4 ms·

PGP/GPG needs to die. It's too clunky, and that means it does not work the way people need it to work.

by 1970-01-01 3y ago

dpifke 3y ago
Do you mean PGP/GPG the program(s)? PGP/GPG the file format (RFC 4880)? Or PGP/GPG's "web of trust" key distribution scheme (which may or may not include public keyservers)? Regarding the three complaints: 1. If you hate GnuPG the program, there are several other implementations which are less "clunky." Have you tried them? Do they also need to die? 2. RFC 4880 was published in 2007. The state of the art of cryptography has advanced since then, much as the state of the art of email has advanced since RFC 822 was published in 1982. And just as RFC 822 has been updated over the years, there's an in-progress effort to update RFC 4880: https://datatracker.ietf.org/wg/openpgp/about/ https://datatracker.ietf.org/wg/openpgp/about/ Are you also calling for that working group to "die"? 3. Some poor implementation choices for the public keyservers made them unusable for a time. There's definitely room for something better—Keybase was great but understandably wasn't sustainable as a VC-funded company. I hardly think we need to throw GnuPG and RFC 4880 away because of particular keyserver implementation details. Nor do I think the keyserver failures mean the entire idea of "web of trust" is doomed. IMO, most of the calls I've heard for PGP to "die" have conflated these issues, and proposed partial solutions which solve e.g. confusing gpg command-line flags, but don't address e.g. key distribution at all. It feels like when people say, "Gmail sucks, therefore email needs to die."
eimrine 3y ago
Then how do you encrypt your emails?
- PenguinCoder 3y ago
  S/MIME.
- nness 3y ago
  I don't think I know a single person or organisation who does... (and likely, that's a problem in itself)
  - mikecoles 3y ago
    Stat of a single person. I found a personal blog with a typo in the commands for one of the tutorials on the site. I found the blog owner's email and it had a pgp key on the keyservers. We chatted, securely, without ever having met before. It was quite a pleasant experience.
  - spapas82 3y ago
    Actually in our organisation we use a custom open source solution built on top of pgp to transmit sensitive data across directorates. It works great. It's this one https://github.com/spapas/etsd https://github.com/spapas/etsd for anybody interested
  - eimrine 3y ago
    > organisation Everything related to megacorps is totally encrypted from you, starting from Intel ME and ending with going to a great length to take off a root rights from you on your "smart" phone. Only megacorp's useds do not appreciate privacy.
  - tinix 3y ago
    we have large healthcare networks as customers, some send provider data to our company in a pgp envelope.
- 1970-01-01 3y ago
  That's been discussed: https://news.ycombinator.com/item?id=19173326 https://news.ycombinator.com/item?id=19173326

PGP/GPG needs to die. It's too clunky, and that means it does not work the way people need it to work.

Do you mean PGP/GPG the program(s)? PGP/GPG the file format (RFC 4880)? Or PGP/GPG's "web of trust" key distribution scheme (which may or may not include public keyservers)? Regarding the three complaints: 1. If you hate GnuPG the program, there are several other implementations which are less "clunky." Have you tried them? Do they also need to die? 2. RFC 4880 was published in 2007. The state of the art of cryptography has advanced since then, much as the state of the art of email has advanced since RFC 822 was published in 1982. And just as RFC 822 has been updated over the years, there's an in-progress effort to update RFC 4880: https://datatracker.ietf.org/wg/openpgp/about/ https://datatracker.ietf.org/wg/openpgp/about/ Are you also calling for that working group to "die"? 3. Some poor implementation choices for the public keyservers made them unusable for a time. There's definitely room for something better—Keybase was great but understandably wasn't sustainable as a VC-funded company. I hardly think we need to throw GnuPG and RFC 4880 away because of particular keyserver implementation details. Nor do I think the keyserver failures mean the entire idea of "web of trust" is doomed. IMO, most of the calls I've heard for PGP to "die" have conflated these issues, and proposed partial solutions which solve e.g. confusing gpg command-line flags, but don't address e.g. key distribution at all. It feels like when people say, "Gmail sucks, therefore email needs to die."

eimrine 3y ago

Then how do you encrypt your emails?

PenguinCoder 3y ago
S/MIME.
nness 3y ago
I don't think I know a single person or organisation who does... (and likely, that's a problem in itself)
- mikecoles 3y ago
  Stat of a single person. I found a personal blog with a typo in the commands for one of the tutorials on the site. I found the blog owner's email and it had a pgp key on the keyservers. We chatted, securely, without ever having met before. It was quite a pleasant experience.
- spapas82 3y ago
  Actually in our organisation we use a custom open source solution built on top of pgp to transmit sensitive data across directorates. It works great. It's this one https://github.com/spapas/etsd https://github.com/spapas/etsd for anybody interested
- eimrine 3y ago
  > organisation Everything related to megacorps is totally encrypted from you, starting from Intel ME and ending with going to a great length to take off a root rights from you on your "smart" phone. Only megacorp's useds do not appreciate privacy.
- tinix 3y ago
  we have large healthcare networks as customers, some send provider data to our company in a pgp envelope.
1970-01-01 3y ago
That's been discussed: https://news.ycombinator.com/item?id=19173326 https://news.ycombinator.com/item?id=19173326