@OgNasty you are right. But the discussion is more about the way to contact someone. On signal you need to have the number of the person that you want to talk. On telegram you just need the nick, and you could talk with that person without exchange your phone number. Discord, slack you only need a nickname/email too.
And I do not think it is off-topic because it is a topic about the part on the profiles page that we use to put personal contact. It is important to discuss anonymous and safe issues about those messagers =)
Thanks. The discussion isn't just about ways to contact someone though as you alluded to in your later comment. It's about increasing the value of the profile page, specifically replacing lines that are no longer useful to anyone. If someone is trying to send me a message on the forum, I think the ability to use PGP to encrypt the message is useful. They could also use the more common method here of using
https://privnote.com - but that runs a bit counter to the decentralization theme here if you ask me.
Ive long thought there should be a spot for PGP fingerprint.
PGP fingerprints are SHA-1, which is insecure. The OpenPGP standard really needs a complete new revision...
Is it really insecure in
this context?
To my knowledge the only problem with SHA-1 so far is collision. Considering SHA-1 is 160-bit and there is a known structural weakness, it has a time complexity of 2
63 which is very fast. But in this context the security depends on ability to find a
second preimage (since the message aka the pubkey and the hash of it is already known), and there has been no weaknesses found to help perform this any faster so this has a time complexity of 2
160 which makes it expensive enough to be secure.
Everything is relative. One man's insecure is another man's fortress. I think rather than debating the security of PGP, we should perhaps ask if there is a better available option.