Hacker News Reader

Comment by 878654Tom | Hacker News Reader

I've reported some bugs and one thing that I always hate is the GPG Key. It is always a huge hassle to use for some reason and for half of the time it doesn't even seem correct or the other party isn't even using it themselves anymore.

If you are an average person and you notice that changing the ID in the URL to another number gives you access to data you should not see; you aren't some elite hacker as many of the news articles try to portray you. So expecting from them to use a GPG Key while they only have their ISP provided webmail will be near impossible for them to do under half a days work.

Especially as most GPG tools are very unfriendly to use.

View on HN

>Is it weird that I expected proof to be a PGP-signed message?

>I have not used PGP for many years, because it does not run on my iPhone[.]

- Phil Zimmermann, author of PGP

https://old.reddit.com/r/IAmA/comments/x3b3gj

> If you are an average person

This isn't for the average person.

Why not? Many security issues are detected by people who just happened to do a series of actions in a way nobody expected them to do.

I clicked this "sudo" button and it changed my name in the app to "root".

Just yesterday there was a thread here, where a random user was added as admin for multiple accounts for GCP accidentally, and he couldn't talk to a human on Google to get it resolved. He was neither actively looking out for nor was not anything other than the average user. OP is correct PGP, is a hassle, and needs explicit knowledge to use it correctly. Keybase somewhat solved it then got unpopular, but thinking about it again even Keybase never went mainstream.

s/got unpopular/acquihired by Zoom and killed/

While I wouldn't call it "mainstream", Keybase got a lot of computer-literate but not IT people into PGP, which hasn't really happened before. It had a good chance to go mainstream, but I guess this ending was inevitable since it was a for-profit company after all...

I understand that the average Joe isn't going to be using pgp. But the kind of folks that go looking for a security.txt file will be able to figure it out.

Or, more likely, ignore it.

Touche

You're underestimating how many average people or below-average hackers find/stumble-upon serious vulnerabilities all the time.

>Especially as most GPG tools are very unfriendly to use.

Install FlowCrypt (or Mailvelope) and it will become the easiest thing in the world. At least, that was my experience!

Even the dependency on email is looking a little outdated — at least that's not a requirement of security.txt though.

I think email is a good standard that you can safely assume will be there for the forseeable future. Many communication platforms come and go, email staied thare from Internet's beginning to today and shows no sign of disappearing. Plus you can safely assume that a person on the Internet has at least one email account (exeptions are extremely rare, often is even your ISP that gives you an email account), the same doesn't hold true for other plarforms like Discord.

Reply on news.ycombinator.com