Why is WhatsApp trusted? Isn't it proprietary and controlled by Zuckerberg? What am I missing here?
I'm giving up on PGP
321–330 of 350 posts
Re: I'm giving up on PGP
#322Earlier quoted context omitted.
It's pretty bonkers that you trust a computer vendor to control the firmware on your PC but not the CA chain. If Dell is determined to listen to your conversations, they can spy from the hardware, keylog beneath the OS, or literally listen through an embedded microphone.
People don't trust their hardware vendors because they're trustworthy, they trust them because they don't have any real choice. If my preferred OEM offered me the choice between a locked-down opaque system, and an /equivalent/ system that is completely open and verifiable, I'd choose the second option every single time. I expect many would as well.
Sure. I'm just saying it's easier to verify the CA list than verify the hardware, and the hardware gives the OEM a superset of what they can do with the CA list.
Re: I'm giving up on PGP
#323Earlier quoted context omitted.
Great - how do I get a non-compromised smartphone? :/ I'm kidding but I'm also serious.
Yeah. I fear the open-source side only ever catches up once something becomes commoditized, so the actual answer is probably that if you care enough you use a weird and slow phone built for this stuff (that Mozilla phone project?), you use whatever the current replacement ROM project is (I would hope one of Cyanogen et al would offer a carefully signed open-source build - I haven't actually looked), or you wait a few…
Even if cyanogen was perfect, there's a closed source firmware running baseband processor with complete access to system memory, microphone, gps, and the network.
Re: I'm giving up on PGP
#324"One click encryption is one click too many" - Bruce Schneier
Re: I'm giving up on PGP
#325Earlier quoted context omitted.
The author of the article mentions Signal as well, but how do you handle communication from a laptop or desktop computer and/or with people who don't own an Android or IOS smartphone?
Signal does have a desktop application. I believe you can also register a Signal account using a phone number from a service like Twilio. I'm not 100% sure that will work with Signal desktop though. https://whispersystems.org/blog/signal-desktop/
Signal in a chrome app can pair to signal on android/IOS. But I don't believe you can use chrome only. The chrome app just waits for you to pair with a phone and can't send/receive messages until you do so.
Re: I'm giving up on PGP
#326Earlier quoted context omitted.
> I wonder if pgp is fundamentally flawed, or we have a deep conceptual usability issue here. I don't think the "WoT" is conceptually flawed, and frankly, the argument that "people of average intelligence" can't grasp the concept comes from a very high horse and is also untrue. It's simply that any and all software for PGP utterly fails in the UX and functionality department when it comes to key management. Web of Tr…
I have to partially disagree with that. Calling PGP an utter failure is an understatement. Just like calling a cat a small tiger. PGP is possibly the WORST experience in usability for any well known software that ever lived. This thing should be taught in courses for decades to come as how to fail a product by 1) having no UI 2) no integrations with anything 3) zero usability 4) not even trying to give a fuck about n…
> Just get the national government to distribute RSA USB keys to every citizen. Then they can use them on public government websites (taxes & jobs stuff) to confirm poeple's identities, just plug in the key. Quick and simple. (And that's not incompatible with ALSO asking for a password that was send in a different paper letter. 2FA-style.).
Estonia does provide S/MIME certificates for every citizen, although I've been told that they're not particularly heavily used.
Between Estonia and the DoD, there's a few million users of S/MIME. Whereas PGP has a few tens of thousands of users. It's clear which product won out in the marketplace.
Re: I'm giving up on PGP
#327Earlier quoted context omitted.
Is there anything that enables key exchange via smartphones? Ideally it should be as easy as a meatbag handshake. Basically, if you can swap contacts via NFC then the pgp keys should go along with it. It may have some theoretical weaknesses such as the exchange being MITMable if the users don't verify something on their screens, but I think having many more edges in the graph would make up for it since you might alre…
OpenKeychain does this, provided both users have it of course.
To expand on this, OpenKeychain wants you to use the camera on your phone to scan a QR code on your friend's phone.
Re: I'm giving up on PGP
#328The conclusions here (avoiding long-lived per-identity keys and having the option to easily rotate and re-validate per-device keys) are very much what we've aimed for in the end-to-end crypto for Matrix.org ( https://matrix.org/blog/2016/11/21/matrixs-olm-end-to-end-en... ). Rather than using a silo like Signal or WhatsApp, it is possible to get the flexibility of an open federated network built on an open standard,…
When I mention Matrix, a lot of people seem to pigeonhole it as a chat system alone because Riot is such a dominating part of the application ecosystem. It would be really great to have more code and demonstrations available; adding Matrix was suggested for Mastodon[0] to potentially gain chat and private messaging features that aren't part of GNUSocial, but as of right now it's considered out of scope. [0] https://g…
I would love to see a full-federated email-like (as opposed to chat-like) system built on top of Matrix.
Re: I'm giving up on PGP
#329Earlier quoted context omitted.
They can do that, but it'snot cheap for them. Giving the government total, automated access to your communications - and that's what we're talking about here IMO - lets them (and you, admittedly) avoid the whole beating scene. In real terms, it would drastically change the balance of power.
> Giving the government total, automated access to your communications Hello no. Absolutely not. We're talking here about a state distributing USB keyz with a certificate to each citizen. The certificate is 'vouched' by the CA, it confirms the name of the citizen and it can be used to sign stuff thanks to private key cryptography. One usage could be to access public websites, and use that USB key to log in and confir…
You're correct, I was distracted by some posts in this chain that seemed to be talking about using the key for encryption, not identification.
So the primary threat would be impersonation by the trusted party, which would erode the trust pretty quickly. I'm still a bit wary of this approach - do you think we'd manage to keep the keys from also being used for message encryption?
Where I live, there's actually a system somewhat like this in place - banks etc. can provide identity verification to websites upon request. You log in to the bank's system with your account and one-time pad they provide, and the bank tells you what information it will pass on to the requester. It seems pretty decent, and might actually be better than the USB key approach.
Re: I'm giving up on PGP
#330I gave up 3 years ago: http://blog.mostlydoing.com/2014/03/how-to-securely-store-pr... (I don't trust myself to securely store my private keys)