PGP: There’s Life in the Old Dog Yet
blog.whiteout.io
PGP: There’s Life in the Old Dog Yet
1–10 of 79 posts
Re: PGP: There’s Life in the Old Dog Yet
#2Is anybody working on making identity-based encryption mainstream?
Re: PGP: There’s Life in the Old Dog Yet
#3Is anybody working on making identity-based encryption mainstream?
Are you thinking of something like https://keybase.io/?
Re: PGP: There’s Life in the Old Dog Yet
#4Gosh. I like the concept, but the web site really needs more information and better design -- starting with whether this is a free or paid service.
Re: PGP: There’s Life in the Old Dog Yet
#5Quoting Dan Geer: "Convenience, freedom, security - choose two."
Solid cryptography concepts were never easy to implement and use.
My main problem lies not with the Gnu/PG or PGP software implementations, but with the actual platforms. Do I trust my iPhone/Android/public internet cafe computer/the family computer? Is it compromised? What about your computer manufacturer? Lenovo, perhaps? Or Apple?
The problem of information safety does go far beyond software. Neglecting this is not an option.
There is certainly life in the old dog called pgp, but I am yet to be convinced of a mass market software concept that allows me to have the same level of confidence in its security as the open source packages I have installed on my offline computer.
"The paranoid will survive."
Re: PGP: There’s Life in the Old Dog Yet
#6Is anybody working on making identity-based encryption mainstream?
IBE requires a trusted third parties to issue private keys to users. That's essentially the lavabit model with slicker math.
Re: PGP: There’s Life in the Old Dog Yet
#7Addressing the Moxie Marlinspike post - PGP being flexible and comprehensive is not the problem. The implementations/libraries (including GPG) being a fossil from last century are.
From my own experience I can say that the libraries are not well designed - they couple things together (like key management and decryption) and make some things hard to do even if they are conceptually simple (like checking a signature without first building a key-ring data structure with all keys from a file).
Progress comes from many experiments, going in all kinds of directions in UI design, infrastructure building etc. You need a comprehensive fundations to base on these experiments on.
Re: PGP: There’s Life in the Old Dog Yet
#8Addressing the Moxie Marlinspike post - PGP being flexible and comprehensive is not the problem. The implementations/libraries (including GPG) being a fossil from last century are. From my own experience I can say that the libraries are not well designed - they couple things together (like key management and decryption) and make some things hard to do even if they are conceptually simple (like checking a signature wi…
>You need a comprehensive fundations to base on these experiments on.
The problem is that people build this huge, powerful libraries, but nobody seems to write the "limiting" libraries that take a subset of the powerful base library and create an easy to use experience from the user.
I suppose this largely stems from "implicit knowledge": People who can write cryptography apps likely know enough crypto that they can't themselves identify usability problems.
Re: PGP: There’s Life in the Old Dog Yet
#9Since Keybase inevitably comes up in these PGP conversations, 2 things in advance:
1. I've really been very slow in letting people into Keybase. The wait time is still 6 months (last night I was letting in people who asked back in August.) But now that we've added HackerNews key proofs, I'll let people in today who notice this post who have more than 1 karma and write "I'm HN: {theirusername}" in the request form.
2. We're not just about PGP keys. It looks that way now, and our first goal was to help solve the very on-the-record type things developers do. Which mostly requires PGP - and PGP is very good at. Signing code and commits, releasing software, etc. But sometime soon each of your Keybase devices will have a device-specific Nacl key, for example. And the process for provisioning devices is something we're taking very seriously - we'll soon have a big blog post about how public sibling key announcements will work. Here's the foreshadowing: with a Keybase account, very soon you'll be able to start with something as simple as a Twitter or HN username, and do some very cool, secure things with files and messages.
[EDIT] We are hiring. There's no specific job page because we've mostly been reaching out to people quietly, but we want help building: the Keybase client (Go), iOS and OSX GUIS (Obj-C), and the site (front end development and back end (Node)). Please reach out to me (chris@keybase) if you like the idea of working on usable security software. We are currently distributed in NYC, SF, and CHI, and ideally you'd work with us in one of these offices.
Re: PGP: There’s Life in the Old Dog Yet
#10Is it possible to have a PGP-powered layer that requires close to no setup from the end user?
This seems to be the issue, and until the encryption is, in effect, totally invisible to the average person on the street, I'm not sure we'll see widespread deployment.