3 ms·
I think what I’ve gathered is that the person I replied to is going with a TOFU model of key security (trust on first use), or is just seeking to avoid plaintex
by Vegenoid 11mo ago
I think what I’ve gathered is that the person I replied to is going with a TOFU model of key security (trust on first use), or is just seeking to avoid plaintext passwords in slack messages and is treating the key as disposable for the one-time encryption of the password.
Presumably they must trust that the user messaging them on slack is indeed who they say they are and is in control of the account.
If I’ve understood correctly, this seems like one of those cases where PGP is adding quite little security to the system, and may be preventing the implementation of more secure systems if it is providing a false sense of security.
But it’s probably just someone doing their best in a system beyond their control.
- johnisgood 11mo agoLike I have said in another comment, the question of identity verification makes no sense in this context. The identity verification problem is orthogonal to the encryption scheme. See: https://news.ycombinator.com/item?id=45919561 https://news.ycombinator.com/item?id=45919561
- tptacek 11mo agoThat is an extremely weird argument. They aren't separable concerns. If you have a trusted identity in place you could use a password-protected AES ZIP file for all the encryption matters.
- johnisgood 11mo agoThere are too many threads, see: https://news.ycombinator.com/item?id=45919651 https://news.ycombinator.com/item?id=45919651. I don't see why we got here from PGP though. > I think I'm missing something, how does asking for their public key improve security or verify their identity? OK, so this was the question. My response should have been "it does not necessarily verify their identity". I mentioned some of the mechanisms for identity verification in the other thread.