Houston, we have a problem

[Andrew Gallagher]

On 26/09/17 13:49, Kristian Fiskerstrand wrote:
> 
> The users shoudn't browse keyservers at all, so it shouldn't really be
> an issue. Linking to get operation to get the public keyblock is just a
> convenience.

Users shouldn't do it. And yet they still do it, precisely because it is
a convenience.

>> WhatsApp gets the UX *very nearly* right. And since everyone and his dog
>> now uses it that's the new baseline. If it's easier to do it wrong than
> 
> No, that actually is broken by design

It's broken, but it's usable. They've prioritised usability over
security, absolutely. People don't care. They should, but they don't.
We're not going to get them to embrace something technically better if
it's harder to use.

> as it doesn't open up for proper operational security controls, > in particular lack of private key
> separation on smartcard and airgapped computer.

Yes. Unfortunately it's tricky to implement that on a smartphone. We
don't have card+phone working in gnupg yet either. We *barely* have
gnupg working on phones at all. But that's for another day.

> the name of the primary UID of a signature is irrelevant; if we follow
> this argument; (i) until it is verified everything is untrustworthy, so
> (ii) the signature itself shouldn't be shown, nor should any of the UIDs
> for the public keyblock itself, as the self-signature isn't verified

I wouldn't go that far. The signature itself is not a signature by "John
Doe <jd at nowhere.com>" - it's a signature by some (sub)key "0x123456...".
The fact that it may or may not be a (sub)key bound to "John Doe" is
rightly stored elsewhere. My argument is that displaying an unverified
comment that *implies* there is a binding *somewhere else* identifying
this key with a particular ID may be a convenience, but is a)
unnecessary and b) a source of confusion. We can't perform any
verification without downloading the full key of the owner anyway, and
that's done with the fingerprint.

-- 
Andrew Gallagher

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 862 bytes
Desc: OpenPGP digital signature
URL: </pipermail/attachments/20170926/ce44b92d/attachment.sig>