It looks like Signal isn't as open source as you thought it was anymore

Re:It looks like Signal isn't as open source as you thought ... by FourthProtocol on Wednesday April 07, 2021 @12:29PM (#26727206)

He means that key exchange is frought with trust issues online. An exchange in meat-space is (can be!) 100% reliable, but doesn't scale. PGP is a posterchild for the impracticality of public key crypto.

The UK actually made it work in conjunction with identity federation through the Government Gateway, but then the Government Digital Service got hold of it and destroyed any chances of moving it forward.

Having seen it work I believe PKI can be practical at scale. And this is why I'd hoped a chat app might break some ground here.

[ Parent | on HN ]

Re:It looks like Signal isn't as open source as you thought ... by IncRnd on Thursday April 08, 2021 @06:00PM (#26744362)

> Having seen it work I believe PKI can be practical at scale. And this is why I'd hoped a chat app might break some ground here.

If you believe that this webpage was delivered securely to your computer, then PKI might be practical. Of course, there are a few implementation details with that PKI.

[ Parent | on HN ]

Re:It looks like Signal isn't as open source as you thought ... by tptacek on Wednesday April 07, 2021 @01:13PM (#26727785)

No, this is not at all what I mean.

[ Parent | on HN ]

Re:It looks like Signal isn't as open source as you thought ... by FourthProtocol on Wednesday April 07, 2021 @01:25PM (#26727949)

Then pray tell good sir.

[ Parent | on HN ]

Re:It looks like Signal isn't as open source as you thought ... by tptacek on Wednesday April 07, 2021 @01:45PM (#26728242)

Metadata problems in messaging systems are about what data about the communication leaks.

[ Parent | on HN ]

Re:It looks like Signal isn't as open source as you thought ... by FourthProtocol on Wednesday April 07, 2021 @03:35PM (#26729970)

Sorry, I suspect I'm missing something obvious. You specifically said PGP, which is an encryption program that provides cryptographic privacy and authentication for data communication.

And above you're saying it's about meta data problems in messaging systems. What is PGP's bad meta data story you were referring to?

[ Parent | on HN ]

Re:It looks like Signal isn't as open source as you thought ... by akerl_ on Wednesday April 07, 2021 @07:59PM (#26733221)

A quick entry point might be found here: https://crypto.stackexchange.com/questions/42247/are-the-met...

Essentially, for most PGP workflows, PGP encrypts the body of the message but the entirety of the metadata (things like sender, recipient, subject line, basically anything you’d think of as “metadata”) are fully unencrypted.

[ Parent | on HN ]

Re:It looks like Signal isn't as open source as you thought ... by FourthProtocol on Monday April 12, 2021 @03:10PM (#26783732)

This is not a problem with PGP. This is a problem with an application of PGP.

[ Parent | on HN ]

Re:It looks like Signal isn't as open source as you thought ... by tptacek on Wednesday April 07, 2021 @03:45PM (#26730095)

We're into the weeds here on this thread but the search bar below will avail.

[ Parent | on HN ]