The double ratchet stuff is too complicated. All it protects from is someone stealing your key. But PGP solves the "server admins can read my posts" problem without all the complication. Prove me wrong.
bonifartius 𒂼𒄄
@alex the problem with pgp is that it also proves that _you_ wrote something in case the key leaks, as everything is the same keypair. that's what double ratchet improves - forward security. what you actually need depends on the threat model of course, pgp isn't bad.
@Hyolobrika @bonifartius @alex That assumes the sender signed the msg. If Bob encrypts a msg to Alice & does not sign it, and he also does not encrypt to self (some ppl do this to store a copy), then the only thing tying Bob to that msg is whatever metadata accompanies the payload. Alex doesn’t mention the protocol involved. If we’re talking XMPP, then openpgp is an issue b/c some clients only have OMEMO.
@koherecoWatchdog i'd say that "encrypted with private key" is a signature.
@Hyolobrika@mstdn.io @alex
@koherecoWatchdog
ah, indeed, had a brain fart :)
@alex @Hyolobrika@mstdn.io
@bonifartius @alex @Hyolobrika That’s true, but you should only do that if you want to sign it. Does the client not give a choice? In principle you don’t even need a keypair to send a msg unless you need to sign it.