291–300 of 450 posts
Keybase, Nylas mail plugin. Done. or GPG Tools beta, Mail app, done. or even just the Keybase built in encrypt/decrypt.
Earlier quoted context omitted.
EFF has criticized WhatsApp for being closed source, but not for this particular aspect of the key exchange functionality. Because of the history around how WhatsApp was criticism over this and some of the apparent results of that criticism, tptacek particularly doesn't want people to conflate "there is something bad, unfortunate, or inadequate about WhatsApp" with "WhatsApp has a 'backdoor' in its key exchange" (and…
> EFF has criticized WhatsApp for being closed source, but not for this particular aspect of the key exchange functionality. The articles I've seen appeared carefully worded so as to achieve some balance, but did express some criticism and concern. "Nevertheless, this is certainly a vulnerability of WhatsApp, and they should give users the choice to opt into more restrictive Signal-like defaults." from: https://www.e…
Earlier quoted context omitted.
> After that point, it's possible that others you are trying to communicate with might be within your web of trust. The problem with the web of trust is that it simply doesn't work: the fact that I know you means nothing about whether I trust you to vouch for others. The fact that I trust you to vouch for employees of Acme Widgets means nothing about whether I trust you to vouch for members of the a political party.…
> The problem with the web of trust is that it simply doesn't work: the fact that I know you means nothing about whether I trust you to vouch for others. Actually it means a lot. That's how trust works in the real world as well.
Encrypted email is pretty much over in 2017. The emerging consensus among experts is that it's not worth the trouble, or, worse, incapable of doing much more than generating a false sense of security. That's for a bunch of reasons: * An enormous installed base of clients that won't do encryption, meaning that at best you're attempting to tunnel encrypted messaging over an unencrypted transport. * A protocol that leak…
> But: why bother? Email is just one of dozens of messaging systems available to Internet users. No, it's not. It's the only widely available, decentralized system, with which you can send to anyone, if you know the address. None of the big ones is this open. XMPP tried to address this and failed; now Matrix is trying again.
This is a real problem that hasn't been solved, and because it hasn't the world has moved on.
Earlier quoted context omitted.
> Nobody has completely nailed the UX for long-term long-form conversations, but services like Signal are designed with those kinds of conversations in mind. No, they're actually not designed with any kind of "long termness" in mind! Case in point - one cannot move to a new device and still have access to conversations that happened on the older device with Signal. All old conversations just have to die with the old…
Also, no way to have multiple separate conversations with the same person, or threaded conversations. These may just be app problems -- there may be protocol support for future applications to provide these (this is where Matrix stands today). But the lack of interest in these things doesn't look good.
Encrypted email is pretty much over in 2017. The emerging consensus among experts is that it's not worth the trouble, or, worse, incapable of doing much more than generating a false sense of security. That's for a bunch of reasons: * An enormous installed base of clients that won't do encryption, meaning that at best you're attempting to tunnel encrypted messaging over an unencrypted transport. * A protocol that leak…
The way to do it is to have it be a standard feature of the email client. Your client, if it supports it, generates the public/private key automatically. Every time it sends an email, it includes the public key. Every time it receives an email, it stores the received public key if there is one. Every time an email is sent, it encrypts it automatically if the address book has the public key. Over time, it will work it…
Solve too many of those problems and you've invented PKI...
Earlier quoted context omitted.
> The emerging consensus among experts "conseunsus"? a few blog posts about some bad user experience with GnuPG / the PGP ecosystem is, at best, just an (re)emerging topic on HN, not the end of email encryption. OpenPGP implementations may not be the easiest encryption software out there (its usability issues have been discussed for two decades now) but that's simply because PGP was not designed to be used by the lai…
You know, I've been having this conversation ever since PGP first came into existence. And much as I love the idea of encryption, and despite having invested lots of time in arguing for the right to encrypt and to share encryption algorithms etc. etc. I've always had to admit that if you're not a geek who loves computing for its own sake then encrypting all your email is a massive pain in the ass, whose costs substan…
Earlier quoted context omitted.
> The emerging consensus among experts "conseunsus"? a few blog posts about some bad user experience with GnuPG / the PGP ecosystem is, at best, just an (re)emerging topic on HN, not the end of email encryption. OpenPGP implementations may not be the easiest encryption software out there (its usability issues have been discussed for two decades now) but that's simply because PGP was not designed to be used by the lai…
You know, I've been having this conversation ever since PGP first came into existence. And much as I love the idea of encryption, and despite having invested lots of time in arguing for the right to encrypt and to share encryption algorithms etc. etc. I've always had to admit that if you're not a geek who loves computing for its own sake then encrypting all your email is a massive pain in the ass, whose costs substan…
Earlier quoted context omitted.
This also raises the question: With a walled garden like Signal/Wire/etc, how do you get+trust the other's key? Their convenience comes at a cost.
There are mechanisms to use out of band communication to verify a key: https://github.com/WhisperSystems/Signal-iOS/wiki/FAQ#can-i-... https://support.wire.com/hc/en-us/articles/207692235-How-can...