News for hackers. Stuff that matters.

A comment on Stop Using Encrypted Email. Parent comment

Re:Stop Using Encrypted Email by AstralStorm on Thursday February 20, 2020 @03:58AM (#22373714)
You forgot about signatures, which TLS does not provide. Nor does Signal. (In a meaningful manual way.)

PGP and S/MIME do. The latter is used for all sorts of official messages for exactly that reason.

Unauthenticated encryption is rather worthless. Repudiation is a separate matter and threat model.

[ Parent | on HN ]
Re:Stop Using Encrypted Email by lvh on Thursday February 20, 2020 @08:37AM (#22374949)
Sure! Use minisign/signify, and see OpenBSD for an example of people who do this who care extremely deeply about non-repudiation.
[ Parent | on HN ]
Re:Stop Using Encrypted Email by sterlind on Thursday February 20, 2020 @04:42AM (#22373873)
fwiw keybase supports simple and easy signatures (and less verbose than PGP.) combined with an (imo) much more rational and discoverable attestation of identity, I think it's nearly ready to supplant PGP for this use case. email integration for signatures would indeed be nice.
[ Parent | on HN ]
Re:Stop Using Encrypted Email by dependenttypes on Thursday February 20, 2020 @06:34AM (#22374327)
> Unauthenticated encryption is rather worthless

How so?

Mind you, unauthenticated encryption in terms of signal does not mean that anyone can forge a message, rather that you can't prove to a 3rd party that this was a message sent by the sender rather than forged by you.

[ Parent | on HN ]