Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

2017 Levchin Prize for Real World Cryptography

linkedin.com

Post reply on HN
Print view View original

21–30 of 35 posts

Re: 2017 Levchin Prize for Real World Cryptography

#21

Post by tptacek »

Unman wrote: post #18

While applauding the stated mission of Open Whisper Systems to make cryptography usable by large numbers of people I think it is fair to hold Moxie & Co. to the same high standards to which they held PGP: https://moxie.org/blog/gpg-and-me/ The journalists who depend on it struggle with it and often mess up (“I send you the private key to communicate privately, right?”), the activists who use it do so relatively spari…

Can you find a single practicing cryptographic engineer who will go on the record as saying that PGP (in any of its incarnations) and email is better than Signal Protocol for message encryption?

Re: 2017 Levchin Prize for Real World Cryptography

#22

Post by ethbro »

scandox wrote: post #14
justinpombrio wrote: post #13

Earlier quoted context omitted.

Moxie was contrasting the different perspectives that communist and fascist leaders had about what caused their success, for the purpose of an analogy. He was not contrasting communism with fascism. Please learn to distinguish the two.

I'm very clear in my comment: a. "The idea that communist leaders felt any different...". In other words "the different perspectives" they had about what caused their success. I do not believe they had different perspectives, except externally. b. I think it's pretty clear that Moxie favours what he perceives as the superior point of view of one group over the other and he reinforces that by himself clapping with the…

They're distinguishable at least by their respective utopian conclusions.

A ideological fascist utopia looks very different than a communist one.

One may rightly gripe that in practice there is no difference, or that those in the respective governments did not believe in the ideas they espoused and instead worked towards different ends.

But I can't believe that 100% of those following the ideologies ignored their tenets.

Re: 2017 Levchin Prize for Real World Cryptography

#23

Post by ethbro »

tptacek wrote: post #21
Unman wrote: post #18

While applauding the stated mission of Open Whisper Systems to make cryptography usable by large numbers of people I think it is fair to hold Moxie & Co. to the same high standards to which they held PGP: https://moxie.org/blog/gpg-and-me/ The journalists who depend on it struggle with it and often mess up (“I send you the private key to communicate privately, right?”), the activists who use it do so relatively spari…

Can you find a single practicing cryptographic engineer who will go on the record as saying that PGP (in any of its incarnations) and email is better than Signal Protocol for message encryption?

If one is going to be paranoid, then one should at least be consistently paranoid.

v1 of the internet as used now seems wildly naive of state surveillance.

v2 may be better, but if most traffic goes encrypted, then there are going to be a lot more attacks (both legal and extra-legal) against the nuances of implementations.

v2 is certainly an improvement on v1. But one of the reasons v1 was deployed is because we believed things like "The US government would never tap traffic at the backbone" or "The US government would never tap private links between data centers."

Valuing both, I think it's important to keep eyes on the future so in 10 years we don't look back on statements like "The US government would never compell Google / Microsoft / Facebook / Whisper to distribute a poisoned version of their application" with the same amount of surprise.

Re: 2017 Levchin Prize for Real World Cryptography

#24

Post by kasey_junk »

tptacek wrote: post #21
Unman wrote: post #18

While applauding the stated mission of Open Whisper Systems to make cryptography usable by large numbers of people I think it is fair to hold Moxie & Co. to the same high standards to which they held PGP: https://moxie.org/blog/gpg-and-me/ The journalists who depend on it struggle with it and often mess up (“I send you the private key to communicate privately, right?”), the activists who use it do so relatively spari…

Can you find a single practicing cryptographic engineer who will go on the record as saying that PGP (in any of its incarnations) and email is better than Signal Protocol for message encryption?

Can you give the 5 cent description of why Signal would be preferred to encrypted email?

Re: 2017 Levchin Prize for Real World Cryptography

#25

Post by tptacek »

kasey_junk wrote: post #24
tptacek wrote: post #21

Earlier quoted context omitted.

Can you find a single practicing cryptographic engineer who will go on the record as saying that PGP (in any of its incarnations) and email is better than Signal Protocol for message encryption?

Can you give the 5 cent description of why Signal would be preferred to encrypted email?

Signal is a system designed always to be encrypted with no plaintext opt-out, with secrets that change automatically over the life of a conversation (which could last years) so that a single point-in-time loss of secrecy has minimized damage, with no exposed message metadata so you can't accidentally betray your conversation with a dumb subject line, and with deniability so that someone wiretapping you can't cryptographically prove you to have said anything.

PGP and email is essentially the opposite.

Re: 2017 Levchin Prize for Real World Cryptography

#26

Post by tptacek »

ethbro wrote: post #23
tptacek wrote: post #21

Earlier quoted context omitted.

Can you find a single practicing cryptographic engineer who will go on the record as saying that PGP (in any of its incarnations) and email is better than Signal Protocol for message encryption?

If one is going to be paranoid, then one should at least be consistently paranoid. v1 of the internet as used now seems wildly naive of state surveillance. v2 may be better, but if most traffic goes encrypted, then there are going to be a lot more attacks (both legal and extra-legal) against the nuances of implementations. v2 is certainly an improvement on v1. But one of the reasons v1 was deployed is because we beli…

I don't understand what this has to do with whether we should use risky, leaky cryptosystems like PGP over things like Signal that were designed specifically to deal with these threats.

Re: 2017 Levchin Prize for Real World Cryptography

#27

Post by ethbro »

tptacek wrote: post #26
ethbro wrote: post #23

Earlier quoted context omitted.

If one is going to be paranoid, then one should at least be consistently paranoid. v1 of the internet as used now seems wildly naive of state surveillance. v2 may be better, but if most traffic goes encrypted, then there are going to be a lot more attacks (both legal and extra-legal) against the nuances of implementations. v2 is certainly an improvement on v1. But one of the reasons v1 was deployed is because we beli…

I don't understand what this has to do with whether we should use risky, leaky cryptosystems like PGP over things like Signal that were designed specifically to deal with these threats.

I'd agree with the top of Unman's comment about striving for more, while disagreeing with the bottom.

Signal is better than PGP.

Running crypto without PFS in this threat environment is an irresponsible bet to make with data.

My point was that failing to continue to maintain vigilance, even if it sounds paranoid, is also irresponsible. Unless one is willing to be that we have a perfect crypto system, some amount of humility (as evidenced by Moxie's speech) is warranted. Else we'll be talking about Signal in 20 years in the same way we're talking about PGP.

Re: 2017 Levchin Prize for Real World Cryptography

#28

Post by yan »

leafpile wrote: post #19
niftich wrote: post #5

Not OP, but I sense perhaps a limitation of HN; articles with comments where the comment is the submission get conflated with submissions about the article itself. (EDIT: the submission's URL has now been changed from a particular reddit comment at https://www.reddit.com/r/crypto/comments/5m0zpo/moxie_marlin... to a different announcement about the prize. The rest of my post as it originally stood follows.) Reproduci…

I first heard that applause story from Žižek (but it might not have originated with him?) https://www.youtube.com/watch?v=zvgl0Oy5wx8#t=13m33s

Moxie explicitly gave Zizek credit in his speech.
Post reply on HN