Trusting PGP

• Autores: Phil Pennock
• Localización: ;login:: the magazine of USENIX & SAGE, ISSN 1044-6397, Vol. 38, Nº. 6, 2013 (Ejemplar dedicado a: Security), págs. 33-37
• Idioma: inglés
• Texto completo no disponible (Saber más ...)
• Resumen

  • PGP is a great tool, but if you’re coming to it now, after this year’s NSA revelations, then it’s probably not the service you want. In fact, I’ll go further: if PGP is being peddled to you as the panacea to the NSA issues, the peddler probably doesn’t understand what they’re talking about.

    In all security decisions, you should decide what you’re trying to protect and from whom. Additionally, you should decide how much the protection is worth to you. Only once you’ve done this, can you decide which attributes (confidentiality, authenticity, etc.) you need and what tradeoffs are worth it.

    For various good reasons, I run my own mail service that serves only two people; for various other reasons, I stand out like a sore thumb. Frankly, the NSA is not in my threat model. If it were, I wouldn’t run servers with network services provided by programs written in C. In this article, I assume that the reader is dealing with people who have suddenly decided that the NSA is part of the threat model and that the reader needs data points to apply in a reeducation process.