Plan B - Who carries the torch?
Locked
12
12
Plan B - Who carries the torch?
 
|
Re: Plan B - Who carries the torch?
|
|
Re: Plan B - Who carries the torch?
|
|
Re: Plan B - Who carries the torch?
|
|
Re: Plan B - Who carries the torch?
|
|
Re: Plan B - Who carries the torch?
|
|
In reply to this post by GnuPG - User mailing list
On Tue, 5 Jan 2021 07:27, Jean-David Beyer said:
> Building a web of trust is so hopeless, from my point of view, that I > have abandonned gnupg. I have made keys for myself, obtained enigmail Virtually nobody uses the WoT. What people use are direct key signatures. That is you verify a key's owner and then sign that key. Usually not even exportable. Verification is often done by trust on first use. And that is okay for the majority of use cases. Salam-Shalom, Werner -- Die Gedanken sind frei. Ausnahmen regelt ein Bundesgesetz. _______________________________________________ Gnupg-users mailing list [hidden email] http://lists.gnupg.org/mailman/listinfo/gnupg-users |
Re: Plan B - Who carries the torch?
|
|
On Tue, 2021-01-05 at 15:38 +0100, Werner Koch via Gnupg-users wrote:
> Virtually nobody uses the WoT... Strangely, the Linux kernel folks still use it a decent amount. They're the only large group I can think of offhand, though. _______________________________________________ Gnupg-users mailing list [hidden email] http://lists.gnupg.org/mailman/listinfo/gnupg-users |
Re: Plan B - Who carries the torch?
|
|
On Tue, 5 Jan 2021 09:46, Robert J. Hansen said:
> Strangely, the Linux kernel folks still use it a decent amount. There are indeed use cases for the WoT; in particular if you don't known your co-worker. However, in commerical or private settings the communication patterns are different from the hacker community. Salam-Shalom, Werner -- Die Gedanken sind frei. Ausnahmen regelt ein Bundesgesetz. _______________________________________________ Gnupg-users mailing list [hidden email] http://lists.gnupg.org/mailman/listinfo/gnupg-users |
Re: Plan B - Who carries the torch?
|
|
Re: Plan B - Who carries the torch?
|
|
On future of GnuPG
|
|
Re: On future of GnuPG
|
|
> The landscape has changed dramatically from the times when the
> original PGP fundamentals were introduced. Today, for any secure > personal communication system to be of practical use, it must > be designed from the ground up observing the following simple > principle: *anonymity is the necessary condition of privacy*. This borders on ridiculous. One of the problems we have in privacy discussions is there is no single agreed-upon definition of privacy. Privacy is defined by culture, and unless we share a culture we're very unlikely to share a privacy definition. In the United States, the prevailing culture cares a lot more about government's ability to learn things about me without a warrant than it does about the ability of corporations or businesses. And we also believe that government limiting our ability to speak infringes on our privacy: "why the hell is the government getting in my business if all I'm doing is sharing true things with my buddy?" Whereas in Europe, right-to-be-forgotten laws, enforced by the government, are seen as wins for privacy, in America they would be (a) blatantly unlawful and (b) considered massive invasions of our privacy by the government. In Europe it's a lot different. There, the prevailing culture cares a lot more about limiting the ability of businesses to learn things about a person than with limiting the ability of governments. The national security exemption in the GDPR is big enough to drive a truck through: it is so all-encompassing that I, as an American, look at the GDPR and think it's a nightmare for privacy rights. And, you know, *this is okay*. Privacy is culturally defined. Enjoy your culture, accept or reject its definition of privacy as you like. Just don't think that your culture's definition is somehow the only one, or universally agreed-upon, or... If there is no agreed-upon universal definition of privacy (and there isn't), then any attempt to make sweeping statements like "anonymity is a necessary condition of privacy" is just a bunch of freshman Philosophy 101 crap that's entirely disconnected from the real world. _______________________________________________ Gnupg-users mailing list [hidden email] http://lists.gnupg.org/mailman/listinfo/gnupg-users |
Re: On future of GnuPG
|
|
Re: On future of GnuPG
|
|
Re: On future of GnuPG
|
|
In reply to this post by markus.rosco
12021/00/04 08:01.47 ನಲ್ಲಿ, [hidden email] ಬರೆದರು:
