Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

PGP: There’s Life in the Old Dog Yet

blog.whiteout.io

Post reply on HN
Print view View original

21–30 of 79 posts

Re: PGP: There’s Life in the Old Dog Yet

#21

Post by felixhammerl »

eukaryotia wrote: post #8
zby wrote: post #7

Addressing the Moxie Marlinspike post - PGP being flexible and comprehensive is not the problem. The implementations/libraries (including GPG) being a fossil from last century are. From my own experience I can say that the libraries are not well designed - they couple things together (like key management and decryption) and make some things hard to do even if they are conceptually simple (like checking a signature wi…

>You need a comprehensive fundations to base on these experiments on. The problem is that people build this huge, powerful libraries, but nobody seems to write the "limiting" libraries that take a subset of the powerful base library and create an easy to use experience from the user. I suppose this largely stems from "implicit knowledge": People who can write cryptography apps likely know enough crypto that they can'…

you are mixing two problems:

1) libraries are often too complex for the avg dev: well, crypto is complex and there is rarely a one-size-fits-all solution. however, there are high level APIs that address your issues in openpgp.js (https://github.com/openpgpjs/openpgpjs). problem is that a lot of people try to roll their own crypto if the library does not offer those high level #box() and #unbox() functions. and THAT is a real problem down the road.

2) lack of empathy is really a big problem, which I've articulated here: https://blog.whiteout.io/2015/01/29/why-alice-has-a-problem-...

Re: PGP: There’s Life in the Old Dog Yet

#22

Post by thefreeman »

lstepniewski wrote: post #20

"We make the client available on all relevant platforms, desktop, Chromebook, Android, iOS, Windows phone." And on the https://whiteout.io/ website: Chromebook, Android, iOS, Web, Windows and Firefox OS. So no Linux version at all??? Isn't Linux a relevant platform?

It's not "Chromebook" it's Chrome App (aka extension). So it runs in any (non-mobile) Chrome browser.

Re: PGP: There’s Life in the Old Dog Yet

#23

Post by celticninja »

prohor wrote: post #14

On thing that always wonders me. Assuming NSA or whatever spying agency is sniffing mail in the Internet, I'm pretty sure that once you use PGP, you are basically a strong suspect for them. Obviously the situation would be different if mail was encrypted by default, but now such people just stand out. Not sure if this is a situation I want to be in...

they have openly said that people who use encryption are of interest to them, or at least their communications are. however this is easily solved if there is wide enough adoption. If I encrypt the shopping list that I send to my other half, or I encrypt the text messages i send siblings or any text communication to anyone, and there are 100's of 1000's who do the same it becomes impossible to store/monitor and decrypt all that information. it would essentially overwhelm them with data, which even if they managed to decrypt (through the theft of private keys or a serious brute force attack) would be of no value other than to prove the task a waste of time.

Re: PGP: There’s Life in the Old Dog Yet

#24

Post by mbel »

lstepniewski wrote: post #20

"We make the client available on all relevant platforms, desktop, Chromebook, Android, iOS, Windows phone." And on the https://whiteout.io/ website: Chromebook, Android, iOS, Web, Windows and Firefox OS. So no Linux version at all??? Isn't Linux a relevant platform?

OS X is also missing, isn't OS X a relevant platform?

Of course both are relevant, they just went for the most popular platforms first, plus FF OS, which probably was a kind of low handing fruit due to its HTML5 apps.

Re: PGP: There’s Life in the Old Dog Yet

#25

Post by TomMasz »

I have Exchange/Outlook (w/Gpg4Win) at work and OS X Mail w/GPGTools) at home. I can't send GPG signed/encrypted emails between work and home. But I can with the S/MIME implementation built into Outlook (w/certificate from Comodo, hmmmm). Add-ons for email programs just don't seem to be the answer, at least so far.

Re: PGP: There’s Life in the Old Dog Yet

#26

Post by urda »

malgorithms wrote: post #9

Since Keybase inevitably comes up in these PGP conversations, 2 things in advance: 1. I've really been very slow in letting people into Keybase. The wait time is still 6 months (last night I was letting in people who asked back in August.) But now that we've added HackerNews key proofs, I'll let people in today who notice this post who have more than 1 karma and write "I'm HN: {theirusername}" in the request form. 2.…

Hey man I love Keybase so far, I'm really glad I finally got in a few weeks back. Keep up the good work!

Re: PGP: There’s Life in the Old Dog Yet

#27

Post by prohor »

celticninja wrote: post #23
prohor wrote: post #14

On thing that always wonders me. Assuming NSA or whatever spying agency is sniffing mail in the Internet, I'm pretty sure that once you use PGP, you are basically a strong suspect for them. Obviously the situation would be different if mail was encrypted by default, but now such people just stand out. Not sure if this is a situation I want to be in...

they have openly said that people who use encryption are of interest to them, or at least their communications are. however this is easily solved if there is wide enough adoption. If I encrypt the shopping list that I send to my other half, or I encrypt the text messages i send siblings or any text communication to anyone, and there are 100's of 1000's who do the same it becomes impossible to store/monitor and decryp…

Agree, if mail encryption becomes common, then it is completely different story.

Re: PGP: There’s Life in the Old Dog Yet

#28

Post by felixhammerl »

mbel wrote: post #24
lstepniewski wrote: post #20

"We make the client available on all relevant platforms, desktop, Chromebook, Android, iOS, Windows phone." And on the https://whiteout.io/ website: Chromebook, Android, iOS, Web, Windows and Firefox OS. So no Linux version at all??? Isn't Linux a relevant platform?

OS X is also missing, isn't OS X a relevant platform? Of course both are relevant, they just went for the most popular platforms first, plus FF OS, which probably was a kind of low handing fruit due to its HTML5 apps.

the chrome app will run both on linux and mac os. and windows. and the chromebook. same does the web app. one of the marvels of the modern web :)

Re: PGP: There’s Life in the Old Dog Yet

#29

Post by ukigumo »

Assuming you have access to your mail server to make the necessary configurations, wouldn't something like ciphermail's (https://www.ciphermail.com/) pgp /smime gateway make it easy for joe user to have encrypted email?

I've used it in my own setup and think it works quite nicely so far but then again I only have 8 people using it.

Re: PGP: There’s Life in the Old Dog Yet

#30

Post by tomjen3 »

malgorithms wrote: post #9

Since Keybase inevitably comes up in these PGP conversations, 2 things in advance: 1. I've really been very slow in letting people into Keybase. The wait time is still 6 months (last night I was letting in people who asked back in August.) But now that we've added HackerNews key proofs, I'll let people in today who notice this post who have more than 1 karma and write "I'm HN: {theirusername}" in the request form. 2.…

I hadn't really heard about keybase yet, but does it solve the only problem worth solving in encryption? Does it allow me to take any email address and give me back a private key that only the recipient can use?

If I wanted to know which public key to use I would just look at the recipients public website or ask that person through a phone.

The problem is that people don't create keys because nobody ever send them anything encrypted and people don't send anything encrypted because nobody ever sends anything encrypted.

But if keybase is just another storage for keys, what is the point? Especially if it is going to add a pointless waiting list that is just going to make the problem of not having a key even worse.

Post reply on HN