‹ BackHN Continuity

Thread

Keys Not Included: recovering the signing keys for US driver's license barcodes

289 points · 152 comments · Ryan5453

  1. bzmrgonz · · focus · HN ↗
    It baffles that people think it's a bad thing to disclose a public key. That's their purpose actually. Sure we now have the post quantum computer threat, and some state actors are harvesting keys, but quantum computer is going to disrupt so much, that Id verification won't even matter really.
    1. morsch · · focus · HN ↗
      Think about it, the key analogy is just terrible. In the origin domain, losing a key is always bad, and making a key available to all is a non sequitur.

      It's not like non-technical people understand asymmetric cryptography. Or even technical people, for that matter.

      Maybe we should refer to the public key as an address, and the private key is just a password again. You can send stuff, securely, to an address. And you can verify the sender when you have their address (ie check the signature).

      1. fc417fc802 · · focus · HN ↗
        The key analogy is perfect for the private key and for symmetric keys. Publishing those is always bad and means you need to rekey immediately just like losing a traditional physical key to a secure building would.

        The public counterpart is tricky to name but I think attaching "public" to it makes the intended usage plenty clear. There isn't really a physical counterpart unless you consider maybe those machines that check for counterfeit cash but even that's not a great fit because the pubkey is simultaneously analogous to a lock box.

        1. TeMPOraL · · focus · HN ↗
          It's not perfect for symmetric keys at all, because the fundamental fact about locks and keys is that a lock sits on the outside of the thing you're protecting, attaching to it or to a container in which the thing is placed. Encryption is about directly scrambling the protected thing.
          1. yencabulator · · focus · HN ↗
            The mental model is that encryption is a locked box you can only open with the key.
            1. TeMPOraL · · focus · HN ↗
              That's a dumb mental model, is what I'm saying. The original sin of cryptography/cybersecurity metaphors.
              1. yencabulator · · focus · HN ↗
                Better than calling encryption "scrambling".
Open on Hacker News to reply ↗

Unofficial Hacker News client; not affiliated with Y Combinator.