Felony – An open-source PGP keychain • Hacker News Board

Re: Felony – An open-source PGP keychain

#131

Post by saidajigumi » Mon, Jul 04, 2016, 4:35 PM UTC

henryboldi wrote: post #37

menzoic wrote: post #34

Earlier quoted context omitted.

"Felony is the first PGP app that's easy for anyone to use" How about calling it "Freedom"

Wow, I like this a lot!

I agree that Freedom is a nice choice, but "Freedom" is already in use by a somewhat well-known website/social media blocker (as in "freedom from all those distractions"):

https://freedom.to/

Still, other suggestions are coming up in this thread that may be of use. I really like the idea of a name that, for a non-technical user, cab be a lead in to answering "why do I want this app? what does it do for me?"

Re: Felony – An open-source PGP keychain

#132

Post by Taek » Mon, Jul 04, 2016, 4:37 PM UTC

mwcampbell wrote: post #111

biokoda wrote: post #78

Earlier quoted context omitted.

> How does the app handle encryption? Has there been a security review? It's built on Electron, React and Redux. There is no security as it is a fundamentally insecure environment.

It's fashionable around here to criticize that tech stack, but do you have anything to back up that claim?

Security is very hard. You need carefully constructed apps with carefully chosen dependencies, and generally you want the number of lines of code to be very small.

Anything webkit based is going to lose on all of those points almost immediately. Anything nodejs based is also going to lose on all of those points, because nodejs has a culture of massive dependency stacks run by whomever. Javascript in general is a pretty insecure language, unless you are using explicit subsets but even then javascript has a horrible reputation for security.

Something is better than nothing. I'd rather people use Telegram (pretty well known for terrible crypto) than people use nothing at all. Same with Felony. I'd rather people use bad crypto than no crypto.

But in general it would seem likely that anything built on a webstack has a low chance of passing a security audit. The cultures surrounding the webstack technologies prioritize shipping product and doing cool things over shipping bug-free or secure code. It's one of the reasons that the webstack is so popular. It's easy, and if you ship something buggy it's generally not too bad to go back and fix it later, especially for something like a webpage, because your users will get your updates immediately.

Re: Felony – An open-source PGP keychain

#133

Post by corndoge » Mon, Jul 04, 2016, 4:40 PM UTC

pmlnr wrote: post #130

henryboldi wrote: post #9

Earlier quoted context omitted.

Once your key is generated you can click the 'copy' icon to the right of your name in the header. After that you can share the key on any platform you like, including Keybase.io :)

keybase.io... right. I've been waiting for an invite letter for a year. Please stop referring to non publicly open platforms as they were actually usable. There is keys.gnupg.net, pool.sks-keyservers.net, pgp.mit.edu, etc. These are the well-known ones that had been around for a while.

What's your username? I have a couple invites.

Should note that I never use the thing since in practice it's easier to fetch my key via traditional methods, a la pgp.mit.edu...

Re: Felony – An open-source PGP keychain

#134

Post by elliottcarlson » Mon, Jul 04, 2016, 4:40 PM UTC

yoklov wrote: post #17

henryboldi wrote: post #2

Hi I'm Henry, the creator of Felony I’ve had a passion for politics, history, and programming since the age of 12 growing up in a suburb of Chicago. During my freshman year, I developed an interest in software. A couple of apps and hackathons (programming competitions) later, I was working on my own startups when I made the leap to drop out of high school to become a software engineer at a venture-backed tech startup…

You dropped out of high school your freshman year? i mean you seem smart enough to get by but uh, wow. (fwiw i say this as a college dropout who doesnt regret it at all)

I dropped out after my sophomore year - I had recently moved to the States from Europe, and school was teaching things that I had learned already been taught a few years prior to that. I was completely bored and decided I was done with school. Getting my GED was really easy, and from there I have had a great career - while it may have hurt me in the beginning, I now have 20 years of relevant work experience behind me, it's generally not a concern to myself or any of my past employers - and if I were to interview somewhere that took issue with it, it's probably not somewhere I would want to work.

Re: Felony – An open-source PGP keychain

#135

Post by nickpsecurity » Mon, Jul 04, 2016, 4:44 PM UTC

dom96 wrote: post #121

nickpsecurity wrote: post #83

Most are focused on the name, which is terrible, while only one other (so far) noticed the big problem: Electron, React, and Redux. A secure messenger needs to have strong endpoint security. Easiest way to do that is using safe, system languages with simple implementation, as few dependencies as possible, and isolation of app from rest of the system. That's one of safe C's, restricted C++, SafeD, Ada/SPARK, Component…

Agreed. Although I think that the name is also a problem. It feels like most of the upvotes are coming in because of the pretty image in the readme...

I mention the name in passing as others wrote on it. A lot on it haha.

