here, where a random user was added as admin for multiple accounts for GCP accidentally, and he couldn't talk to a human on Google to get it resolved. He was neither actively looking out for nor was not anything other than the average user. OP is correct PGP, is a hassle, and needs explicit knowledge to use it correctly. Keybase somewhat solved it then got unpopular, but thinking about it again even Keybase never went mainstream.
- franga2000 3y ago
  s/got unpopular/acquihired by Zoom and killed/ While I wouldn't call it "mainstream", Keybase got a lot of computer-literate but not IT people into PGP, which hasn't really happened before. It had a good chance to go mainstream, but I guess this ending was inevitable since it was a for-profit company after all...
- mattpallissard 3y ago
  I understand that the average Joe isn't going to be using pgp. But the kind of folks that go looking for a security.txt file will be able to figure it out.
  - JohnFen 3y ago
    Or, more likely, ignore it.
    - mattpallissard 3y ago
      Touche
sn_master 3y ago
You're underestimating how many average people or below-average hackers find/stumble-upon serious vulnerabilities all the time.

Zamicol 3y ago

>Is it weird that I expected proof to be a PGP-signed message? >I have not used PGP for many years, because it does not run on my iPhone[.] - Phil Zimmermann, author of PGP https://old.reddit.com/r/IAmA/comments/x3b3gj https://old.reddit.com/r/IAmA/comments/x3b3gj

the_jesus_villa 3y ago

>Especially as most GPG tools are very unfriendly to use. Install FlowCrypt (or Mailvelope) and it will become the easiest thing in the world. At least, that was my experience!