All right, well, we get set up.
I'd like to welcome our next speaker,
Oz-John Oost to the stage.
He is a founding member and president of the Free
Software Association in Turkey,
and a founding member of Hacker Space Instumble.
He's going to give a critical defense
like a new PG that frames user on cryptographic keys
as the only defense against digital feudalism.
So, how may we welcome him to the stage, everyone?
We're right now.
OK.
So, hello, and thank you for coming at an early hour,
because some stands are still like building up.
It's a huge crowd.
Thank you for coming in.
I'm going to talk not talk.
I'm probably going to defense going to PG today.
In this talk,
so he made a great introduction, but if you ask who am I,
I'm a daily and regular user of the new PG.
I do, I do and use the new PG encryption
authentication like in a daily basis.
And I'm a founding member of Free Software Association
in Turkey, Oz-John Oost, and Hacker Space Instumble.
Unfortunately, it's defined right now.
And we wrote a book for end users mainly.
It's a security guide, basically, to tell people
how to, like, survive in digital spaces.
So, this talk is based on an article published
in our Association's website, 60 years ago,
but things never change.
So, the cycle comes again.
Every year, in every six months, every two years,
a blog post, a video, something just shows up,
and says, the new PG is that.
By the way, in this slide, I use the new PG or GPG,
but it mostly covers open PGPS law.
And the reasons are usually the same.
It's too hard to use.
It's too old.
I don't know what this means.
It's too complicated for normal users.
It's funny.
Two nerdy, and sometimes replaced with something else.
And there are some other things.
That says, you cannot secure your email anyway,
because it will leak your metadata.
It has no meaning.
All ignored use, so it's lame.
Basically, you are, like, a group of crypto nerds,
and you do it together.
Web of trust is broken.
So, why don't you just leave it?
I installed.
You can insert any app here.
Like, we have a bunch of them.
From some proprietary store.
And now, I'm fully secure.
I don't need anything to do else.
And from the nerdy side, we usually
got something like, the new PG has an irrelevant issue
on the level of NSA, like a vulnerability.
Only, like, colors you, if you're an Edward Snowden level.
Someone.
And now, that's why it's obsolete.
So, switch to, like, modern crypto.
And unfortunately, this is the saddest part.
I am nothing to hide.
So, why you need to encrypt something.
So, these people usually assume that users are stupid and lazy.
And security must be invisible for that.
Like, freedom is optional, they say.
It's not.
It's essential, because if you give up from your freedom,
you give up freedom for everyone else.
And they say, if it's not perfect, it's worthless.
We're not Edward Snowden.
They're a threat models.
So, nothing is perfect.
We're trying to make things perfect.
And almost always, it comes to someone else
should manage identity.
And, yeah, it's not a UX debate.
It's about power.
Like, who controls your keys?
Your identity.
Who do you trust about this?
How do you revoke your keys?
And, about the continuity.
So, here comes the term digital feudalism.
And, you know, the era's in human history.
Usually, in names, after the most valuable thing,
the valuable property, for example, the Iron Age.
In the Iron Age, Iron was the most valuable thing.
Who has Iron has the power?
They had weapons.
They had agriculture, tools, everything.
And now, we are living in digital era.
So, who owns digital identities, rules of earth basically?
And now, unfortunately, our infrastructure
is owned by just a few companies.
There are some fun.
We were talking about, at the previous talk here,
we were talking about clubs there, right?
Like, it went down and the half of the internet collapse, basically.
But the value is produced by many.
We all use technology.
So, you don't need to understand.
Is the nurse of them?
Because, some companies gives you a package.
That will make you safe.
You don't need to understand how it's working.
You don't need to understand the technology, the idea behind it.
We will just handle the thing, just download an app and be the safe.
You know what's up?
What's up, works like this?
It says there is an end to end encryption.
You just download the app and it will work.
But GNUPG actually comes from a different era.
The era when the hacker culture was leading the technology.
And the user responsibility was a thing.
As I said, if you say, the users are lazy and stupid.
