Hacker News Reader

Comment by TheLoneWolfling | Hacker News Reader

This sounds like an implementation as opposed to design flaw. Enigmail should be throwing up red flags all over the place when duplicates exist.

That being said, this is perilously close to the "No True Scotsman" fallacy.

View on HN

I'd be really, really cautious about throwing "No True Scotsman" at Seth David Schoen and Erinn Clark.

https://en.wikipedia.org/wiki/Seth_Schoen

His hopelessly out-of-date homepage: http://www.loyalty.org/~schoen/

That said, yes, PGP has a notable failing in that there's no reliable method for repudiating a key, particularly one generated by a hostile party.

If you've hung on to your key revocation certificate you can revoke a key you have generated. But that's only a small part of the battle.

I'm sorry my homepage is out of date; thanks for the reminder. It seems like it's been a decade or so since I updated it.

I normally check signatures when downloading a new key, particularly as a way of distinguishing between multiple keys available on a keyserver. But I don't have a way to force other people who are writing to me to do that, and apparently at least the Enigmail users often don't.

Edit: Erinn is a more cautious PGP user than I am (with an extraordinarily important key!), but I expect she also has no way of forcing people to check that they have the right key when e-mailing her.

I check up on you from time to time. Virtunova's been offline for ages as well.

I'm kicking around ways of making email more reliable, one option that occurs to me is key negotiation at transmit time, or as part of the delivery process. That is: a user's home mailserver would be key-aware. Though that too is subject to skulduggery.

  -----BEGIN PGP MESSAGE-----
  Version: GnuPG v1.4.11 (GNU/Linux)

  hQIMA6PfwQZKAOF/ARAAkzfxMj8XnsmBmGu3uxS6cp/0q1xE/U89sTLlVZmDbwna
  IGOXkm1h6DId7Hvwnj+RjYRj/wym3kvrMCXoOPLpqr0y2kGcBxxcW0kdK+zhlz34
  ik+Vy+HGp0MZKog6HnBiMotnDZuYJsxZhPE++XSZDj8N/16XNXmvDjuDZTlkvKUm
  UX0y8kem2uSN8WjGuQepF2zwwzL8LDjJ7x9RemDgfudkiNkSUQVDz2WNwrrXssR4
  g4cRTs0wUaRYa/xDUXvum/uHxOJ/ZF/cEKMB9oXBIw4m+1VHTzLJYz3PFwFHiib3
  SWnJ90tm2vjKsp9Q1VQYa8zyINOzDDGMbLP7OgkDU5/nvGFxLflRyvYwVoHkyKuW
  Ar/5vHxdf0F4vgJuJHJIieuQcSVv06pvFczmnbQmO9vLMBvRti++Vu2u2olyoyr9
  5cgZ+I/AvNXjPN8u3IiyT+6/bwXAT41G6nUZWs7xfqEvX5RFQA4dh/qkjuHpDUWx
  ROVzgdqvLpnsO2uZ2Y0++ETuer0aYpqSo03oOb2bNsXdlZF1SSu7dNfSzJv47J5e
  yFn5Wn4hK1TswuRYKDy3HGk0au0NSdNfDi83YR17N1xQg5heK1Daf73DWZRnxOPi
  EnDHc17Uha3nN+FIKm1JdwxA4T35eJl0pa2S9SPWmHUNWvMwCLC4JqR0Br8Yx8TS
  aQGmENhVRPMX73uPo8SDn+M6u0PvJ7pWPKn3ulcwwrMgqSf4qgptozB8g0vTr3YJ
  k40OdHO7ebcWN5wkw2dg9tIFFgxnqrpjB7vr0aHJj3Y96AYoD0uSrEiBgX6pIJdz
  jGWswAp7O5UfGw==
  =DT21
  -----END PGP MESSAGE-----

Including your key signature everywhere you post your email address (homepage, business card, email signature, etc.) is a good practice. It's not perfect, but it's better than teaching users to go straight to a keyserver.

I do have my key and/or fingerprint on my

* personal e-mail .signature

* personal home page

* work employee page

* business card

I don't have my key or fingerprint on my

* work e-mail .signature

Despite this, 12 people accepted the fake key as genuine.

No, I mean that my argument there was perilously close to said fallacy.

Hrm. Not sure I see that, but that's more acceptable ;-)

PGP is fine. People aren't using it correctly.

The point of Web of Trust is to only trust keys that other people you know have also signed. Everything else is garbage until proven otherwise.

Key servers are untrustworthy because anyone can upload random shit to them.

Trying to shift WoT to a third party is trying to get something for free that doesn't emphasize solving the problem: getting everyone you know signing keys of only other people they know.

https://www.kernel.org/signature.html#kernel-org-web-of-trus...

PGP is extremely hard to use, so no, it's not "fine". Usability is just as important as (if not more important than) cryptographical correctness!

Reply on news.ycombinator.com