Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Felony – An open-source PGP keychain

github.com

Post reply on HN
Print view View original

111–120 of 241 posts

Re: Felony – An open-source PGP keychain

#111

Post by mwcampbell »

biokoda wrote: post #78
wmluke wrote: post #67

Earlier quoted context omitted.

Currently, the trending HN commentry is focused on this name, and as much I like a good naming debate, I feel it is distracting from more "significant" concerns, such as... How does the app handle encryption? Has there been a security review?How are keys handled? How are conversations persisted in the app? Does it use iCloud? Etc...

> How does the app handle encryption? Has there been a security review? It's built on Electron, React and Redux. There is no security as it is a fundamentally insecure environment.

It's fashionable around here to criticize that tech stack, but do you have anything to back up that claim?

Re: Felony – An open-source PGP keychain

#112

Post by unimpressive »

krisdol wrote: post #102
SNvD7vEJ wrote: post #93

Earlier quoted context omitted.

Please change the name of the app. I'm Swedish, and to me the name sounds really repelling. Maybe someone could fork the application and rename it to something cool that I can use?

You seriously can't do this yourself? Clone the repo and change the name using find-and-replace and run install. No need to insult.

That won't mitigate the PR damage involved. A fork would need to actually just plain outcompete the original app.

Re: Felony – An open-source PGP keychain

#113

Post by nailer »

ZenoArrow wrote: post #110
nailer wrote: post #97

Earlier quoted context omitted.

+1 for 'Privacy'. Liberty is America centric. And privacy is more specific.

> "Liberty is America centric." I wouldn't say it belongs to any nation, though if it had to belong to one it'd probably be France. The first two things that come to mind when I think of the word 'liberty' are both of French origin: https://en.wikipedia.org/wiki/Liberté,_égalité,_fraternité https://en.wikipedia.org/wiki/Statue_of_Liberty

You're right re: France, but people in the UK, Ireland, Germany and Australia talk much less about liberties than they do about privacy.

Oddly, this government minister [http://news.sky.com/story/1675276/conservative-mp-calls-for-...] was so shocked and outraged about requests for leaders to reveal their tax returns he suggested banning curtains as a equivalent. He's from the same government that collects and reads all email of all citizens.

Re: Felony – An open-source PGP keychain

#114

Post by petre »

peterbonney wrote: post #68
bwghughes wrote: post #56

Earlier quoted context omitted.

I think folks should chill on the name. It's just a word which makes it stand out as a product. Good job !!

In that famous Goldman Sachs "theft" case, use of a tool called "Subversion" (which any IT person knows is just vanilla version control software) was taken by the FBI as evidence of malicious intent. Just saying.

Just call it Line Noise, Static, or something. No malicious intent in that.

Re: Felony – An open-source PGP keychain

#116

Post by unixhero »

api wrote: post #104
jackweirdy wrote: post #28

Earlier quoted context omitted.

Nor does it help the cause of explaining to the general public that encryption is something they do use and should use in their own lives.

There's been a rule: encryption must have terrible UX. Most encryption stuff even has awful UX by command line Linux hacker standards. Now we have an effort otherwise but... cannot... resist... doing... something... to make it unfriendly...

Luksus begs to differ. http://thomasfrivold.github.io/luksus

Re: Felony – An open-source PGP keychain

#118

Post by givinguflac »

henryboldi wrote: post #2

Hi I'm Henry, the creator of Felony I’ve had a passion for politics, history, and programming since the age of 12 growing up in a suburb of Chicago. During my freshman year, I developed an interest in software. A couple of apps and hackathons (programming competitions) later, I was working on my own startups when I made the leap to drop out of high school to become a software engineer at a venture-backed tech startup…

Might I suggest "FreedomKeyper" as an alternate name? Great project!

Re: Felony – An open-source PGP keychain

#119

Post by conorpp »

henryboldi wrote: post #2

Hi I'm Henry, the creator of Felony I’ve had a passion for politics, history, and programming since the age of 12 growing up in a suburb of Chicago. During my freshman year, I developed an interest in software. A couple of apps and hackathons (programming competitions) later, I was working on my own startups when I made the leap to drop out of high school to become a software engineer at a venture-backed tech startup…

Have you heard of or used signal?

https://whispersystems.org/

Same idea -- strong crypto that's usable for anyone. It uses the OTR Ratchet protocol which uses perfect forward secrecy. The app also provides a way to verify keys through an OOB channel.

I would recommend considering OTR Ratchet integration just like WhatsApp did recently.

PGP is not a good design choice for a messaging app as you're always using asymmetric crypto operations which are computationally intense -- not terrible on modern computers but will be dreadful on mobile devices. Also can you provide some more documentation on how the app leverages PGP? Hopefully conversation is not using the same private keys to encrypt. That is vulnerable to data or side channel leakage. The modern approach is to generate and exchange an ephemeral key. Also please provide information on key storage.

Rather than making vague security claims like "first-rate" and " Security++ to the greatest extreme" you should rather provide a threat model and explain why one can remain confidential and have authenticity against particular types of adversaries. No security tool is perfect and it's only a matter of time before an adversary breaks it. Developers are doing a disservice by claiming anything more.

Before you can claim a first-rate security tool you will need to face a lot of scrutiny first.

Re: Felony – An open-source PGP keychain

#120

Post by iancarroll »

conorpp wrote: post #119
henryboldi wrote: post #2

Hi I'm Henry, the creator of Felony I’ve had a passion for politics, history, and programming since the age of 12 growing up in a suburb of Chicago. During my freshman year, I developed an interest in software. A couple of apps and hackathons (programming competitions) later, I was working on my own startups when I made the leap to drop out of high school to become a software engineer at a venture-backed tech startup…

Have you heard of or used signal? https://whispersystems.org/ Same idea -- strong crypto that's usable for anyone. It uses the OTR Ratchet protocol which uses perfect forward secrecy. The app also provides a way to verify keys through an OOB channel. I would recommend considering OTR Ratchet integration just like WhatsApp did recently. PGP is not a good design choice for a messaging app as you're always using asymmet…

PGP is a great choice when you want to be able to send encrypted messages over any channel you want. It sounds like you do not understand how PGP works -- you exchange public keys over a trusted medium and then use public key cryptography to encrypt the AES key used to encrypt the rest of the message.

The OpenPGP library it uses has been audited (twice). Most of the mistakes that could have be made are avoided this way.

Edit: Yes, you lose PFS by using PGP, but it would not really be possible to negotiate PFS via, say, email.

Post reply on HN