3 ms·
I didn’t say the issue with this example scenario is PGP. The scenario is theater (if you have an out of band lookup for verification, just use that. Don’t bot
by akerl_ 11mo ago
I didn’t say the issue with this example scenario is PGP.
The scenario is theater (if you have an out of band lookup for verification, just use that. Don’t bother asking for pub keys).
Also in parallel PGP is trash.
- johnisgood 11mo agoThe out-of-band verification is for initial key enrollment, not every credential exchange. You verify the fingerprint once through a trusted channel, then use that verified key indefinitely without needing the trusted channel again. That's the entire value proposition: establish trust once, communicate securely many times. Without this, you'd need out-of-band verification for every single credential exchange, which doesn't scale. As for "PGP is trash"... That's a different argument entirely, and you've provided zero technical justification for it. If you have specific criticisms of PGP's cryptographic primitives, key management model, or implementation security, make them.
- akerl_ 11mo agoNo thanks, I think we’ve gotten all we’re going to get out of this thread.
- johnisgood 11mo agoI agree.