Hacker News Reader

Comment by CydeWeys | Hacker News Reader

> If you have information or tips, you can contact this reporter over an encrypted chat service such as Telegram, Signal, or WhatsApp, at 310-617-1302. You can also send an encrypted email to will.alden@buzzfeed.com, using the PGP key found here.

This is the best "contact me if you have juicy insider info" slug that I have ever seen. He can take PGP-encrypted email!

And this is on Buzzfeed!!!

View on HN

Buzzfeed's long-form journalism is pretty good/interesting/relevant, you just have to hold your nose long enough to get past the foul stench of click-bait.

The tennis racket article is very good. https://www.buzzfeed.com/heidiblake/the-tennis-racket?utm_te...

They seem to be putting quite a lot of effort into producing actual journalism lately, and I agree it's good (I also enjoyed the tennis piece mentioned).

Well that or use HN to curate for you, the extremely rare well written pieces are not worth frequenting Buzzfeed, Techcrunch etc for

That's how the economics of journalism has always worked. Going after people with a lot of money at stake will never, ever pay the bills and is a great way to rack up a lot of legal fees. So in the old days you surrounded the real news with classifieds, comic strips and movie listings, and these days you surround it with cute animal videos.

If I had to make a choice to contact the author, I would go for Signal. You can make a lot less cryptographic mistakes by using it, and it doesn't backup all the conversations to Google Drive like WhatsApp or store them in the cloud like Telegram.

Even Gawker writers take PGP-encrypted email these days.

Could a publicly traded newspaper company legally allow its employees to use end-to-end encryption? I would guess not, given the email retention requirements in Sarbanes-Oxley.

Some companies even block webmail providers to ensure only the centrally-archived corporate mail server can be used for company business.

Remember that emails can be encrypted to N recipients. So long as one of the recipients is a public key corresponding to the legal team at your company, it should be fine, as they can decrypt and read anything they would need to. They would also keep their private key in high security offline storage. You'd just need to configure your PGP mail plugins to always also include the legal team's key as a recipient.

the big problem that stuck out for me is that it is an unsigned pgp key hosted on another site. Which means someone could easily replace the key with something else and man in the middle the communication. At least have a couple trust worthy public sources sign your key if you going to asking people to communicate with you about very sensitive information

Reply on news.ycombinator.com