gpg: unhelpful messages?

[Daniel Kahn Gillmor]

Thanks for raising this, Neal!

On Mon 2016-08-29 07:22:52 -0400, Neal H. Walfield wrote:

> While doing some unrelated development / testing, it occured to me
> that the following message is rather misleading:
>
>   # gpg --verify FILE
>   gpg: Signature made Wed 24 Aug 2016 01:49:53 PM CEST
>   gpg:                using RSA key 7223B56678E02528
>   gpg: Good signature from "Neal H. Walfield <neal at walfield.org>" [unknown]
>   gpg:                 aka "Neal H. Walfield <neal at gnupg.org>" [unknown]
>   gpg:                 aka "Neal H. Walfield <neal at g10code.com>" [unknown]
>   gpg: WARNING: This key is not certified with a trusted signature!
>   gpg:          There is no indication that the signature belongs to the owner.
>   Primary key fingerprint: 8F17 7771 18A3 3DDA 9BA4  8E62 AACB 3243 6300 52D9
>        Subkey fingerprint: C03F A641 1B03 AE12 5764  6118 7223 B566 78E0 2528
>
> I think there are two problems with the above message.
>
>
> First, gpg says: "Good signature from USERID".  The good signature is
> from the key, not the user id.  Anyone can create a key and specify
> any user id that she wants.  Only if the USERID / KEY binding has been
> somehow verified should we say Good signature.  Otherwise, we should
> say something along the lines of:
>
>   Good signature from KEY allegedly controlled by USERID [unknown]
>
> or the slightly shorter:
>
>   Good signature from KEY with the moniker USERID [unknown]

"allegedly controlled" would be my first choice, "moniker" second, and
the current wording last.  Thanks for suggesting this improvement.

> Second, the warning says: "There is no indication that the signature
> belongs to the owner."  Whereas my previous critique is based on the
> reliance on jargon, this phrase is just technically false.  If the
> signature is valid, then it definitely belongs to the owner.  The
> question is whether the owner is actually who the user thinks she is.

I agree with this as well. If we fix the "Good signature" line, this
entire warning could go away.  Or, if we want to keep the WARNING, we
could change both lines of the warning to something like:

WARNING: GnuPG does not know whether KEY actually belongs to USERID.
         This signature might be made by someone pretending to be USERID.

It'd be even nicer to give the user a suggestion about what to do if
they have actually verified that KEY does belong to USERID, but that
might get too verbose :)

> I mentioned these issues to Werner on gnupg-devel and he said:
>
>   1. People complain about the TOFU messages being too verbose.
>
>   2. No one has complained about the above messages in the past 25
>      years.

Maybe no one has ever complained on-list or to the GnuPG team because
they don't think they can ever be changed, or because they don't know
how to rephrase them better.

But i can tell you that i've heard many many complaints about these
messages from trainers and from users during trainings.  it's nearly
impossible to explain it to new people, and it's one of the first things
that new users see when they are trying to understand the tool.

There, now at least two of us have complained on list, a minor
reflection of the hundreds of complaints i've heard over the last few
years.

>   3. gpg is just for geeks and as just the interface can use lots of
>      jargon and users can be expected to look up these terms.

if we want gpg to just be for geeks, we can keep it with its current
usability.  if we want it to have wider adoption, we need to take
UI/UX/jargon concerns seriously and take the improvements that people
offer.

I'm on board with the fixes Neal proposes here.

        --dkg
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 930 bytes
Desc: not available
URL: </pipermail/attachments/20160829/49945457/attachment.sig>