Sign arbitrary data with your SSH keys

Re:Sign arbitrary data with your SSH keys by ak217 on Saturday November 13, 2021 @11:54AM (#29211180)

So many people in this discussion talking about how this isn't a true alternative to PGP while ignoring the fact that gnupg and all other PGP software are a giant usability trainwreck.

The PGP web of trust is as good as dead, and denialism around the usability issues in gnupg is mostly to blame. If we want people to use a decentralized web of trust solution going forward, it's time to accept the fact that we'll need a new set of clients and usability/accessibility standards.

[ Parent | on HN ]

Re:Sign arbitrary data with your SSH keys by upofadown on Saturday November 13, 2021 @12:04PM (#29211291)

>The PGP web of trust is as good as dead, ...

I don't think the thing you are referring to ever actually existed. Just like in real life you would trust someone just because someone you trusted trusted them. This is a common strawman and does not represent some sort of weakness in the relatively straightforward certifications provided by stuff that supports OpenPGP.

[ Parent | on HN ]

Re:Sign arbitrary data with your SSH keys by Gargyle on Saturday November 13, 2021 @12:05PM (#29211302)

Cryptographic Trust /= Trust in persons motives.

I guess we need better words.

[ Parent | on HN ]

Re:Sign arbitrary data with your SSH keys by ak217 on Saturday November 13, 2021 @01:01PM (#29211763)

Of course I would trust someone if someone I trusted trusted them - subject to some obvious limitations. That is the essence of a social network. A cryptographic representation of that network is a profoundly powerful concept. But OpenPGP/gnupg are bad tools to represent it.

[ Parent | on HN ]

Re:Sign arbitrary data with your SSH keys by Gargyle on Saturday November 13, 2021 @12:01PM (#29211270)

SSH tooling does not make that any better tbh.

Things are being worked on.

Watch Sequoia.

Maybe some things regarding UX on my radar will surface in a range of <2 years.

[ Parent | on HN ]