4 ms·
> It also required its users to think like engineers, which included participating in exceptionally nerdy activities like attending real-life “key-signing parti
by upofadown 3y ago
> It also required its users to think like engineers, which included participating in exceptionally nerdy activities like attending real-life “key-signing parties” to verify your identity to other users.
In fairness to PGP, Signal uses exactly the same method as PGP does for verifying identities. You need to check a ridiculously long number which represents your correspondent's identity. It's a 40 digit hex "key fingerprint" in the case of PGP and a 60 digit decimal "safety number" in the case of Signal. The difference is that Signal will cheerfully let the user have an insecure conversation before the user has verified the safety number. PGP makes it very difficult to fail in that particular way.
Signal has a separate safety number for each of your devices. So it makes it significantly harder to keep up with the user verification than with PGP which has a single key fingerprint per user.
So you could totally have a Signal identity party for exactly the same reasons as in the PGP case...
- hnarn 3y agoI think it’s pretty important to point out that Signal allows you to import this number with a QR code, so it’s not very arduous to do to verification.
- georgyo 3y agoVarious OpenPGP clients have this feature as well, such as OpenKeychain. OpenGPG, the the most commonly used implemention of OpenPGP, doesn't have QR codes because it's meant to be a cli and a library. With an open standard different clients will have different client facing features.
- anonym29 3y ago[flagged]
- burkaman 3y agoI enjoy the internet because I can interact with and learn from people with very different skillsets and experiences than me. I don't think I would enjoy it very much if it were only used by computer enthusiasts.
- unixr 3y agoThis is a terrible and very un-empathetic take. The internet would be a much more enjoyable place if we strive to make it as secure, useful, and accessible as possible to as many people as possible instead of gatekeeping it to a certain group we decide are worthy because they are capable of browsing HN with curl instead of Chrome or something like that
- mikrotikker 3y agoNo. Society joining the internet has led to the downfall of society. It should be left to the nerds.
- lobocinza 3y ago> The internet would be a much more enjoyable place if we strive to make it as secure, useful, and accessible as possible to as many people as possible instead of gatekeeping it to a certain group we decide are worthy because they are capable of browsing HN with curl instead of Chrome or something like that An ideal to aspire but many will use for things worst than porn.
- monetus 3y agoThe roads would indeed be more enjoyable as well if only mechanics were allowed to drive on them, but alas.
- anonym29 3y agoI also unironically agree with this, fwiw.
- sneak 3y ago> The difference is that Signal will cheerfully let the user have an insecure conversation before the user has verified the safety number. PGP makes it very difficult to fail in that particular way. Most people do not use "insecure" in this way. I would venture to say that your usage of "insecure" here is actually incorrect. Approximately nobody ever does this verification[1], so this distinction is critically important: Signal works out of the box, whereas PGP does not. Fun fact: it was renamed from fingerprint to safety number after studies showed non-technical users (reasonably) associate the idea of fingerprints with criminal investigations. [1]: sneak's law: users will not securely manage {=generate, back up, transmit, or, importantly, in this case, authenticate} key material
- upofadown 3y ago>Approximately nobody ever does this verification[1], so this distinction is critically important: Signal works out of the box, whereas PGP does not. Then, say, Telegram in non-secret message mode, is just as secure, in the sense that you have to trust a third party. Not clearly informing the user of this trust is dishonest. >...after studies showed non-technical users (reasonably) associate the idea of fingerprints with criminal investigations We would be interested in a reference to one of those studies. "Fingerprint" at least implies something about identity. "Safety" is more obscure. I feel that both are less than optimal here for imparting the important concept to the user. I think that "PGP number" or "Signal number" would be better. There is already preexisting culture around "Phone numbers" and identity.
- thecrash 3y ago> Then, say, Telegram in non-secret message mode, is just as secure, in the sense that you have to trust a third party. Not clearly informing the user of this trust is dishonest. The difference is that if Telegram was intercepting messages, there would never be any indication to users. If Signal did it there would be evidence on the client side, in the form of tampered safety numbers. We can worry that a user is very unlikely to notice bad safety numbers, but "very unlikely" is much different from "impossible" when it comes to mass surveillance. All it takes is a single public scandal where Signal provably tampered with safety numbers for the whole service to be thrown into question. Not to mention the dramatic surge in user interest in "safety numbers" that would result from such attacks being detected in the wild.
- deleted 3y ago[deleted]
- pcl 3y agoFor most of my conversations, authentication really isn’t an important consideration. If someone snoops the random pics and texts I send back and forth with my friends, so be it. But it’s awfully nice to use the same app for different communications too, where authentication is important. Signal has done a fantastic job of nailing that balance, and I appreciate that.
- doublepg23 3y agoWhen I was actively using signal I tried key signing with people I knew but even the technical folks wiped their key within months.