3 ms·
GPG for chat (at least XEP-0027) is much, much less secure than OTR. You have no authentication of received messages, no defense against replay attacks or dropp
by xnyhps 13y ago
GPG for chat (at least XEP-0027) is much, much less secure than OTR. You have no authentication of received messages, no defense against replay attacks or dropped messages, no perfect forward secrecy. In my opinion, support for it should be removed because it endangers people who think it is secure.
I would like to see an automatic way to use GPG to sign OTR keys, though. You can create a message "My OTR fingerprint is abcdef..." and sign that, but it would be nice if clients did that automatically. Or maybe even use the GPG key itself instead of the OTR key...
- mike-cardwell 13y agoI publish my OTR public key fingerprint on the front page of my website, which is it's self signed using my private PGP key. On that same page, I provide links to DDG searches of my fingerprints so people can see the multitude of places that it has been indexed. It gets indexed in a lot of places because I am active on several public mailing lists and the fingerprint is included in the signature of all my emails. All of my emails are signed using the same PGP key as the front page of my website. https://grepular.com/ https://grepular.com/ EDIT: I just remembered, my HN profile also contains my OTR fingerprint, and is signed using my PGP key.