Hacker News Reader

Comment by na85 | Hacker News Reader

Blaming "1990s crypto" is, IMHO, missing the point. Until we discover attacks against the ciphers there's no reason to throw them out just due to their age.

If you're referring to GPG's shitty interface, then sure. But how much of that is "1990s crypto" and how much is due to the fact that it's one guy working by himself and barely being able to afford it, for years?

GPG with Linux-levels of support would be an entirely different beast.

edit: oh sorry, are we not allowed to disagree with Big Names™?

View on HN

>edit: oh sorry, are we not allowed to disagree with Big Names™?

Not when it comes to cryptography and HN. Moxie, Collin, and tptacek are the only 3 people that can say anything that isn't mainstream pop-crypto. Anyone that dares to disagree with them is clearly wrong and must be punished with downvotes.

I agree, and this attitude is one of the things that's holding progress in crypto back.

Should random software engineers experimenting with crypto claim that they've created a software package worthy of being used by dissidents and whistleblowers?

Absolutely not!

But should we be discouraging random software engineers from experimenting with crypto, and starting open source projects that may gain steam...and eventually, after years of use and audits, gain the standing and reputation to be used by dissidents and whistleblowers?

Again, absolutely not.

As it happens, I was just studying the CT-RSA 2015 conference agenda, I read that there is a conference talking about some form of oracles in OpenPGP and affecting several implementations. That would indicate that the RFC4880 format is fundamentally broken in theory AND practice. http://www.rsaconference.com/events/us15/agenda/sessions/176...

Well for one, he's blaming the protocols that are "90's crypto", not the cipher, but second, I think GPG does use some weak crypto as well, at least as options, and they never bothered to remove those.

Reply on news.ycombinator.com