Thread

1. bzmrgonz · 1789618128 · focus · HN ↗

   It baffles that people think it's a bad thing to disclose a public key. That's their purpose actually. Sure we now have the post quantum computer threat, and some state actors are harvesting keys, but quantum computer is going to disrupt so much, that Id verification won't even matter really.

   1. morsch · 1789623646 · focus · HN ↗

      Think about it, the key analogy is just terrible. In the origin domain, losing a key is always bad, and making a key available to all is a non sequitur.

      It's not like non-technical people understand asymmetric cryptography. Or even technical people, for that matter.

      Maybe we should refer to the public key as an address, and the private key is just a password again. You can send stuff, securely, to an address. And you can verify the sender when you have their address (ie check the signature).

      1. fc417fc802 · 1789624845 · focus · HN ↗

         The key analogy is perfect for the private key and for symmetric keys. Publishing those is always bad and means you need to rekey immediately just like losing a traditional physical key to a secure building would.

         The public counterpart is tricky to name but I think attaching "public" to it makes the intended usage plenty clear. There isn't really a physical counterpart unless you consider maybe those machines that check for counterfeit cash but even that's not a great fit because the pubkey is simultaneously analogous to a lock box.

         1. TeMPOraL · 1789662059 · focus · HN ↗

            It's not perfect for symmetric keys at all, because the fundamental fact about locks and keys is that a lock sits on the outside of the thing you're protecting, attaching to it or to a container in which the thing is placed. Encryption is about directly scrambling the protected thing.

            1. yencabulator · 1789663638 · focus · HN ↗

               The mental model is that encryption is a locked box you can only open with the key.

               1. TeMPOraL · 1789717594 · focus · HN ↗

                  That's a dumb mental model, is what I'm saying. The original sin of cryptography/cybersecurity metaphors.

                  1. yencabulator · 1789741815 · focus · HN ↗

                     Better than calling encryption "scrambling".
                  2. fc417fc802 · 1789756362 · focus · HN ↗

                     What's dumb about it? I'd suggest that it's slightly abstract and argue that there's nothing wrong with that. It fits perfectly and it's readily understandable.

                     For example a VPN connection lends itself to being described as a pipe. That already equates the encapsulating protocol with a physical barrier regardless of the presence of cryptography.

                     I think you're just being overly literal, something which will kill almost any decent analogy regardless of topic.

                     1. TeMPOraL · 1789768924 · focus · HN ↗

                        You have a very large subthread debating downstream confusions, which were previously debated in millions of such discussion on-line too. It's a confusion everyone has to learn to live with when first exposed to concept and the metaphor of "keys" and "locks".

                        And it's because it does not fit. Locks and keys are distinct kinds of objects, and are external to the thing being protected, with lock itself being attached to the thing being protected. Only the key can be distributed separately and copied; you come into possession of the security mechanism and the protected object together, they're literally unseparable (that's the point - if you can separate the lock from the thing, you don't need the key anymore).

                        Encryption in contrast is (reversibly) destroying the thing being protected, the "locking mechanism" is public and same for everyone and therefore you already have a copy, and you can't "bypass" it because the very thing being protected has been destroyed (scrambled) and you cannot undo that without having the "key".

                        There's no 1:1 mapping of any concept from physical locks and keys to encryption. It's a fundamentally dumb analogy that people run away with, because at first look it seems to have some semantic similarities.

                        1. yencabulator · 1789770804 · focus · HN ↗

                           "Undo" a "destroy" is just a bad metaphor okay?

Unofficial Hacker News client; not affiliated with Y Combinator.