3 ms·
That's an odd* implementation decision. Gpg is well established and eminently applicable here. Both the camera hardware as well as the photo journalist could s
by mceachen 3y ago
That's an odd* implementation decision.
Gpg is well established and eminently applicable here. Both the camera hardware as well as the photo journalist could sign the image data payload, and embed the signature in metadata, especially if the camera hardware accepted new keys. Trust chains could be established both via their publisher and the camera manufacturer.
But let's be real: no one will bother to validate anything.
* I'm being diplomatic
- woodruffw 3y agoGPG is “well-established” in the sense that it’s old; it’s not considered a modern or well-designed digital signing (or encryption, or trust distribution, etc.) scheme. I think there are significant issues with establishing the “authenticity” of digital artifacts in any scheme, but GPG would probably make things worse rather than better here.
- b0afc375b5 3y agoWhat are the modern / well-designed alternatives?
- computerfriend 3y agoThe GPG hate is, in my opinion, overblown. But modern alternatives would be SSH signing, signify/minisign or cosign.
- woodruffw 3y agoThere is no “alternative” to GPG, because PGP/GPG’s problem space is poorly defined. Modern cryptographic protocol design has moved away from “Swiss Army knife” designs: protocols and formats are now designed to do one thing well, rather than a whole bunch of things poorly and with an unintuitive user interface. In other words: use TLS to communicate securely with services. Use Signal or another modern E2EE IM protocol to communicate securely with humans. For file encryption, use age. For digital signatures, use minisign or Sigstore.
- backendanon 3y agoGPG is not good now? When did that happen?
- woodruffw 3y agoIt’s been about a decade[1]. You can find older links as well, but that’s a decently old one from an authoritative source. [1]: https://blog.cryptographyengineering.com/2014/08/13/whats-matter-with-pgp/ https://blog.cryptographyengineering.com/2014/08/13/whats-ma...
- backendanon 3y agoOk. I read it, thanks. I plan to continue using GPG.
- deleted 3y ago[deleted]