> > On 2021-01-05 Stefan Claas via Gnupg-users - [hidden email] wrote: > > ... but why are then SKS key servers > > still in operation, which allows third parties to look up who signed > > who's key and with what trust level and GnuPG's WoT support, compared > > to sq and Hagrid? > > The landscape has changed dramatically from the times when the > original PGP fundamentals were introduced. Today, for any secure > personal communication system to be of practical use, it must > be designed from the ground up observing the following simple > principle: *anonymity is the necessary condition of privacy*. In many ways, security and anonymity are at odds, since if I can't easily verify that <x> is the person they claim to be, I have no way of knowing if I'm telling them stuff they shouldn't know. While there are ways to ensure confidentiality and integrity of the *communication channel* while preserving anonymity, there isn't really a way of ensuring the integrity of the *conversation* while preserving anonymity. Pretty much any way of properly resolving this dilemma requires de-anonymizing both participants, and then we're right back where we started. If, instead, we acknowledge that most use cases require integrity of the communication channel *and* the conversation, then we can use common identifiers (like phone numbers) or (mostly) verifiable identities (like GPG keys hosted on WKD) to ensure the integrity of the conversation (I say mostly verifiable because there's always a chance the domain is compromised and the keys are replaced). Once anonymity isn't really as much of a concern, we get things like Signal, which is decidedly *not* anonymous (with the exception of using VOIP numbers to sign up) but is most assuredly private (they don't know what you're saying and neither does anyone else, apart from the people you're messaging). Regards, Chiraag -- ಚಿರಾಗ್ ನಟರಾಜ್ Pronouns: he/him/his _______________________________________________ Gnupg-users mailing list [hidden email] http://lists.gnupg.org/mailman/listinfo/gnupg-users  publickey - mailinglist@chiraag.me - b0c8d720.asc (902 bytes) Download Attachment signature.asc (242 bytes) Download Attachment |
Re: On future of GnuPG
|
|
Re: Plan B - Who carries the torch?
|
|
In reply to this post by GnuPG - User mailing list
On Tue, 5 Jan 2021 16:46, Stefan Claas said:
> Not sure I understand you correctly, but why are then SKS key servers > still in operation, which allows third parties to look up who signed > who's key and with what trust level and GnuPG's WoT support, compared Because that is the base of the WoT and there a legitimate use cases for this. You might also want to learn on how the WoT works to see why the keyservers don't carry any information on what you call "trust level" and what we call "ownertrust". Just in case you meant the signature class (0x10..0x13 aka generic,persona,casual,positive) the default is "generic" and you need to employ the --ask-cert-level option to change the default on a key by key case. Further, the plan is to replace the SKS software by hockeypuck on the servers. Thus the existing defaults are still good defaults. Salam-Shalom, Werner -- Die Gedanken sind frei. Ausnahmen regelt ein Bundesgesetz. _______________________________________________ Gnupg-users mailing list [hidden email] http://lists.gnupg.org/mailman/listinfo/gnupg-users |
Re: On future of GnuPG
|
|
In reply to this post by GnuPG - User mailing list
On Tue, 5 Jan 2021 17:07, Robert J. Hansen said:
> I'm doing is sharing true things with my buddy?" Whereas in Europe, > right-to-be-forgotten laws, enforced by the government, are seen as > wins for privacy, in America they would be (a) blatantly unlawful and I don't think that the right not to be listed prominently in search results is related to privacy. This ruling is more similar to rules that you are not required to wear a badge that you spent some time in jail or need to state this in your CV. > In Europe it's a lot different. There, the prevailing culture cares a > lot more about limiting the ability of businesses to learn things about > a person than with limiting the ability of governments. The national Like all over the world governments work on terminating all rules which limit their power. It seems to be a never-ending task to counter that. Speaking of Germany: There are a lot of barriers between administrative entities to share data - there is not even a central database of all citizens. There is no shared access between the databases of the police and the spooks. The spooks tried to tell us that it is okay to eavesdrop as long as no German citizen is part of the communication but courts declared such a workaround as illegal. But yes, all these laws and rulings wind up faster and faster :-( Shalom-Salam, Werner -- Die Gedanken sind frei. Ausnahmen regelt ein Bundesgesetz. _______________________________________________ Gnupg-users mailing list [hidden email] http://lists.gnupg.org/mailman/listinfo/gnupg-users |
Re: Plan B - Who carries the torch?
|
|
Re: On future of GnuPG
|
|
| Free forum by Nabble | Edit this page |