There's a lot of negativity around pgp, but I actually like the fact that you see the raw ciphertext as opposed to everything happening in the background.
I also like the portability of openpgp.js its pretty versatile in my opinion.
There's a good idea in PGP, and a very bad one. The good idea --- and PGP genuinely deserves credit here --- is end-user, consumer-facing strong cryptography tools. That's now universally accepted and has been for decades. The bad idea is a tool with PGP's design, of "cryptographic jack-of-all-trades". PGP's design has aged like milk, and PGP itself is a security liability in almost every system that hosts it.
Another thing is also that email itself was not designed with encryption in mind and because it is decentralized and backwards-compatible it is hard to enforce new rules (everyone should use PGP).
But PGP is useful if both sender and receiver agree to use PGP.
I guess the code base has really become a bit messy over time with all that parsing and different crypto algorithms. But the attack surface can be significantly reduced by using sq or even better stateless sqop.
We don't need to keep elaborating or re-litigating the same discussion. The PGP idea of "one tool to rule them all" is a terrible cryptography design, and the world is better off the sooner we stop trying to make it work.
> In 2013, an article on "Zimmermann's Law" quoted Phil Zimmermann as saying "The natural flow of technology tends to move in the direction of making surveillance easier"
The biggest issue of using PGP was using PGP. You were pretty nerdy to be on the internet back then, but even then using PGP was beyond what the majority of people wanted to do. Exchanging keys was problematic. Writing text in one app, encrypting in another app, copying encrypted back to an email was just tiresome.
I'm still glad that it existed as its mere existence seems to have pushed things in the right direction as far as protecting everyone's ability to use encryption if they chose. It just never became the panacea it was envisioned to be.
There's a lot of negativity around pgp, but I actually like the fact that you see the raw ciphertext as opposed to everything happening in the background.
I also like the portability of openpgp.js its pretty versatile in my opinion.
https://openpgpjs.org/
A well-intentioned ideal from a bygone era.
Good ideas demand to be free. =3
There's a good idea in PGP, and a very bad one. The good idea --- and PGP genuinely deserves credit here --- is end-user, consumer-facing strong cryptography tools. That's now universally accepted and has been for decades. The bad idea is a tool with PGP's design, of "cryptographic jack-of-all-trades". PGP's design has aged like milk, and PGP itself is a security liability in almost every system that hosts it.
Another thing is also that email itself was not designed with encryption in mind and because it is decentralized and backwards-compatible it is hard to enforce new rules (everyone should use PGP).
But PGP is useful if both sender and receiver agree to use PGP.
>PGP itself is a security liability in almost every system that hosts it.
Elaborate
I guess the code base has really become a bit messy over time with all that parsing and different crypto algorithms. But the attack surface can be significantly reduced by using sq or even better stateless sqop.
https://gpg.fail/
https://www.latacora.com/blog/2019/07/16/the-pgp-problem
Recommendations: https://soatok.blog/2024/11/15/what-to-use-instead-of-pgp/
We don't need to keep elaborating or re-litigating the same discussion. The PGP idea of "one tool to rule them all" is a terrible cryptography design, and the world is better off the sooner we stop trying to make it work.
> In 2013, an article on "Zimmermann's Law" quoted Phil Zimmermann as saying "The natural flow of technology tends to move in the direction of making surveillance easier"
The biggest issue of using PGP was using PGP. You were pretty nerdy to be on the internet back then, but even then using PGP was beyond what the majority of people wanted to do. Exchanging keys was problematic. Writing text in one app, encrypting in another app, copying encrypted back to an email was just tiresome.
I'm still glad that it existed as its mere existence seems to have pushed things in the right direction as far as protecting everyone's ability to use encryption if they chose. It just never became the panacea it was envisioned to be.