Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

CrypTweet: Strong Encryption for Twitter DMs

news.ycombinator.com

Post reply on HN
Print view View original

11–20 of 24 posts

Re: CrypTweet: Strong Encryption for Twitter DMs

#11

Post by ZenPsycho »

ilikepi wrote: post #9
ZenPsycho wrote: post #4

Earlier quoted context omitted.

sure good idea. Oh wait I was just shot in the face while I was distracted staring at my phone for 20 minutes figuring out how to do that.

Please describe a realistic scenario in which all of the following are true: 1) You are in imminent danger of being "shot in the face" or similarly harmed; 2) Your best means of salvation from (1) is communication via Twitter DM; 3) The absence of a means in which your message could be encrypted on the client side beyond the HTTPS connection to Twitter's servers would significantly increase the chance of (1). This is…

Protests in which you are faced with policemen who have guns, and your survival depends on efficiently communicating and organising 1) without police intercepting your messages 2) without your communications being held as evidence against you in prosecution

Re: CrypTweet: Strong Encryption for Twitter DMs

#12

Post by ZenPsycho »

mjdwitt wrote: post #8
ZenPsycho wrote: post #5

Earlier quoted context omitted.

I think you are discounting the level of thought and care that went into this. Meh, fail.

The level of care and thought put into creating a secure encryption scheme doesn't matter if the cryptography is broken. There's a reason you constantly hear cryptographers telling everyone to never invent their own crypto-systems; it's extremely difficult to do right.

so copy pasting PGP is somehow getting it right?

Re: CrypTweet: Strong Encryption for Twitter DMs

#13

Post by waitwhat »

ZenPsycho wrote: post #11
ilikepi wrote: post #9

Earlier quoted context omitted.

Please describe a realistic scenario in which all of the following are true: 1) You are in imminent danger of being "shot in the face" or similarly harmed; 2) Your best means of salvation from (1) is communication via Twitter DM; 3) The absence of a means in which your message could be encrypted on the client side beyond the HTTPS connection to Twitter's servers would significantly increase the chance of (1). This is…

Protests in which you are faced with policemen who have guns, and your survival depends on efficiently communicating and organising 1) without police intercepting your messages 2) without your communications being held as evidence against you in prosecution

1) https://twitter.com/ (and if someone can do a MITM on that, they can also do it on your cryptweet server)

2) environments where "your survival depends on efficiently communicating and organising" tend to ignore habeus corpus and standards of evidence. Realistically, your survival depends on external factors (your side winning) rather than hoping you and everyone you've been communicating with can withstand torture indefinitely.

2b) digitally signing a message reduces plausible deniability

Re: CrypTweet: Strong Encryption for Twitter DMs

#14

Post by stephen_mcd »

ZenPsycho wrote: post #12
mjdwitt wrote: post #8

Earlier quoted context omitted.

The level of care and thought put into creating a secure encryption scheme doesn't matter if the cryptography is broken. There's a reason you constantly hear cryptographers telling everyone to never invent their own crypto-systems; it's extremely difficult to do right.

so copy pasting PGP is somehow getting it right?

Parent made no mention of PGP, only that care and thought are meaningless if the crypto is flawed, which from the looks of some of the more knowledgable commenters, is the case.

It's understandable that you have a personal obligation to defend your friend, but it really isn't necessary. Sit back, relax, and allow the author to reflect on the constructive feedback here.

Re: CrypTweet: Strong Encryption for Twitter DMs

#15

Post by true_religion »

ZenPsycho wrote: post #11
ilikepi wrote: post #9

Earlier quoted context omitted.

Please describe a realistic scenario in which all of the following are true: 1) You are in imminent danger of being "shot in the face" or similarly harmed; 2) Your best means of salvation from (1) is communication via Twitter DM; 3) The absence of a means in which your message could be encrypted on the client side beyond the HTTPS connection to Twitter's servers would significantly increase the chance of (1). This is…

Protests in which you are faced with policemen who have guns, and your survival depends on efficiently communicating and organising 1) without police intercepting your messages 2) without your communications being held as evidence against you in prosecution

You probably should have sat down and figured out how to encrypt your communications beforehand.

Ofcourse it'd be great if twitter did the job for you, but I don't necessarily see why it ought to be Twitters position to fulfill this edge case rather than say a protester who knows they are about to go into a life threatening scenario and need to organize--both beforehand and during the escapade.

Re: CrypTweet: Strong Encryption for Twitter DMs

#16

Post by ZenPsycho »

true_religion wrote: post #15
ZenPsycho wrote: post #11

Earlier quoted context omitted.

Protests in which you are faced with policemen who have guns, and your survival depends on efficiently communicating and organising 1) without police intercepting your messages 2) without your communications being held as evidence against you in prosecution

You probably should have sat down and figured out how to encrypt your communications beforehand. Ofcourse it'd be great if twitter did the job for you, but I don't necessarily see why it ought to be Twitters position to fulfill this edge case rather than say a protester who knows they are about to go into a life threatening scenario and need to organize--both beforehand and during the escapade.

I don't see how anyone has implied that twitter is responsible for anything.

Re: CrypTweet: Strong Encryption for Twitter DMs

#17

Post by mike-cardwell »

ZenPsycho wrote: post #11
ilikepi wrote: post #9

Earlier quoted context omitted.

Please describe a realistic scenario in which all of the following are true: 1) You are in imminent danger of being "shot in the face" or similarly harmed; 2) Your best means of salvation from (1) is communication via Twitter DM; 3) The absence of a means in which your message could be encrypted on the client side beyond the HTTPS connection to Twitter's servers would significantly increase the chance of (1). This is…

Protests in which you are faced with policemen who have guns, and your survival depends on efficiently communicating and organising 1) without police intercepting your messages 2) without your communications being held as evidence against you in prosecution

XMPP+OTR

Re: CrypTweet: Strong Encryption for Twitter DMs

#18

Post by m3owzers »

Nice initial attempt. Besides the encryption issues mentioned here, here's my suggestion. This needs to be built into a mobile twitter application (non-jailbreak), I use pgp encryption/decryption programs on my iPhone and they are fast. Also, you should allow the use of any key server that the user wants, as known public key server access can be blocked by a country.

Re: CrypTweet: Strong Encryption for Twitter DMs

#19

Post by nickmerwin »

We built something very similar a couple years ago except all encryption/decryption is done broswer side, so no keys are ever sent through our server. Also, it uses actual tweets as opposed to DM's.

http://cryptwit.com

You can see an example here:

http://cryptwit.com/decrypt

Enter "yickster", then passphrase "hackernews"

Re: CrypTweet: Strong Encryption for Twitter DMs

#20

Post by [deleted] »

ZenPsycho wrote: post #4
ComputerGuru wrote: post #3

Are you serious? If you need secure messaging, surely you have other options than twitter? Just copy and paste a PGP encrypted message to pastebin.ca and and tweet the link, if you must.

sure good idea. Oh wait I was just shot in the face while I was distracted staring at my phone for 20 minutes figuring out how to do that.

[deleted]
Post reply on HN