News for hackers. Stuff that matters.
Re:PGP needs to be retired in honor by verytrivial on Thursday February 23, 2017 @01:52PM (#13716594)
I think the title is a little inflammatory. The conclusion does not say we should stop using PGP but consider the weakness inherent in its operating model and assumptions when evaluating future replacement. I think it is fair to say that the world is still waiting for said replacement, and until that arrives, PGP still has a number of valuable properties, one of which being it exists.
Re:PGP needs to be retired in honor by mstef on Thursday February 23, 2017 @02:03PM (#13716691)
the listed examples all exist. signal is already more widely used than pgp ever was in the last 25 years.
Re:PGP needs to be retired in honor by datatan on Thursday February 23, 2017 @03:28PM (#13717436)
Thats an impossible statement to prove. Signal is centralized with a concrete list of users. PGP is decentralized with no possible way of knowing how many use it or dont
Re:PGP needs to be retired in honor by mstef on Thursday February 23, 2017 @03:41PM (#13717565)
count the keys on the keyservers, apply some multiplier, chances are that it's still less than signal users today.
Re:PGP needs to be retired in honor by OJFord on Thursday February 23, 2017 @07:31PM (#13719509)
> PGP is decentralized with no possible way of knowing how many use it

> ..., apply some multiplier, ...

You glossed over that like it was nothing. Let me rephrase GP: "... with no possible way of knowing the multiplier".

Obviously there exist k such that for n keys on "the keyservers" (we'll have fun enumerating those too) and s signal users, k*n > s.

Re:PGP needs to be retired in honor by mstef on Friday February 24, 2017 @02:01PM (#13726574)
according to http://keys.mayfirst.org/pks/lookup?op=stats there's currently 4594571 keys on the bulk of public keyservers. considering the rumors that facebook and others also do signal and their user base is around a rumored billion, the k that i glossed over is around 217. even if we assume that there's dark masses that never ever used a keyserver, we ignore the fact that out of those 4.5 million pgp keys most are expired, revoked or simply lost, so the active keys on the keyservers are probably much less, and thus k is also much bigger.
Re:PGP needs to be retired in honor by acqq on Thursday February 23, 2017 @02:22PM (#13716866)
Have you not written:

"I also do not recommend using a centralized service that keeps your keys on a smartphone. However I warmly recommend using the Signal Protocol whenever messaging is to be done. Signal can be a direct replacement for PGP someone just has to code up the whole thing (time to flesh out signal-cli)."

Can be, someone just.

Re:PGP needs to be retired in honor by mstef on Thursday February 23, 2017 @02:40PM (#13717022)
signal the app exists and is much more used than already than pgp ever was. it's a different story that i don't recommend it myself, only the protocol.