PGP: There’s Life in the Old Dog Yet • Hacker News Board

Re: PGP: There’s Life in the Old Dog Yet

#31

Post by tomjen3 » Wed, Feb 25, 2015, 4:12 PM UTC

wuschel wrote: post #5

Quoting Dan Geer: "Convenience, freedom, security - choose two." Solid cryptography concepts were never easy to implement and use. My main problem lies not with the Gnu/PG or PGP software implementations, but with the actual platforms. Do I trust my iPhone/Android/public internet cafe computer/the family computer? Is it compromised? What about your computer manufacturer? Lenovo, perhaps? Or Apple? The problem of info…

I probably shouldn't go around and disagree with quotes from people I have never heard about, but there is no law that means encryption has to be ackward, user-unfriendly or badly designed.

Re: PGP: There’s Life in the Old Dog Yet

#32

Post by mayniac » Wed, Feb 25, 2015, 4:22 PM UTC

tomjen3 wrote: post #30

malgorithms wrote: post #9

Since Keybase inevitably comes up in these PGP conversations, 2 things in advance: 1. I've really been very slow in letting people into Keybase. The wait time is still 6 months (last night I was letting in people who asked back in August.) But now that we've added HackerNews key proofs, I'll let people in today who notice this post who have more than 1 karma and write "I'm HN: {theirusername}" in the request form. 2.…

I hadn't really heard about keybase yet, but does it solve the only problem worth solving in encryption? Does it allow me to take any email address and give me back a private key that only the recipient can use? If I wanted to know which public key to use I would just look at the recipients public website or ask that person through a phone. The problem is that people don't create keys because nobody ever send them an…

Easier PGP programs would increase the use of encryption, especially post-Snowden. I've walked people through using GPG4WIN/Kleopatra and it took a good half hour of explaining how everything works. People care about privacy, but unfortunately not enough to go through the hassle of manually encrypting everything.

Re: PGP: There’s Life in the Old Dog Yet

#33

Post by Retric » Wed, Feb 25, 2015, 4:26 PM UTC

tomjen3 wrote: post #31

wuschel wrote: post #5

Quoting Dan Geer: "Convenience, freedom, security - choose two." Solid cryptography concepts were never easy to implement and use. My main problem lies not with the Gnu/PG or PGP software implementations, but with the actual platforms. Do I trust my iPhone/Android/public internet cafe computer/the family computer? Is it compromised? What about your computer manufacturer? Lenovo, perhaps? Or Apple? The problem of info…

I probably shouldn't go around and disagree with quotes from people I have never heard about, but there is no law that means encryption has to be ackward, user-unfriendly or badly designed.

Can you name a single counterexample?

HTTPS: You can give up freedom and some security for convenience of 3rd party registrars! You can roll your own which is less convenient and likely less secure… Not really sure of the 3rd option here.

Re: PGP: There’s Life in the Old Dog Yet

#34

Post by tomjen3 » Wed, Feb 25, 2015, 4:28 PM UTC

Retric wrote: post #33

tomjen3 wrote: post #31

Earlier quoted context omitted.

I probably shouldn't go around and disagree with quotes from people I have never heard about, but there is no law that means encryption has to be ackward, user-unfriendly or badly designed.

Can you name a single counterexample? HTTPS: You can give up freedom and some security for convenience of 3rd party registrars! You can roll your own which is less convenient and likely less secure… Not really sure of the 3rd option here.

WhatsApp.

Re: PGP: There’s Life in the Old Dog Yet

#35

Post by Retric » Wed, Feb 25, 2015, 4:37 PM UTC

tomjen3 wrote: post #34

Retric wrote: post #33

Earlier quoted context omitted.

Can you name a single counterexample? HTTPS: You can give up freedom and some security for convenience of 3rd party registrars! You can roll your own which is less convenient and likely less secure… Not really sure of the 3rd option here.

WhatsApp.

WhatsApp fails freedom and arguably security.

Let's put things in context. Would you trust WhatsApp to be part of the US nuclear launch chain? Or talkes between the leaders of US, France, China, and North Korea.