It's basically saying, like, users cannot have the responsibility to handle
their keys, their infrastructure, their encryption.
And back then, there was no app stores.
There was no vote gardens and no invisible cryptography.
So yes, GNUPG is hard.
If you compare to the others, but silver computers.
Twenty years ago, there was a term about knowing how to use a computer.
Computers were not like that.
Not everybody was using them.
And within the time, the complexity didn't disappear.
If you look at the low level, the complex is still there.
But we built a layer on it.
The complexity disappeared.
Not disappeared.
It was hidden under a layer.
So now, we lost our right to fix on so many software.
And hardware.
We lost user autonomy.
We lost inspectability, especially on proprietary software.
And the encryption followed the same path.
The capital wants to control the crypto.
So now, privacy is a product.
Apple sells you the privacy.
Because the fear is profitable.
This is the main idea of the capital, as Karl Marx said.
And the control still remains centralized.
We trust on the central authorities.
So I'm talking about mostly proprietary software and big corporations.
So when you say, just use signal.
Signal is an excellent software.
They have so many problems.
We have forward secrecy right now.
And the usability is great.
But it's basically a world garden.
Because we don't have federation.
Not only that, but also if we have f-droid users.
There was a project a few years ago.
It's not frequency, I guess.
It was another client of the official signal software.
And they threatened the developer to remove it from the f-droid.
So they said, signal server.
The one runs on the signal.org is ours.
So you have to use the official app from signal.org.
You can build your own server.
But you cannot build an app for our server.
So it's basically a world garden.
Your identity is f-bound.
You cannot remove the identity from the app.
It ties with signal app.
So just use matrix.
You can say.
matrix solves one of the problems of the signal.
Yes, the protocol is open.
And it has federation.
But still, it's mostly about instant messaging on me.
And the cryptography on matrix is usually bounded with the purpose.
And also it's not mandatory.
Like you can use matrix without any encryption.
And it's not a general identity system.
And also, like, if you are talking about using something easy on matrix,
I'm personally using GlimiJoyS.
And for the false damage stuff,
like so many their rooms are using matrix to chat.
Just try to use push notifications on the element.io.
And you will see if it's easy to use and set up or not.
So there is a pattern.
Modern tools on cryptography are usually single purpose.
Like instant messaging and it's sold.
And there is a provider on the media.
And you use their servers or their protocol.
The key management is open.
Have you ever seen any signal message literally on the encrypted?
Probably not.
Because it handles everything for you.
It's open.
And the identity is not portable.
Sometimes it's tied to your device.
Sometimes it's tied to your account.
So what GlimiPG gives you basically at this point?
The key sovereignty.
You have your key, you have your identity.
You can export it either in binary formats or plain text formats.
You can see it.
You can revoke it.
It's one of the most important features of the GlimiPG.
You can generate a revocation certificate and use it to revoke your key.
If you lost your key or your key is compromised.
It's a great feature.
You can extend your key, add new identities.
Like if it's expired, you can extend anything.
You can back up your key.
Either in a file or in a paper.
This is a GlimiPG privacy.
You can hold it in your hands.
Either in this form or in that form.
Or maybe in that form.
It's a GlimiPG smart card.
This is my key.
And this is my key too.
And there is a paper backup.
It is stumbled for me.
And this is my key as well.
So we can go offline forever.
If internet goes on the black card right now,
GlimiPG keys are still usable because we have it in our hands.
By the way, if you want to back up it,
you can print it like this as well.
On QR code.
So now it's machine readable.
There was a tool back then.
But now it's written in Python 2.
I suppose.
So I wrote a tool to put your keys like this.
You can find it on the description in for the website.
So it's basically identity without any permission.
There is no central authority.
No mandatory server.
No owner of anything.
You own the key and you own the trust.
No phone number.
No account.
You are on 30 to 30 basic.
And if it comes to the authority of trust,
I need to mention something like,
to mentioning signal.
If you want to download signal from the official website,
there is a method of verification.
