News for hackers. Stuff that matters.
Re:Modern Alternatives to PGP by tptacek on Saturday February 16, 2019 @11:31AM (#19179352)
I downvoted it for making the unhinged argument that a poor KDF is a feature because it encourages users to select better passwords.

I downvote lots of things. On Hacker News, we're explicitly encouraged to downvote disagreement, especially when verbalizing that disagreement will just clutter up the thread. Everyone gets downvoted. I've been downvoted all over this thread. You were just downvoted a minute ago.

The one thing we're not supposed to do is complain about downvoting. That's in the guidelines for the site.

Re:Modern Alternatives to PGP by tyingq on Saturday February 16, 2019 @11:56AM (#19179509)
"making the unhinged argument that a poor KDF is a feature because it encourages users to select better passwords."

Where does it say that? It says a better kdf would improve the security of shorter passwords. I don't see anything that suggests a poor kdf is a feature.

The kdf used for "gpg -c" also seems better than "openssh enc". And we've still not heard what the reasonable alternative is for symmetric/password file encryption is. So, I'm sticking with gpg for that use case.

Re:Modern Alternatives to PGP by tptacek on Saturday February 16, 2019 @12:08PM (#19179560)
I think you're right, and that I misread the comment. I fixed my vote. Thanks! See! The system works!