3 ms·
I've been hacking on several side projects with GPG and OpenPGP for the past few months[1][2][3], and I've come away from it fully convinced that the lack of in
by diafygi 12y ago
I've been hacking on several side projects with GPG and OpenPGP for the past few months[1][2][3], and I've come away from it fully convinced that the lack of interest in PGP is because people don't want to unofficially extend the format. The the fundamental format and specification are really extensible and could be used as the base for most crypto apps, including Keybase/OTR/TextSecure apps. However, for some reason, people are scared to unofficially extend the OpenPGP format specification to add the features they need. Maybe it's that they don't want to extend the format, maybe it's that there's no good tools to actually do that (there really aren't).
For example, there is a "User Attribute" packet you can add to a PGP public key that can contain arbitrary data. The only official format for this packet is a jpeg image, but you can specify up to 99 more types of "attributes" on your own, and parsers that don't understand them will just ignore them. So Keybase could have extended this packet for its online identity validations, but instead it created it's own centralized PKI, signature format, and command line tool. One of my next side projects is going to be trying to add my Keybase signatures for my github to my PGP public key.
Also, there's no reason why the format can't be extended to allow for Forward Secrecy. You could very easily use OpenPGP as the base format for OTR and Axolotl. One of my next side projects is going to be implementing the same OTR and Axolotl flow using OpenPGP as the base format. That way, you could use the public keyservers to start end-to-end encrypted chat sessions (AND utilize the web of trust in the process).
I love Keybase and TextSecure just as much as the next person, but it really sucks that we're having to rely on so few people to maintain the infrastructure, protocols, and formats for the next generation of crypto apps.
[1]: https://github.com/diafygi/publickeyjs https://github.com/diafygi/publickeyjs
[2]: https://github.com/diafygi/openpgp-python https://github.com/diafygi/openpgp-python
[3]: https://github.com/diafygi/keyserver-elasticsearch https://github.com/diafygi/keyserver-elasticsearch