Hacker News Reader

Comment by thriftwy | Hacker News Reader

In Russia you can get a key-certificate pair (x509, perhaps with GOST algorithms) signed by government CA and then sign documents with it.

How different this OpenPGP key stuff is, minus the "OpenPGP is so bad we decided to sunset it" vibe?

View on HN

The jab at OpenPGP feels unnecessary when your yardstick is an FSB signature using a GOST.

The problem with OpenPGP has nothing to do with security, ciphers, etc - it's tooling.

Isn't it just "the problem is hard enough that tooling have to be complicated" ?

I don't believe that in 20+ years "nobody found a good UI/UX designers for it"

It’s both: OpenPGP’s mandatory primitives are not great. There are extension RFCs for more modern primitives, but they aren’t mandatory.

The OpenPGP stuff in Germany is not officially required to be accepted as a paper signature replacement anywhere. They are just doing this as an advertisement for the eID/ePA electronic RFID passport functionality that nobody wants.

OpenPGP is pretty good, I don't get why it gets criticism to be honest. It even has support for quantum resistant cryptography now if I recall correctly. It's also pretty easy to use. OpenKeyChain for Android works great. So does Kleopatra on Linux. Even thunderbird has support for it

I recently came along this post [0], which pretty much killed PGP for me. I certainly cannot follow all technical detail in the post, but I do see that cryptography has moved on and now offers e.g. forward secrecy.

[0] https://latacora.micro.blog/2019/07/16/the-pgp-problem.html

I should add that some of the risks mentioned in that post can be mitigated by proper user behavior (use a sufficient key length, limit the lifetime of your key). But then PGP is sufficiently complex and error prone (in using it and apparently in its technical complexity), that I don’t believe that it scales to everyone and their grandma using it.

I found the "The PGP Problem" fairly misleading:

* https://articles.59.ca/doku.php?id=pgpfan:tpp

Who would want to immediately destroy their access to their received emails in the name of forward secrecy?

Reply on news.ycombinator.com