Personally I'm most fond of Calibre + Calibre-Web, which masquerades as the Kobo Store and lets you use the built-in Kobo syncing mechanisms with your Calibre library instead of having to do it all within Koreader.
Those are no longer big these days so no. Also, they're not going to restart a whole product category just for grapheneos.
As OnePlus is kinda dead and taken over by oppo, I'm guessing Sony. They have some similar collaboration in the past like with Jolla. My Sony XA2 was one of the few models that could run sailfish.
BlackBerry hasn't been OEM for their last few phones - the KeyOne, 2LE, and 2 were all outsourced to TCL, who is still making handsets. This would also fit with BlackBerry's security image, and even pull in the OnwardMobility vapourware.
I'm every bit as skeptical as you are, and in no universe is BlackBerry the OEM in question, but I would like to live in my delusion until GrapheneOS proves me wrong - I want a keyboard, dammit!
I'm hoping they'll get around to supporting command-number for switching between windows[0]. command-` is fine but clunky as hell when you have more than three or four windows. Without command-number, I'm still stuck using iTerm2 as my daily driver.
(It'd be nice if it supported other standard macOS UI conventions[1] too)
A little unfair that this is downvoted. No search is like a dealbreaker for me. I'm happy with iTerm and for 99% of my use cases I don't need a "very fast" terminal. Thanks for pointing this out.
Seems I will wait a little longer before search is in the regular build (and not nightly ones)
Many, many, many years ago (before 9/11 and before cell phones were commonplace) I used to carry my ham radio HT and call on simplex (146.52 for those that know) and make contacts. Those were fun times.
Every time I get a dev or executive sending me a Slack message saying "can you reset my password" or "can your provision me in...", my very next reply is "please send me your public key".
They do not get their credentials until they do so. And once they do, our security posture gets better and better.
As for how it improves security, I'm going to hazard a guess that many of the people sending zikduruqe those messages hadn't previously set up a PGP key. So by asking for the public key and refusing to send them the credentials until he receives it, he's forcing them to set one up, which then makes it possible for them to do things like sign messages. Just making someone set up a keypair doesn't mean they'll use it correctly, but it's hard to argue against the idea that a company's security posture is improved when more people have PGP keys.
It’s so easy to use insecurely that I will argue that employees setting up PGP keys and then potentially trying to use them does weaken the company’s security posture.
I agree it is easy for people to shoot themselves in the foot with many historcal PGP tools, which is exactly why we made keyfork.
It generates modern ECC PGP keychains with best practices in one shot, with multiple reasonably secure user friendly paper or smartcard, backup solutions.
You will really know what you are doing to force keyfork to generate an unsafe keychain. Especially if you use it on AirgapOS, which ships with it.
Care to elaborate on this? How come using PGP insecurely is somehow more insecure than not using it at all? And what do you exactly mean by using it insecurely? Care to give me an example of this insecure use of PGP?
Asking for their public key lets you encrypt messages that only their private key can decrypt, and verify signatures they create. It doesn't by itself prove their real identity, you still need to verify the key's authenticity (e.g. via fingerprint comparison or a trusted keyserver) to avoid impersonation or man-in-the-middle attacks.
I think what I’ve gathered is that the person I replied to is going with a TOFU model of key security (trust on first use), or is just seeking to avoid plaintext passwords in slack messages and is treating the key as disposable for the one-time encryption of the password.
Presumably they must trust that the user messaging them on slack is indeed who they say they are and is in control of the account.
If I’ve understood correctly, this seems like one of those cases where PGP is adding quite little security to the system, and may be preventing the implementation of more secure systems if it is providing a false sense of security.
But it’s probably just someone doing their best in a system beyond their control.
Like I have said in another comment, the question of identity verification makes no sense in this context. The identity verification problem is orthogonal to the encryption scheme.
That is an extremely weird argument. They aren't separable concerns. If you have a trusted identity in place you could use a password-protected AES ZIP file for all the encryption matters.
> I think I'm missing something, how does asking for their public key improve security or verify their identity?
OK, so this was the question. My response should have been "it does not necessarily verify their identity". I mentioned some of the mechanisms for identity verification in the other thread.
