8 ms·
There is no bootstrapping problem. Snowden was also able to get journalists to use OTR, without relying on some web interface with questionable security claims
by betterunix 13y ago
There is no bootstrapping problem. Snowden was also able to get journalists to use OTR, without relying on some web interface with questionable security claims. The problem with PGP and S/MIME is that the existing software is too hard to set up. It is hard to tell journalists to go use Thunderbird, get Enigmail set up, and publish a key. The situation is even worse with S/MIME, despite the built-in support in many email clients.
Basically, the problem is that PGP and S/MIME as they exist today are (and I shudder to say it) too security conscious. The reality is that most users are not going to take the time to maintain their public keys, to verify others' public keys, etc., nor are most users going to spend the time to get their keys verified by a CA. We need a "lite" PGP client that is less obnoxious about using untrusted keys, and basically a "newbie" PGP that is more vulnerable to active MITM attacks (which are actually much harder to pull off than one might expect). It would also be nice if public keys could be easily published via QR codes, so that someone can literally hand their public key to another person.
The worst thing we can do is lie to people about the security they receive e.g. telling them things like "Lavabit is set up so that nobody but you can read your email!"
- lifeisstillgood 13y agoqr codes for gpg public keys - sounds a great idea. Any idea why no one done it yet - seems like it could be a simple transform from an ASCII armoured output. Bookmarking reply
- XorNot 13y agoYou have to use a very large QR code to do it. It won't fit on a business card and phones are picky about scanning them.
- betterunix 13y agoSure, but we have key servers for distributing the actual keys. You would only need the fingerprint in the QR code.
- XorNot 13y agoKind of defeats the point - how do you know you're downloading the private key you scanned? While someone might have their business cards replaced, it's a lot easier just to send a different key to someone.
- lifeisstillgood 13y agoI thought a QR code could be effectively any size - I certainly remember a Japanese billboard that used shadows etc. A QR code can have ~4000 chars of a-z and ~3000 Latin1 iirc so with my limited gpg knowledge that handles my public key quite happily. would be interested on the business card front though
- betterunix 13y ago"Kind of defeats the point - how do you know you're downloading the private key you scanned?" Assuming that "private key" is a typo (you download public keys), you can just check the fingerprint of the key against the fingerprint you were given. That is easily automated.
- XorNot 13y agoThis puts us back in the same kind of problem that was being complained about though - keyservers, publishing keys etc.
- betterunix 13y agoNot really. The problem is not about publishing keys or key servers, but with the cumbersome process of having to enter a hexadecimal string (and having to check an even longer string). The point of using QR codes is to simplify things: the user just scans a QR code, and the key is fetched and assumed to be valid (i.e. no need for the user to check fingerprints).