Re:Making PGP Key Management Invisible So Johnny Can Encrypt
by pdkl95 on Friday February 06, 2015 @07:26PM
(#9012484)
Yes, that is probably the most important part of making a crypto solution actually work in practice. You can't solve all of the problems at once. Trying to solve everything has been shown to have a predictable outcome: nobody uses it and we're stuck in plaintext.
By deploying a partial solution that doesn't attempt to fix all of the problems, we can at least defend against some attacks. More importantly, a partial solution is educational. It introduces the idea of managing keys and wrapping your communications in crypto, which is a new concept to a lot of people. You might consider it "training wheels" for crypto.
Later on - when more people are used to these ideas - it will be a lot easier to upgrade to other methods that defend against the rest of the attack classes. Also, there is a bonus benefit: it is probably a lot easier to deploy a proper PGP/GPG web of trust when you have an existing infrastructure of keys that could be used as another layer of verification.
By deploying a partial solution that doesn't attempt to fix all of the problems, we can at least defend against some attacks. More importantly, a partial solution is educational. It introduces the idea of managing keys and wrapping your communications in crypto, which is a new concept to a lot of people. You might consider it "training wheels" for crypto.
Later on - when more people are used to these ideas - it will be a lot easier to upgrade to other methods that defend against the rest of the attack classes. Also, there is a bonus benefit: it is probably a lot easier to deploy a proper PGP/GPG web of trust when you have an existing infrastructure of keys that could be used as another layer of verification.