Comment by CHY872 | Hacker News Reader

Comment by CHY872 | Hacker News Reader

Parent Full thread

Fine. End-to-end crypto requires key authentication. This means that users must have some way of authenticating a key.

For the majority of people, this is too much. People should not be expected to spend time manually checking the signatures on a key, and should likewise not be expected to get signatures for their key. They should not have to worry about key revocation. If a solution is not as easy as email is at the moment, it's not a solution.

So, the problems that need to be solved in an automated manner:

Finding a public key, verifying it to be authentic beyond all reasonable doubt, making it so that a new user can be trusted. Revoking the key if the device is compromised.

These problems are not new - they've been around since PGP was invented. Yet, there is seemingly no compelling answer to them that doesn't involve bringing your passport to a key signing party.

All of the end-to-end encryption systems I've seen either have some complicated handshake process before one can communicate with another, or are unauthenticated.

So, anyone who argues for widespread end-to-end encrypted communication must provide evidence that such a system can actually be produced in a way that is totally transparent to the user.

Google's doing well with this software - they're massively reducing the barrier to entry for PGP; I just don't see why people are complaining about their preaching of security gospel.

> Yet, there is seemingly no compelling answer to them that doesn't involve bringing your passport to a key signing party.

The only reason I trust the source of an email by its "from" address is because of the history of correspondence with that person from that address. Yes, if it is compromised, I may not realize it right away, or I may (see: phishing emails from virus/malware infestations), but by and large it works as advertised.

Same thing with usernames in forums. There's a certain cred that is eventually attached to a username over time.

If I use the same public key to represent myself in all my communication "for a while", then there's implicit trust that it's me there, for the same reasons.

Key revocation is admittedly not as simple, if I want to continue to maintain my "trust balance" somehow. What happens if I switch email addresses? "Hi guys, this is my new email address." What if I was compromised and someone else did that? (Well, how often does that happen in real life?)

Perhaps you could keep one key super secret (and offline) and sign all new day-to-day keys with it. I don't know.

What I'm saying is- Treat it like email. Forget trying to centralize who owns what key. Forget trying to exercise absolute control over trust in a given key. The key(s) I use "most of the time" is "me". If I need to revoke it, I will suffer some in the short term, but I will quickly build my cred back up by using a new one.

If it was more widespread then perhaps we could centralize SOME third-party signing. Say I could go to a bank and they could sign my key saying "this key definitely belongs to lectrick", and it would work because the bank's public key is known-trusted.

I'm afraid that fundamentally doesn't work (though at first glance it does). Email is not a forum - it's person to person. When someone emails me, I might not know anyone else who has also had a conversation with them.

In order for anyone to trust your key at all you need to make it available out of band.

This is because otherwise, your email provider could simply man-in-the-middle you (or them); and they have no way of working out.

The first time they email you, their key is already compromised. You then build up your trust for them; but you've trusted an attacker. The system is worse than useless.

This is worse than (say) TLS because TLS, you generally do not connect through a single access point. Email is far more centralised.

So, they need to get your key from outside the communication system, somehow.

Reply on news.ycombinator.com