protonmail is a whole lot easier to use now that you only need 1 password instead of 2
Encrypted email is still a pain
231–240 of 450 posts
Re: Encrypted email is still a pain
#232Earlier quoted context omitted.
Harder to prevent access to, harder to wire-tap. As other people pointed out WhatsApp has been blocked in countries before. Not to mention that with WhatsApp having a central location all messages are routed through we really don't have any guarantee that there isn't a compromised actor in there intercepting everything. Even if WhatsApp's crytpo is as flawless in implementation as we'd like FB still has access to all…
> Even if WhatsApp's crytpo is as flawless in implementation as we'd like FB still has access to all that metadata. Note that this argument is even more problematic for OpenPGP-encrypted email, as such email sends all metadata and some message data in plaintext.
Note that this argument is even more problematic for OpenPGP-encrypted email, as such email sends all metadata and some message data in plaintext.
I ususally respect tptacek a lot but when it comes to Whatsapp I actively avoid it if at all possible, preferring Telegram even if the crypto is more than questionable. Same goes for mail: I prefer it - even unencrypted - over Whatsapp.
For some of us our treat model is more concerned about Facebook and less about major TLAs.
With Whatsapp I have to expect that all metadata about me - and my friends - are fed into Facebook and datamined from here to eternity and back again or until the end of the world as we know it.
I have little to hide but given the catastrophically bad ad targeting of Facebook (yes, I am still a happily married father, a Java developer, a Norwegian. I don't need ANY more ads for dating websites until I specifically change my profile to let you know, THANK YOU. I would be happy to learn about useful developer tools or underrated fast food restaurants though. I also appreciated the uber ad with bundled coupon in google maps a few weeks ago and tested uber for the first time.)
Given the same catastrophically bad targeting and given that it is the same owner who as far as I know hasn't yet apologised for his remarks about how trusting him was stupid it wouldn't surprise me if is more a WHEN than a IF that Facebook is going to sell everyones data to insurance companies, support scam call centers etc.
Re: Encrypted email is still a pain
#233Earlier quoted context omitted.
> No, I fully understand the problem. If Google Mail vanished tomorrow, a pretty large number of people would probably stop emailing altogether. The number of people for whom that's true increases every year. I highly doubt that's true. Email is pretty essential to the functionality of the internet, from signing up accounts to getting notifications, to just plain discussions with professionals. It's pretty much the o…
Three responses: * Email remains important for middle-class Americans because it's used for business. But that is a small subset of the whole population, including very large numbers of Americans. * For almost all those users, email might as well be a Google, Yahoo, or Microsoft product. * Every year, the number of people and businesses that rely on email gets smaller --- in the last 5 years or so, by something like…
> * Email remains important for middle-class Americans because it's used for business. But that is a small subset of the whole population, including very large numbers of Americans.
Middle class Westerners (not only Americans by any mean) that are doing business are also pretty much the only ones that are willing to spend money on written communication. E-mail might not be on the rise, but I'd guess it grosses way more money than all IM platforms together.
Re: Encrypted email is still a pain
#234Encrypted email is pretty much over in 2017. The emerging consensus among experts is that it's not worth the trouble, or, worse, incapable of doing much more than generating a false sense of security. That's for a bunch of reasons: * An enormous installed base of clients that won't do encryption, meaning that at best you're attempting to tunnel encrypted messaging over an unencrypted transport. * A protocol that leak…
> The emerging consensus among experts "conseunsus"? a few blog posts about some bad user experience with GnuPG / the PGP ecosystem is, at best, just an (re)emerging topic on HN, not the end of email encryption. OpenPGP implementations may not be the easiest encryption software out there (its usability issues have been discussed for two decades now) but that's simply because PGP was not designed to be used by the lai…
Why use PGP anymore when you can use Keybase and the next generation of key management?
Instead of having one master key for your identity, the paradigm is changed:
Identity is a set of claims "X on domain A is Y on domain B". That's it.
"Domain" can refer to a server-based service such as reddit, or a client app on a device.
Such proofs are easy:
1) For public identity on sites which don't support this scheme, X simply signs something with their private key for A, and posts it on A at a URL only they control (such as an About page or a Facebook post). Presumably, X and A had to cooperate to do that. Now, to prove "you are X on A", you simply claim your your identity and the url to check, and sign it with the same private key. The verification proceeds by checking the https url for the actual claim. You hold that key. If A wants to revoke your identity proof, they just delete it from eg your profile. Each site A has to be supported individually by the client lib though, because "urls you control" are different on each site.
2) For private identity on sites that cooperate, there is a huge variety of things you could do. Everything from oAuth 2, to the signature scheme above, except the user id X on A can be different for each relying party B.
So the claim "X[B] on A is Y on B" is a private claim - others can verify it only if they identify themselves as B (eg X must be logged into A and using https on A and B and doing cross-domain communication using iframes).
They can't satisfy these conditions unless they spoof B's SSL certificate and trick X into visiting their site via a poisoned DNS. And in that case they can just find out that X is X[B] on A. Very limited privacy leak. They still can't decrypt or sign anything as X on A.
