131–140 of 450 posts
Earlier quoted context omitted.
If you are an active target of a tier 1 state, your endpoint will be compromised, your decrypted communication will be read, and no cryptosystem will prevent this.
And if you were aware that a state-level actor is targeting you, you'd be using a programmable, self-contained HSM for all sensitive computation. This is a topic I'm working on actually.
Earlier quoted context omitted.
And if you were aware that a state-level actor is targeting you, you'd be using a programmable, self-contained HSM for all sensitive computation. This is a topic I'm working on actually.
You mis-spelled "iphone."
The site does not use HTTPS (TLS) so that public key is completely useless.
Is a TLA going to MITM all connections to incoherency.co.uk in order to read OpenGPG-encrypted mails? That's not very realistic.
I'm not saying that the way the key is being distributed is perfect, but I wouldn't say it's "completely useless".
Earlier quoted context omitted.
Google's embrace-extend-extinguish destroyed XMPP. They made their chat system XMPP compatible for a short time which caused many people to swap to their solution. When they ended support, most users simply stopped using XMPP.
Did you also notice that Google's messaging system pretty much died out around that point in favor of Skype and similar? I used to see people mention GTalk all the time, but I haven't seen anything similar in years. No one has mentioned G+ or Allo. That decision by Google may have been the thing that killed its user base.
its not just gpg and mail encryption, this sort of experience describes a lot of tools - and not too long ago just installing linux was a considerably worse nightmare of usability fails than this (it has greatly improved, i'm happy to say)
Encrypted email is pretty much over in 2017. The emerging consensus among experts is that it's not worth the trouble, or, worse, incapable of doing much more than generating a false sense of security. That's for a bunch of reasons: * An enormous installed base of clients that won't do encryption, meaning that at best you're attempting to tunnel encrypted messaging over an unencrypted transport. * A protocol that leak…
Signal and Whatsapp are not a solution for everything and will certainly not replace email.
Earlier quoted context omitted.
That's exactly the point. Take a step back and think about what you just said. It's true: most people don't care about crypto. But here's are two other true statements: * In modern messaging protocols, they don't have to care about encryption. The protocols are designed to reliably encrypt messages without user intervention, and security isn't "opt-in". * The people who most need encryption are not the ones who are m…
> In modern messaging protocols, they don't have to care about encryption. The protocols are designed to reliably encrypt messages without user intervention, and security isn't "opt-in". Sounds good. Doesn't sound worth giving up decentralisation for. Doesn't even seem like something we'd need to give up OpenPGP to get - if client design were equal (and it isn't at the moment, but I see no reason it can't be) I'd far…
Earlier quoted context omitted.
> at best you're attempting to tunnel encrypted messaging over an unencrypted transport. That covers pretty much all communication encryption: ultimately, encrypted data goes out over an unencrypted link. > A protocol that leaks metadata, including some message content, at the envelope layer. That is indeed the major problem I have with it. > Hundreds of millions of users that primarily access messages through browse…
>I think that one's home computers can probably handle the load of searching all of one's own data. You seem to be implying that I have one computer at home. I mostly use the computer in my pocket, but sometimes I use "my" computer in "My office" at home. Sometimes I use "my wife's computer". Many people I know have a computer attached to their tv. I'm looking into putting a computer in my garage. Someday I'm likely…
I used to do this with Owncloud, and Sandstorm has done some cool work in this field, though ISP's of course make it challenging. Also, it does raise the risk of everyone contributing to massive botnets.
Earlier quoted context omitted.
If you are an active target of a tier 1 state, your endpoint will be compromised, your decrypted communication will be read, and no cryptosystem will prevent this.
Furthermore, if you're using PGP to evade a state-level adversary, the odds are overwhelming that you've own-goaled yourself many times over: * You keep plaintext archives and drafts of your messages, because that's a fundamental feature of email clients going back 3 decades. * You use a server-mediated PGP provider like Protonmail that has your security one surreptitious Javascript injection on an XHR call away from…
No it's not, you don't have to keep it at all or in plaintext and it's irrelevant for new clients supporting encryption, their UX have to be redesigned anyway. So it's a UX issue at most.
"Your peer accidentally forgot to encrypt a response and quoted your own plaintext back to you."
Again, just a UX issue. Although all messaging apps actually have incentives to provide a UX that lets them spy on most people's communications or be open to add that possibility some time in the future.
"that has your security one surreptitious Javascript injection on an XHR call away from complete collapse"
This is a problem of centralization that you are trying to ignore and none of those messaging apps can solve it. Any centralized system is one tiny change away from a complete collapse. It can also be shut down by the state just to force people to use plaintext or backdoored alternatives. The problem is even bigger than it looks, even if you make a completely decentralized protocol there will still be incentives to centralize as much of it as possible to make money and still leave a strategic possibility to spy on everyone also for money. Makes sense?
Earlier quoted context omitted.
That's exactly the point. Take a step back and think about what you just said. It's true: most people don't care about crypto. But here's are two other true statements: * In modern messaging protocols, they don't have to care about encryption. The protocols are designed to reliably encrypt messages without user intervention, and security isn't "opt-in". * The people who most need encryption are not the ones who are m…
> In modern messaging protocols, they don't have to care about encryption. The protocols are designed to reliably encrypt messages without user intervention, and security isn't "opt-in". Sounds good. Doesn't sound worth giving up decentralisation for. Doesn't even seem like something we'd need to give up OpenPGP to get - if client design were equal (and it isn't at the moment, but I see no reason it can't be) I'd far…
Also, given how PGP works I fail to see how you can claim that you can achieve comparable client design/ease of use/UX to Signal.
At the very least it appears evident to me that the problem is much much harder than Signal (and it should be, Signal was designed from the ground up with UX in mind, and made several important trade offs for it).