Nice username.

https://hackyourmom.com/en/osvita/u-pamyat-pro-kevina-mitnik...

Almost all of it, yes.

The packet format is awful, full of complexity, backwards compatibility mess, and serious security problems.

The spec is pretty awful in that a lot of the complexity is due to keeping compatibility with things that are a terrible idea. And also in that the general concept of a long lived key turned out to be a bad one.

The library or lack thereof IMO cripped PGP/GPG back when it was relevant. It's nigh impossible to make tooling for it, or it was until Sequoia showed up, which was extremely late. Things like doing stats on keys, or doing anything but what the binary wants to do were terribly painful until Sequoia.

The Web of Trust was an interesting idea for a while, but failed to transition to the modern internet.

By the time you fix all the things what remains looks nothing like PGP, so it amounts to "all of it is bad".

PGP: The flamethrower (kids love this one)

All of those things are liabilities (I read them carefully and mentally checked them off one by one; I'm not just being rhetorical). I wrote a sibling comment going into more detail, but happy to answer questions.

Each of these bad in a different and exciting way, if your idea of exciting is reading mailing list threads.

(The idea of trust networks is not bad. But PGP’s implementation of them is bad.)

Secure messaging is its own (increasingly well-defined) cryptographic problem. Group secure messaging is a distinct problem with its own cryptography. Backups are their own problem with their own constraints. Package signatures are their own problem.

There isn't one cryptosystem that does all these things. For messaging you want a carefully-defined notion of forward secrecy and post-compromise recovery, along with a careful decision about repudiation/non-repudation (1990s cryptography doctrine would suggest you just always want nonrepudiabilty, which turns out to be disastrous for privacy). For backup, you want deduplication and content addressing. For packages, you want transparency logs. You almost never want long-lived keys, but you often want identify binding.

PGP solves basically none of these problems, and offers instead a 1998 API (I'm not kidding, I thought about what year to pin it at) to basic cryptography primitives.

I guess the code base has really become a bit messy over time with all that parsing and different crypto algorithms. But the attack surface can be significantly reduced by using sq or even better stateless sqop.

https://gpg.fail/

https://www.latacora.com/blog/2019/07/16/the-pgp-problem

Recommendations: https://soatok.blog/2024/11/15/what-to-use-instead-of-pgp/

We don't need to keep elaborating or re-litigating the same discussion. The PGP idea of "one tool to rule them all" is a terrible cryptography design, and the world is better off the sooner we stop trying to make it work.

> But PGP is useful if both sender and receiver agree to use PGP.

Anecdotally: this works until you add a third person who responds to the thread in plain text, with everything threaded beneath. Or when you do that by accident.

Applied cryptographers will tell you to use Signal or any other E2EE chat.