News for hackers. Stuff that matters.
Re:Rpgp: Pure Rust implementation of OpenPGP by 01HNNWZ0MV43FF on Monday April 08, 2024 @08:34AM (#39969039)
It's hard to prove the whole chain of possibly-tampered hardware and proprietary software hasn't gotten any malicious update to steal private keys at any point
Re:Rpgp: Pure Rust implementation of OpenPGP by woodruffw on Monday April 08, 2024 @09:23AM (#39969479)
If your threat actor is omnipotent, you’re going to have a very hard time designing a coherent threat model against them. Neither Signal nor PGP nor hiding under the bedsheets will protect you from an adversary capable of directly recording your screen.

(But note: absent something like that, it in fact is possible for Signal to prove that you’re communicating with the same identity you initiated with. That’s the whole point of authenticated key agreement, which is not something that PGP can natively perform.)

Re:Rpgp: Pure Rust implementation of OpenPGP by 01HNNWZ0MV43FF on Tuesday April 09, 2024 @07:44AM (#39978417)
"communicating with the same identity you initiated with."

Is that not tofu, which is easy in many crypto systems?