Hacker News new | ask | show | jobs
by willalden 3701 days ago
Hi all -- I wrote the Palantir article. It's really awesome to see all this discussion about it. As I say in the post, please don't hesitate to contact me if you'd like to chat confidentially. I am always eager to hear any tips or new information. Find me on WhatsApp, Telegram, Signal, or encrypted email. Contact info here:

https://www.buzzfeed.com/williamalden/inside-palantir-silico...
2 comments
CydeWeys 3701 days ago
By the way, your PGP key has no signatures on it. It could trivially be swapped out on your webhost if the server was compromised and no one would know the difference. You should go to a PGP key-signing party. I would offer to sign your key, but you aren't in the NYC office like I would've assumed. Fortunately there's no shortage of people to sign your key in SF!
link
rcpt 3701 days ago
This seems relevant right now https://moxie.org/blog/gpg-and-me/
link
snassar 3701 days ago
Signal has a nicer communication user interface for some communication compared to email + PGP but it has not really solved the verification problem that many secure communication methods have.

The grandparent is advising the writer to improve the verification aspects that PGP provides.

Have you tried re-establishing trust with a Signal user who wiped their device? It falls back to the same PGP problem of comparing a string of numbers over a different secure channel.

Moxie addresses some problems with the OpenPGP RFC and with the GnuPG implementation, but after re-reading that post I don't see how it relates to the verifiability issue the grandparent is bringing up.

link
aestetix 3701 days ago
Or he could post his key signature on multiple media, provide links to them, and not expose his social network ;)
link
CydeWeys 3700 days ago
There's not particularly any connection between your social network and your PGP key signatures. That's what key-signing parties are good for: You get your needed signatures from people who are strangers, who are validating your identity through other means, such as access to your email account, physically matching photos that are associated with your various online presences, and possession of government-issued photo ID.
link
CydeWeys 3701 days ago
Do you have your PGP key fingerprint on your business card? If not, you should.
link
willalden 3701 days ago
I don't! Good call.
link