[talk] How I stopped worrying, and learned to love GPG

[Charles Sprickman]

On Feb 21, 2015, at 7:47 PM, Isaac (.ike) Levy <ike at blackskyresearch.net> wrote:

> Signed PGP part
> ...
> --
> To me, this whole thing begs some very serious and important questions:
> 
> - Who really trusts GPG these days?
> As the article states, it's written by one guy.  Werner's work is
> obviously a classic- I don't want to rip on his implementation, nor do
> I want to dive into tinfoil hat bits- but it's really serious when one
> human being is the sole contributor to a tool with such relative
> security/crypto importance.
> 
> - Are there any viable PGP spec implementations in the world that are
> under more active development?  (There are literally dozens of really
> great starts- and half-implementations, I'm looking for something that
> is outright on-par with gpg, but with more active development and
> review of the codebase.)
> 
> --
> And, my last question- the *BSD world is filled with so many impacting
> cryptographers, and some of the most prolific security-minded
> programmers in the world.  Why are we all still OK with this gnu-pg
> stuff, and all this RMS-ware?

OpenSSL was an eye-opener (well, even worse, many eyes were open and
damning the code for years), and I’m sure one day GnuPG will have
some similar bugs of horror revealed and everyone will freak out and
wonder why we have only one piece of software for this task but
Linux has a dozen sound subsystems.  And so the wheel turns.

I dont have anything to contribute, but following one of the links
for one of the other projects landed me here, and it’s a great read:

http://research.microsoft.com/en-us/people/mickens/thisworldofours.pdf

I have no idea who this man is, but the writing is entertaining, so
I will share one paragraph:

"The Mossad/not-Mossad duality is just one of the truths that
security researchers try to hide from you.  The security community
employs a variety of misdirections and soothing words to obscure the
ultimate nature of reality; in this regard, they resemble used car
salesmen and Girl Scouts (whose cookie sales are merely shell
companies for the Yakuza).  When you read a security paper, there’s
often a sentence near the beginning that says 'assume that a public
key cryptosystem exists'.  The authors intend for you to read this
sentence in a breezy, carefree way, as if establishing a scalable
key infrastructure is a weekend project, akin to organizing a
walk-in closet or taming a chinchilla.  Given such a public key
infrastructure, the authors propose all kinds of entertaining,
Ferris Bueller-like things that you can do, like taking hashes of
keys, and arranging keys into fanciful tree-like structures, and
determining which users are bad so that their keys can be destroyed,
or revoked, or mixed with concrete and rendered inert.”

[Back to my words, which I’m stating in case this is all mangled]

Oh, and shall we talk about Enigmail and how it might turn normal
people off to the idea of encrypting their email?  Or about what
strange mangling some will experience when trying to read this
Mail.app/MacGPG monstrosity has stitched together because I chose to
sign this email?  Or that when some of you look up my key you’ll find
two and wonder if one is the result of some earlier NSA kidnapping
stunt?

Charles

> 
> Best,
> .ike
> 
> 
> 
> _______________________________________________
> talk mailing list
> talk at lists.nycbug.org
> http://lists.nycbug.org/mailman/listinfo/talk

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 495 bytes
Desc: Message signed with OpenPGP using GPGMail
URL: <http://lists.nycbug.org/pipermail/talk/attachments/20150221/880745c8/attachment-0001.bin>