Hacker News Reader

Comment by akerl_ | Hacker News Reader

I’m saying asking somebody for a public key in the example scenario is pure security theater, no matter if it’s PGP or some other scheme.

View on HN

That's only true if the key's authenticity isn't verified. If you just accept any key a person gives you, then yes, it's meaningless. But if you independently confirm the key's fingerprint through a trusted channel, it becomes a real security measure that prevents impersonation and ensures confidentiality.

The workflow as described (no verification step) is theater. But that's true for any credential exchange without identity verification, PGP or otherwise. The issue isn't PGP, it's skipping the verification step. PGP provides the tools (fingerprint verification, web of trust, key signing), but you have to actually use them.

I didn’t say the issue with this example scenario is PGP.

The scenario is theater (if you have an out of band lookup for verification, just use that. Don’t bother asking for pub keys).

Also in parallel PGP is trash.

The out-of-band verification is for initial key enrollment, not every credential exchange. You verify the fingerprint once through a trusted channel, then use that verified key indefinitely without needing the trusted channel again. That's the entire value proposition: establish trust once, communicate securely many times.

Without this, you'd need out-of-band verification for every single credential exchange, which doesn't scale.

As for "PGP is trash"... That's a different argument entirely, and you've provided zero technical justification for it. If you have specific criticisms of PGP's cryptographic primitives, key management model, or implementation security, make them.

No thanks, I think we’ve gotten all we’re going to get out of this thread.

I agree.

Reply on news.ycombinator.com