News for hackers. Stuff that matters.

A comment on Modern Alternatives to PGP. Parent comment

Re:Modern Alternatives to PGP by blattimwind on Friday February 15, 2019 @05:04PM (#19175137)
I have PGP keys on the keyservers but don't actively look random people up and send encrypted mail on first contact (perhaps something that can be automated). I'm surprised how often the reply I receive when contacting some German (.de) open source person is PGP encrypted.
[ Parent | on HN ]
Re:Modern Alternatives to PGP by fefe23 on Saturday February 16, 2019 @06:26AM (#19178168)
Please sign your outgoing mails if you have a key.

Of the PGP mails I get, most are just encrypted to me. That is cryptographically not a sound idea, but it also means that I cannot encrypt back, because I don't know which key to encrypt to.

The keyservers do not validate anything. They are just a storage medium. In fact, for my personal e-mail address, a prankster has uploaded a rogue key. There is no process by which I can ask for its removal. People who just take the key from the keyserver have a 50% chance to send me data I cannot decrypt.

This is not a PGP weakness. It has been quipped that cryptography is a method to reduce a generic problem to a key exchange problem. There is some truth to that.

[ Parent | on HN ]
Re:Modern Alternatives to PGP by Squithrilve on Saturday February 16, 2019 @07:15AM (#19178268)
> Please sign your outgoing mails if you have a key.

It's interesting that even Edward Snowden made this mistake of sending only encrypted email.

For more elaboration about this subject K-9 resources are quite good:

https://k9mail.github.io/2017/01/30/OpenPGP-Considerations-P...

[ Parent | on HN ]
Re:Modern Alternatives to PGP by dgrove on Friday February 15, 2019 @05:07PM (#19175167)
> perhaps something that can be automated

This is solved using WKD. Thunderbird already supports this with enigmail enabled

[ Parent | on HN ]
Re:Modern Alternatives to PGP by Boulth on Saturday February 16, 2019 @03:56AM (#19177813)
Yes, WKD works well for people in control of their own domain (e.g. kernel.org uses it).

For other people there is also https://autocrypt.org/

[ Parent | on HN ]