This is the scheme anyone can implement and use. It should be standardized IMHO somewhere.
Re: Encrypted email is still a pain
#235Encrypted email is pretty much over in 2017. The emerging consensus among experts is that it's not worth the trouble, or, worse, incapable of doing much more than generating a false sense of security. That's for a bunch of reasons: * An enormous installed base of clients that won't do encryption, meaning that at best you're attempting to tunnel encrypted messaging over an unencrypted transport. * A protocol that leak…
> But: why bother? Email is just one of dozens of messaging systems available to Internet users. No, it's not. It's the only widely available, decentralized system, with which you can send to anyone, if you know the address. None of the big ones is this open. XMPP tried to address this and failed; now Matrix is trying again.
> XMPP tried to address this and failed
XMPP aint't dead yet ;)
Re: Encrypted email is still a pain
#236Earlier quoted context omitted.
> In modern messaging protocols, they don't have to care about encryption. The protocols are designed to reliably encrypt messages without user intervention, and security isn't "opt-in". Sounds good. Doesn't sound worth giving up decentralisation for. Doesn't even seem like something we'd need to give up OpenPGP to get - if client design were equal (and it isn't at the moment, but I see no reason it can't be) I'd far…
There are also people that use OpenOffice on Desktop Linux, and believe in their bones that everyone else should too.
I sometimes preferred it even on Windows and even when I have a valid office subscription.
Some people really manage to mess up styles and Open or LibreOffice used to make it much easier to clean up those docs. (I'd switch back to get page numbers right though :-/)
Re: Encrypted email is still a pain
#237Earlier quoted context omitted.
> Even if WhatsApp's crytpo is as flawless in implementation as we'd like FB still has access to all that metadata. Note that this argument is even more problematic for OpenPGP-encrypted email, as such email sends all metadata and some message data in plaintext.
Note that this argument is even more problematic for OpenPGP-encrypted email, as such email sends all metadata and some message data in plaintext. I ususally respect tptacek a lot but when it comes to Whatsapp I actively avoid it if at all possible, preferring Telegram even if the crypto is more than questionable. Same goes for mail: I prefer it - even unencrypted - over Whatsapp. For some of us our treat model is mo…
I agree with not using WhatsApp due to it's ties to FB and metadata issues, but Telegram is arguably even worse. They've been (rightfully) panned for implementing their own crypto and doing it poorly. You should be using Signal on a phone if you're trying to use a secure messenger.
Re: Encrypted email is still a pain
#238A client's admin sends credentials via email - including logins and passwords for mission critical infrastructure. When asking him about security concerns he said: "Our mail server's using HTTPS, everything is secure"
I haven't responded to that.
Re: Encrypted email is still a pain
#239Earlier quoted context omitted.
I feel like Matrix may be the way forward; it also looks like it's possible to build an email-like interface on top of it. But currently, federated Matrix leaks metadata, so that's a problem.
Agree about Matrix. You get addresses such as @username:example.com , which work somewhat like email addresses. The example.com part is the homeserver, analogous to gmail.com or yahoo.com in emails. Users can communicate across homeservers. It's also fast to setup. Took me about 30 minutes to set up a homeserver and host a customized riot client to use it. It's not completely decentralized yet, and you can only use f…
Just to clarify: identity servers are strictly optional and are used just for mapping 3rd party IDs (3PIDs) such as phone numbers and email addresses to matrix IDs so you can be discovered or discover other users by 3PID.
They are only centralised atm because we haven't really started to attack the problem of decentralising them. What we really need is a decentralised equivalent of Keybase, but nobody has really built a suitable one yet. Blockstack is close, as are a few others, but we'd rather wait until we found something which nailed the problem and stuck with the jury-rig until then. I spoke about this at FOSDEM the other weekend: https://fosdem.org/2017/schedule/event/matrix_future/
There's also renewed community interest in fixing this over the last few days: #matrix-identity:matrix.org is a thing.
I would argue that Matrix itself is fully decentralised; it's just that some of the solutions to the optional identity discovery problem happen to be centralised. Just as some folks publish their Matrix E2E pubkeys on keybase etc.
In terms of Matrix revealing metadata: yes, it does so to the servers participating in the convo. This is really not very unusual; the problem of protecting metadata for realtime comms is very much still an open area of research (see Alpenhorn etc from CSAIL)! Hopefully it's not really a reason to turn anyone off Matrix though. I also briefly spoke about this at FOSDEM: https://fosdem.org/2017/schedule/event/encrypting_matrix/
Re: Encrypted email is still a pain
#240What I find most frustrating when it comes to GPG encryption and email is the lack of support for public key encryption for generated mails. I've seen very few sites supporting GPG and if they did, I found it always just worked and I imaging not much of a big deal to setup. So why do even the biggest shops not offer this? I really would like to be able to upload my public key to e.g. Amazon. It's great to make the checkout process and everything super secure, but just to send every purchase you did and your personal data in an unencrypted mail across the web afterwards.