Hacker News Reader

Comment by verytrivial | Hacker News Reader

I think the title is a little inflammatory. The conclusion does not say we should stop using PGP but consider the weakness inherent in its operating model and assumptions when evaluating future replacement. I think it is fair to say that the world is still waiting for said replacement, and until that arrives, PGP still has a number of valuable properties, one of which being it exists.

View on HN

the listed examples all exist. signal is already more widely used than pgp ever was in the last 25 years.

Have you not written:

"I also do not recommend using a centralized service that keeps your keys on a smartphone. However I warmly recommend using the Signal Protocol whenever messaging is to be done. Signal can be a direct replacement for PGP someone just has to code up the whole thing (time to flesh out signal-cli)."

Can be, someone just.

signal the app exists and is much more used than already than pgp ever was. it's a different story that i don't recommend it myself, only the protocol.

Thats an impossible statement to prove. Signal is centralized with a concrete list of users. PGP is decentralized with no possible way of knowing how many use it or dont

count the keys on the keyservers, apply some multiplier, chances are that it's still less than signal users today.

> PGP is decentralized with no possible way of knowing how many use it

> ..., apply some multiplier, ...

You glossed over that like it was nothing. Let me rephrase GP: "... with no possible way of knowing the multiplier".

Obviously there exist k such that for n keys on "the keyservers" (we'll have fun enumerating those too) and s signal users, k*n > s.

according to http://keys.mayfirst.org/pks/lookup?op=stats there's currently 4594571 keys on the bulk of public keyservers. considering the rumors that facebook and others also do signal and their user base is around a rumored billion, the k that i glossed over is around 217. even if we assume that there's dark masses that never ever used a keyserver, we ignore the fact that out of those 4.5 million pgp keys most are expired, revoked or simply lost, so the active keys on the keyservers are probably much less, and thus k is also much bigger.

Reply on news.ycombinator.com