Is there anyone who does it?
It verifies why are the fingerprint of the HTTPS certificate basically.
But HTTPS certificates are usually bound
on some certificate authority.
The CA.
And in the CA list of your system,
there are certain entries from governments.
For example, in Turkey, there was an authority called Turk trust.
And it's like government owned.
So they created wildcard certificates on Google.com,
Gmail.com, whatever.
And why are that?
They were doing many intermediary attacks.
You cannot avoid it.
Everything is like vulnerable.
But if you have the key and you have the trust,
you can determine your level of trust.
It will not be a problem.
So, there is a thing called web of trust.
Now, whenever you see, whenever you see or you say web of trust,
in case of GNUPG, people usually say,
it's done.
Like the SKS servers are done.
They are full of spam, float, float, float.
So, it's that.
It's not bad.
Yeah, the servers are full of spam,
but trust is social.
You trust to people basically.
And trust is remarkable as now.
If something is compromised, you can revoke it.
We have a web of trust in Istanbul, which in our friends.
And when we come to conferences like Phosem, CCC,
or which media hackathon, we made signatures.
And with all three signatures from Richard Stone,
some debyan developers and some people from canonical,
you will probably have a really good web of trust.
It just works.
Like when you trust someone at a high level,
and if they trust someone at the same level,
you automatically trust with them.
People run it.
Not companies.
Not big corporations.
Yeah, this is the thing.
Forward secrecy is missing.
It's the main feature of signal.
It's true, but new PG protects identity.
So it has a feature coming from this.
It has long term variability.
If you can verify something today,
you will probably verify it in the next.
I mentioned about this, but web models matter.
When we wrote the article I mentioned before,
Open PGP has no post quantum cryptography stuff.
And this was the whole topic.
Like, Google PG has no post quantum support,
so it's useless right now.
Is there anyone see a quantum computer in their life?
It will probably be a problem from 50 years from now.
But you know what?
We will probably, like, half of us, let's say.
We'll probably dead within, like, 60 years.
So the thing is, actually, nothing is perfect.
So trying to make it perfect is a good effort.
But, like, discarding it because of not being perfect
is not sustainable.
The new PG is well implemented,
and it has durable access.
So you have one key, and it has many uses, including
but not limited to.
You can encrypt your email.
If you install the email, you can encrypt your instant messages.
Files, backups.
It can be used as this digital signature.
Like, if you want to contribute to Ubuntu, for example,
they want you to sign code of conduct with your little PGT.
Because it's fine with your identity.
Packages.
If you install something like pseudo-opt,
install some package Firefox,
it's used GNU PG to verify.
Mostly, the transmission is not over HTTPS,
because of the same reason.
Why do we need to trust some central authority
when we have an opportunity to trust ourselves?
We can, woman, okay.
Code signing.
Just words.
If you use GitHub, GitLab, Codeberg,
you can sign your comments with GNU PG.
Passwords.
Everything.
So you have one backup strategy, one identity,
and you have hardware tokens, as I mentioned.
So GNU PG is not an app.
It's never meant to.
It's not server bound.
It is not that we have a bedroom about this.
So if you want just need to install an app,
installing an app will not give you privacy.
Because privacy is a human matter, not a software matter.
But you can still try open keychain.
And using GNU PG with open keychain is way more easier
than opening an account in X,
I meant anywhere.
But X, the Twitter is still applies.
And yeah, security requires an ordinary doubt.
So being alerted on privacy is better than one
ability caused by this lag stick.
And real risk is calling on a PG too hard is usually
accepting users should not control your own identity.
And that's why GNU PG is not obsolete right now.
GNU PG is an idea, basically, with no authority.
And the ideas are valid proof.
It's survived cryptolors, political pressure, black propaganda,
and it will survive after that.
Thank you.
If you have questions, I will be around.
And you can use my stuff as well.
Exactly.
I was going to say if you have any questions for Liz gun,
please go ahead and find him after this.
We're going to go ahead and get changed over now.