4 ms·

PGP is built in to Linux as a core service, just not the way you're describing it. The vast majority of distros (Anything DEB or RPMS based, and I'm sure other

by subway 13y ago

PGP is built in to Linux as a core service, just not the way you're describing it. The vast majority of distros (Anything DEB or RPMS based, and I'm sure others) distribute software authenticated with GPG. Gnome already makes it quite easy to utilize GPG -- support is built in to the Gnome Keyring as well as a number of build in Gnome utilities (I imagine KDE has a similar mechism in KWallet, I just haven't used KDE in over a decade). The reason you're not noticing widespread use is because OpenPGP has been made quite transparent most places it is utilized.

malandrew 13y ago
I'm talking about taking it far beyond just package managers like apt-get, pacman, rmp, etc., and beyond just software installation. I would love it if the usage of public keys got as far as allowing any browser to have access to your public key in a safe controlled manner so that it can offer your public key to any site you visit as an alternative to passwords.
- im3w1l 13y ago
  Wouldn't that lead to facerape x1000?
  - IanCal 13y ago
    Distributing your public key? No. Edit - However you can't just use your public key as a password, but they could form part of a much simpler login process.
    - kyrias 13y ago
      Which already exists.
      - IanCal 13y ago
        Yes but I've never seen it done smoothly through a browser. It's OK, but not something I'd want my Mum to have to do to log into her emails.
        malandrew 13y ago
        Exactly this. Take the github process for getting your public key for example. I as a user need to go to the github user settings (probably after getting a warning at the command line or wondering why the command line process is so disjointed) and find the tab for adding my public key. Once there, if I don't yet have a public key I need to generate one, which requires reading instructions on how to do so. Then I need to copy the .pub file (someone uninformed might not understand them fully yet and try to upload the private one by accident). This entire tango might be acceptable for you and I, but not for most people who are probably struggling on the first step and figuring out on their own what PGP is to begin with. At the end of the day, this is just a really convoluted way of doing exactly what ssh-id-copy(1) does[0]. Hardly something my mother could do. What we're suggesting is building the ssh-id-copy(1) process into the browser as a W3C spec, which would allow me to show up on a site and quickly and safely copy the public key of my choosing. It is precisely the lack of such integration with a distributed auth technology that has made centralized auth technologies like OAuth with Facebook and Twitter much more attractive than they should have even been. [0] http://linux.die.net/man/1/ssh-copy-id http://linux.die.net/man/1/ssh-copy-id

by subway 13y ago

malandrew 13y ago

I'm talking about taking it far beyond just package managers like apt-get, pacman, rmp, etc., and beyond just software installation. I would love it if the usage of public keys got as far as allowing any browser to have access to your public key in a safe controlled manner so that it can offer your public key to any site you visit as an alternative to passwords.

im3w1l 13y ago
Wouldn't that lead to facerape x1000?
- IanCal 13y ago
  Distributing your public key? No. Edit - However you can't just use your public key as a password, but they could form part of a much simpler login process.
  - kyrias 13y ago
    Which already exists.
    - IanCal 13y ago
      Yes but I've never seen it done smoothly through a browser. It's OK, but not something I'd want my Mum to have to do to log into her emails.
      - malandrew 13y ago
        Exactly this. Take the github process for getting your public key for example. I as a user need to go to the github user settings (probably after getting a warning at the command line or wondering why the command line process is so disjointed) and find the tab for adding my public key. Once there, if I don't yet have a public key I need to generate one, which requires reading instructions on how to do so. Then I need to copy the .pub file (someone uninformed might not understand them fully yet and try to upload the private one by accident). This entire tango might be acceptable for you and I, but not for most people who are probably struggling on the first step and figuring out on their own what PGP is to begin with. At the end of the day, this is just a really convoluted way of doing exactly what ssh-id-copy(1) does[0]. Hardly something my mother could do. What we're suggesting is building the ssh-id-copy(1) process into the browser as a W3C spec, which would allow me to show up on a site and quickly and safely copy the public key of my choosing. It is precisely the lack of such integration with a distributed auth technology that has made centralized auth technologies like OAuth with Facebook and Twitter much more attractive than they should have even been. [0] http://linux.die.net/man/1/ssh-copy-id http://linux.die.net/man/1/ssh-copy-id