Comment by woodruffw
4 days ago
> But PGP is useful if both sender and receiver agree to use PGP.
Anecdotally: this works until you add a third person who responds to the thread in plain text, with everything threaded beneath. Or when you do that by accident.
Applied cryptographers will tell you to use Signal or any other E2EE chat.
Signal isn’t owned by the users and independent of third parties the way PGP/GPG is so regardless of who will or won’t suggest a substitute it’s not.
Why is “owned by the users” (whatever that means) the quality you’re testing cryptographic protocols against?
Signal's has buildable source code on the client side and all. However, the server code is closed source and the developers have made disquieting changes like uploading most users' contact lists to the server protected only by Intel SGX that is known to have vulnerabilities exploitable by a nation-scale actor.
6 replies →
XMPP + omemo