Comment by rasengan | Hacker News Reader

Comment by rasengan | Hacker News Reader

Parent Full thread

I think it depends on the type of communication being made, when, why, etc.

For example, if someone wants to send you an anonymous message, they could just reply right here to this thread with some blob of PGP encrypted text, anonymously. Plausible deniability would exist and, as well, metadata could easily be obfuscated. Here's an example, but I'm not going to make a throwaway.

-----BEGIN PGP MESSAGE----- Comment: GPG

hQIMA9gXRUOEWVQSAQ/9FppY6pK4P6xErZw9/M9UXtrUmRhKIWzorfXctiji0e8z f/Qgx6sxlIHT5HHKvdhagMVcPL7GqdYUSlfNmiyXBq3jPvkYPzzFfxGeIRSefBQP pHqo0vsMz9lZ572rtx2iIfBkPd0WDbzKEABID2REetJSaFUARoAKsiOaNUhIfoqd rOnytETv63WBYVBdTimNgtkhTWtT9LVobrKv9EfTLfbErVgONWmuo3mXXRbeOswG 50nqT7LQrV/nnzKj0Eq5nVjaIHiTo9EXwQgs3MGl8ZFAV45MWJ+7Sw9sbD/MpXhv i/za17Z+MOsmZs0ja3iXq/8N+xKCqYJv2bMh9EzTZ6mOOwVDIUDi59+S7pA5QzJx xGTwppJ9XDajdsvg91H+DCWgc8/Ln7/5FeC4F2QMhnjrF7KiR9qsux1mZfQbRFIs T5krRzMOvbHgb3/br/wdxbWgIKYpVFJiUmIO502R0cWw3X6ni6zz9yybfHlzUCm3 FBDbi5NNY7tcs+gehtRcwhrjfDHoxRZ17oOnexmD9fYvQA5FWvt4UVG9TBwEawnh BvBxhkuAgcMue2FgsiYlcWQ214FoXFuJSPlG8d01VcDmPLG5kXbNftwlS61dl6yW dyk5yGZw9uR0BKpCuvDk7f8uURDj8p7t69+u2M08FPYyaNImtBtJV96ZWI1gjV3S NwFPb/UKnqc/xQc6asORi5r7Mp/0PDFuasoInR8pp5rmIYHaJYzTQfdNxuL3aD5w EAxDPMn+bCI= =3DBv -----END PGP MESSAGE-----

I was mildly disappointed that this doesn't appear to be encrypted to my key, since I have Keybase in my profile ;)

The general shape of the argument against this, is you can use age, and avoid the many well-documented problems with the OpenPGP standard.

More people have PGP keys, naturally, but that's a bit of a chicken-and-egg problem. By the time you're messing with cloak-and-dagger stuff like dead drops on public message boards, taking the extra effort to set up to use a better cryptosystem strikes me as relatively minor.

Ah! I did encrypt it for: rsa4096/D817454384595412 2019-12-24

The formatting was messed up but it should be fixed now!

clears throat

the difficulties here are illustrating some point about the perils of GPG, let's put it that way!

rsa4096/0355E91DFA3EFAB3 2019-12-24, that's me

lord knows how you have the right creation date with the wrong fingerprint... perhaps we can agree that we shouldn't be trusting our lives and freedom to this piece of software.

The fingerprint is:

Primary key fingerprint: A92D 5A61 7818 99B0 401F D8AC 0355 E91D FA3E FAB3

Which matches yours...

Again, it really depends on the situation. I wouldn't trust sending an anonymous message through Signal for example as it is tied to a phone number, whereas, I'd happily post through a VPN an anonymous message somewhere on HN that would go unseen other than to the recipient who would be directed to it at a later date across a different medium for example.

Reply on news.ycombinator.com