alt Hacker NewsThere's a good idea in PGP, and a very bad one. The good idea --- and PGP genuinely deserves credit here --- is end-user, consumer-facing strong cryptography tools. That's now universally accepted and has been for decades. The bad idea is a tool with PGP's design, of "cryptographic jack-of-all-trades". PGP's design has aged like milk, and PGP itself is a security liability in almost every system that hosts it.
Replies
PGP is special to me, I was a beta user when Phil uploaded it to some Colorado BBSes, way back when. He even made time to talk to teenage me about it on the phone.
What's crazy is when it was concieved, we didn't have trusted strong cryptographic primitives. We did have DES but it wasn't trusted. We did have some of these crazy ideas that we all would have "secrets" and you might put those secrets encrypted on a disk in a vault and you'd not even want the feds to get them. Now we have all sorts of much more vetted crypto primitives, but the idea of actual secrets you'd keep in cold storage is largely dead. You're spot on that modern use cases need different APIs and tools and specialized solutions.
PGP the packet formats, PGP the tool(s), OpenPGP the specs, GnuPG the tool, GnuPG the library; or any of the other libraries? Web of Trust? All of it? None of the above?
Any time this topic comes up, here and elsewhere, I find that most discussions revolve around different understandings and misunderstandings what people mean when they say “PGP”, and rarely lead to anything beyond that. - no this is PGP no you’re wrong that is PGP and so on and on…
Another thing is also that email itself was not designed with encryption in mind and because it is decentralized and backwards-compatible it is hard to enforce new rules (everyone should use PGP).
But PGP is useful if both sender and receiver agree to use PGP.
>PGP itself is a security liability in almost every system that hosts it.
Elaborate
Can you elaborate? I know of commercial softwares that use it still where only the softer has the private key. Seems to work pretty well, but this is slightly out of my normal scope.