Re: PGP: There’s Life in the Old Dog Yet

#36

Post by moxie » Wed, Feb 25, 2015, 4:39 PM UTC

I'm not really positioning TextSecure as a secure mail solution, but this article says that the TextSecure protocol can't support asynchronous operations or federated namespaces. To clarify, that's incorrect, the TextSecure protocol was actually designed from the ground up for asynchronous communication, and is designed to support a federated namespace: https://whispersystems.org/blog/asynchronous-security/

That leaves these points for PGP:

> It’s been around for a long time, so it’s cryptographically well understood.

Yes, but it's cryptographically well understood not to provide the properties we need.

> There are a variety of implementations and there is a small but vibrant and highly committed developer community. > A small but active and committed user community.

Small can't be emphasized enough, and this is the most important part to me. I think people have a tendency to look at PGP and conclude that while it might be painful, we have to put up with it for backwards compatibility. The truth is that it's a protocol with few contemporary redeeming qualities, and an active user base of ~50k. So why bother with backwards compatibility?

Re: PGP: There’s Life in the Old Dog Yet

#37

Post by zobzu » Wed, Feb 25, 2015, 4:42 PM UTC

moxie wrote: post #36

I'm not really positioning TextSecure as a secure mail solution, but this article says that the TextSecure protocol can't support asynchronous operations or federated namespaces. To clarify, that's incorrect, the TextSecure protocol was actually designed from the ground up for asynchronous communication, and is designed to support a federated namespace: https://whispersystems.org/blog/asynchronous-security/ That leav…

Still would like to see your source for the "50k active user base" claim.

Re: PGP: There’s Life in the Old Dog Yet

#38

Post by kgo » Wed, Feb 25, 2015, 4:43 PM UTC

tomjen3 wrote: post #30

malgorithms wrote: post #9

Since Keybase inevitably comes up in these PGP conversations, 2 things in advance: 1. I've really been very slow in letting people into Keybase. The wait time is still 6 months (last night I was letting in people who asked back in August.) But now that we've added HackerNews key proofs, I'll let people in today who notice this post who have more than 1 karma and write "I'm HN: {theirusername}" in the request form. 2.…

I hadn't really heard about keybase yet, but does it solve the only problem worth solving in encryption? Does it allow me to take any email address and give me back a private key that only the recipient can use? If I wanted to know which public key to use I would just look at the recipients public website or ask that person through a phone. The problem is that people don't create keys because nobody ever send them an…

Keybase lets you do some key stuff, but the bigger feature is that it provides a bunch of ways to authenticate the source of a key above and beyond the WoT and getting into the strong set. Authentication is an inherently hard problem. With keybase you can, for example, see that the key that you want to use to send an encrypted email to x@example.com's website is owned by someone who also controls x@example.com's twitter, reddit, github accounts, web-site, etc, making it less likely that there's a MiTM going on.

Re: PGP: There’s Life in the Old Dog Yet

#39

Post by zobzu » Wed, Feb 25, 2015, 4:45 PM UTC

tomjen3 wrote: post #30

malgorithms wrote: post #9

Since Keybase inevitably comes up in these PGP conversations, 2 things in advance: 1. I've really been very slow in letting people into Keybase. The wait time is still 6 months (last night I was letting in people who asked back in August.) But now that we've added HackerNews key proofs, I'll let people in today who notice this post who have more than 1 karma and write "I'm HN: {theirusername}" in the request form. 2.…

I hadn't really heard about keybase yet, but does it solve the only problem worth solving in encryption? Does it allow me to take any email address and give me back a private key that only the recipient can use? If I wanted to know which public key to use I would just look at the recipients public website or ask that person through a phone. The problem is that people don't create keys because nobody ever send them an…

keybase proves who you are.. if you trust keybase

Re: PGP: There’s Life in the Old Dog Yet

#40

Post by sergiosgc » Wed, Feb 25, 2015, 4:58 PM UTC

malgorithms wrote: post #9

Since Keybase inevitably comes up in these PGP conversations, 2 things in advance: 1. I've really been very slow in letting people into Keybase. The wait time is still 6 months (last night I was letting in people who asked back in August.) But now that we've added HackerNews key proofs, I'll let people in today who notice this post who have more than 1 karma and write "I'm HN: {theirusername}" in the request form. 2.…

Thanks for the opportunity to try out Keybase. Great work.

The only question, but really important is: What is Keybase's business model? How will you make your living? It's a great service, I'd love to build upon it (my company does email as a service), but that step requires knowing you'll still be here a few years from now.