Smart card

[Mike Gerwitz]

On Sun, Apr 09, 2017 at 11:30:47 -0700, Doug Barton wrote:
> You and Rainer have gone on at great length about the part of the threat
> model equation dealing with the attacker. However, you don't seem to take
> into account the other part of the equation, what you are protecting.

Sure: the sensitivity of the data determines the threat model.  If I'm
just protecting the password to my bank account, then law enforcement
isn't part of my threat model, because they wouldn't need it to access
my account.

> The overwhelming number of PGP users simply use it because it's cool. They
> don't have anything approaching significant secrets to protect, it's just
> fun to do cryptography. There is nothing wrong with that, in and of
> itself. (Note, I acknowledge that there are people for whom signatures and
> encryption actually matter.)

My advice isn't useful to those people (unless they find it cool),
you're right; but they aren't my audience, generally speaking.  With
that said, everyone can benefit from strong crypto to some degree to
protect their privacy.  Whether or not they care, and whether or not GPG
is the solution to any sort of problem they're having, is another story.

> The concern is that when folks tell the new users that they are
> *required*, that becomes problematic for a couple of reasons. First, it
> gives a false impression of how secure the "basic" version of GnuPG is in
> the first place. Perhaps more importantly, it places a much higher barrier
> to entry for new users; for no measurable ROI.

I agree.  I don't mean to give the impression that I convey that it is
required.  When introducing users to the concept of PGP, smartcards are
always mentioned as an extra step that might help with certain concerns
they have (e.g. sharing the key on multiple devices).  I don't invent
reasons, unless someone's asking from a crypto perspective and wants
that level of detail.  Sometimes smartcards don't come up at all.

With that said, my use of my smartcard sometimes initiates discussion.
And sometimes people use GPG simply because they want to be able to use
a smartcard for something like SSH.

-- 
Mike Gerwitz
Free Software Hacker+Activist | GNU Maintainer & Volunteer
GPG: D6E9 B930 028A 6C38 F43B  2388 FEF6 3574 5E6F 6D05
https://mikegerwitz.com
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 818 bytes
Desc: not available
URL: </pipermail/attachments/20170409/4c057c65/attachment.sig>