Your comment on image is possibly also true. I remember much of the press of another messenging app oriented toward privacy came because it advertised as "the beautiful messenger" with many nice pictures. It was Icelandic with .is site but I don't recall name. Versus competition, wasn't much to say in terms of implemented features or security. The U.I. was beautiful, though. ;)

Note: The Apple website takes this technique about as far as it can go outside a dedicated, high-def, image board.

Note 2: I could add Nim to my prior list if there's been any work evaluating it for security-critical applications. Particularly, how it helps or hinders expressing such things plus risk compiler brings in during transformations. Anything on that yet?

Re: Felony – An open-source PGP keychain

#136

Post by mablap » Mon, Jul 04, 2016, 4:44 PM UTC

nickpsecurity wrote: post #83

Most are focused on the name, which is terrible, while only one other (so far) noticed the big problem: Electron, React, and Redux. A secure messenger needs to have strong endpoint security. Easiest way to do that is using safe, system languages with simple implementation, as few dependencies as possible, and isolation of app from rest of the system. That's one of safe C's, restricted C++, SafeD, Ada/SPARK, Component…

This was also my first reaction. The PGP part might have been audited... but what about the rest of the code? I highly doubt Electron is bullet proof.

Re: Felony – An open-source PGP keychain

#137

Post by vtlynch » Mon, Jul 04, 2016, 4:45 PM UTC

ascendantlogic wrote: post #98

krisdol wrote: post #91

Earlier quoted context omitted.

fork it and maintain your own name if you feel strongly about it.

Or maybe he shouldn't be giving opponents of strong encryption a PR gift on a platter.

Agreed. There is real irresponsibility in choosing this name. Thinking that this wont be used against the encryption community is naive and short-sided.

Re: Felony – An open-source PGP keychain

#138

Post by conorpp » Mon, Jul 04, 2016, 4:51 PM UTC

iancarroll wrote: post #120

conorpp wrote: post #119

Earlier quoted context omitted.

Have you heard of or used signal? https://whispersystems.org/ Same idea -- strong crypto that's usable for anyone. It uses the OTR Ratchet protocol which uses perfect forward secrecy. The app also provides a way to verify keys through an OOB channel. I would recommend considering OTR Ratchet integration just like WhatsApp did recently. PGP is not a good design choice for a messaging app as you're always using asymmet…

PGP is a great choice when you want to be able to send encrypted messages over any channel you want. It sounds like you do not understand how PGP works -- you exchange public keys over a trusted medium and then use public key cryptography to encrypt the AES key used to encrypt the rest of the message. The OpenPGP library it uses has been audited (twice). Most of the mistakes that could have be made are avoided this w…

Yes you're right.

It's hard to say that most mistakes are avoided from two audits. Especially in a browser; there's a lot of attack vectors.

Re: Felony – An open-source PGP keychain

#139

Post by tmalsburg2 » Mon, Jul 04, 2016, 4:52 PM UTC

wmluke wrote: post #67

deanCommie wrote: post #21

Okay, I'll be the contrarian one: I HATE the name. There have already been trends in the mainstream and right wing media that "If you have nothing to hide, you have nothing to fear", that the NSA only monitors the communication of criminals, and that things like iPhone encryption help terrorists first. With that in mind, can you imagine the reaction that the average lay-person will have when they see a clickbait head…

Currently, the trending HN commentry is focused on this name, and as much I like a good naming debate, I feel it is distracting from more "significant" concerns, such as... How does the app handle encryption? Has there been a security review?How are keys handled? How are conversations persisted in the app? Does it use iCloud? Etc...

Unfortunately, these endless tangents are becoming increasingly common on HN. I guess these are people who want to show off how smart they are but really don't have anything interesting to say about the topic at hand, so they go for the low-hanging fruits like spelling, layout, titles, and so on.

Re: Felony – An open-source PGP keychain

#140

Post by GavinMcG » Mon, Jul 04, 2016, 4:55 PM UTC

tmalsburg2 wrote: post #139

wmluke wrote: post #67

Earlier quoted context omitted.

Currently, the trending HN commentry is focused on this name, and as much I like a good naming debate, I feel it is distracting from more "significant" concerns, such as... How does the app handle encryption? Has there been a security review?How are keys handled? How are conversations persisted in the app? Does it use iCloud? Etc...

Unfortunately, these endless tangents are becoming increasingly common on HN. I guess these are people who want to show off how smart they are but really don't have anything interesting to say about the topic at hand, so they go for the low-hanging fruits like spelling, layout, titles, and so on.

I don't think that's it. Sure, the name is low-hanging fruit, but it's important low-hanging fruit.

Criticizing a name is hardly something that "shows off" smarts. Dismissing everyone for having nothing interesting to say, on the other hand...