How Dutch Police Took Over Hansa, a Top Dark Web Market

Re:How Dutch Police Took Over Hansa, a Top Dark Web Market by DINKDINK on Friday March 09, 2018 @08:55PM (#16556669)

>you probably should not do your PGP-encryption server-side

PGP-encryption server-side is meaningless, even if it was done client side, there's a MITM. Eve can replace public keys (though at the risk of exposing her MITM if people are double checking their own public keys listed on the site against their client side public keys)

>They tweaked a feature designed to automatically encrypt messages with users' PGP keys, so that it secretly logged each message's full text before encrypting it

Unless this is Wired's way of saying a MITM as described above.

[ Parent | on HN ]

Re:How Dutch Police Took Over Hansa, a Top Dark Web Market by Buge on Saturday March 10, 2018 @01:43AM (#16557435)

>PGP-encryption server-side is meaningless

It's not meaningless, it prevents past messages from being compromised by a future breach. Future messages are still compromised, but past messages are secure.

By your logic you could say that forward secrecy is meaningless. But yet security professionals recommend that you use a TLS key exchange with forward secrecy.

[ Parent | on HN ]

Re:How Dutch Police Took Over Hansa, a Top Dark Web Market by DINKDINK on Tuesday March 13, 2018 @06:02PM (#16580277)

I said: If there’s a MITM, server side PGP is meaningless. I didn’t say that server-side PGP has no security value in all domains.

[ Parent | on HN ]