It allows the security guy (in this case, zikduruqe) to send an email that can only be read by the person who possesses the corresponding private key. Which means that either the email is going to the executive who really does own the account, or else that the attacker has already breached that executive's laptop to the point of having acquired his private key (and passphrase, if there was one), in which case phishing attempts to get a password would be utterly pointless (like trying to pick the lock of the front door when you're already inside the house).
Well, I've been assuming that zikduruqe is competent and knows how to pick up a phone and call the person (looking up a phone number in the company database) to verify that the public key came from him via fingerprint-checking over the phone. Sometimes people leave steps out so as not to write essays in a comment box.
My confusion here is that if you're doing that, why bother with the cryptography? You can just look the person up in the company database, call them, and say "Hey! Did you just request a password reset?".
If one of your pre-requisites is "There is a trusted out-of-band way for me to validate comms with this person", the crypto is just extra bits.
The question makes no sense in this context. The identity verification problem is orthogonal to the encryption scheme.
This problem exists regardless of PGP. If someone's Slack is compromised:
With PGP: attacker gets credentials encrypted to their key
Without PGP: attacker gets plaintext credentials
But both fail at the same point: verifying who you're talking to. That's not a PGP problem, it's a "doing password resets over unauthenticated Slack" problem.
PGP does provide multiple identity verification mechanisms, e.g. web of trust, key signing, fingerprint verification, in-person key exchange, and Keybase-style social proofs linking keys to verified accounts.
The workflow described just doesn't use them. Identity verification is required for ANY secure credential exchange system; you either verify keys properly (signed by trusted parties, verified fingerprints, pre-enrolled, social proofs) or you have the same problem with passwords, TOFU SSH keys, or anything else.
Are you criticizing PGP for not solving a problem that the workflow simply didn't implement a solution for?
That's only true if the key's authenticity isn't verified. If you just accept any key a person gives you, then yes, it's meaningless. But if you independently confirm the key's fingerprint through a trusted channel, it becomes a real security measure that prevents impersonation and ensures confidentiality.
The workflow as described (no verification step) is theater. But that's true for any credential exchange without identity verification, PGP or otherwise. The issue isn't PGP, it's skipping the verification step. PGP provides the tools (fingerprint verification, web of trust, key signing), but you have to actually use them.
The out-of-band verification is for initial key enrollment, not every credential exchange. You verify the fingerprint once through a trusted channel, then use that verified key indefinitely without needing the trusted channel again. That's the entire value proposition: establish trust once, communicate securely many times.
Without this, you'd need out-of-band verification for every single credential exchange, which doesn't scale.
As for "PGP is trash"... That's a different argument entirely, and you've provided zero technical justification for it. If you have specific criticisms of PGP's cryptographic primitives, key management model, or implementation security, make them.
> This is the weirdest technology market that I’ve seen.
You must have not lived through the dot com boom. There was almost everything under the sun was being sold under a website that started with an "e". ePets, ePlants, eStamps, eUnderwear, eStocks, eCards, eInvites.....
Those things all worked, and all of those products still exist in one form or another. It was a business question of who would provide it, not a technology question.
It's funny that the Netherlands seems to still live in the dotcom boom to this day. Want to adopt a pet? verhuisdieren.nl. Want to buy wall art? wall-art.nl. Need cat5 cable? kabelshop.nl. 8/10 times there is a (legit) online store for whatever you need, to the point where one of the local e-commerce giants (Coolblue) buys this type of domain and aliases them to their main site.
I was making commentary about the niche/independent nature of these online retailers (another example: graszaaddirect.nl, specialized in grass seeds), not that e-commerce itself survived the bubble.
Having a dense country where you reach any opposite end in <3 hours is probably a major factor. You don't really care where it's coming from (sometimes it's Germany) as delivery time is the same. That would not be the case for the US, you'd require a web of distributors.
Pretty funny, looks like it works in France too! animaux.fr redirects to a pet adoption service, cable.fr looks like a cable-selling shop. artmural.fr exists but looks like a personal blog from a wall artist, rather than a shop.
It did make sense though. ePlants could have cornered the online nursery market. That is a valuable market. I think people were just too early. Payment and logistics hasn’t been figured out yet.
I seem to remember real bullies would do it to your face before the internet. Not just anyone behind a keyboard.
reply