161–170 of 241 posts
Okay, I'll be the contrarian one: I HATE the name. There have already been trends in the mainstream and right wing media that "If you have nothing to hide, you have nothing to fear", that the NSA only monitors the communication of criminals, and that things like iPhone encryption help terrorists first. With that in mind, can you imagine the reaction that the average lay-person will have when they see a clickbait head…
Earlier quoted context omitted.
Currently, the trending HN commentry is focused on this name, and as much I like a good naming debate, I feel it is distracting from more "significant" concerns, such as... How does the app handle encryption? Has there been a security review?How are keys handled? How are conversations persisted in the app? Does it use iCloud? Etc...
Unfortunately, these endless tangents are becoming increasingly common on HN. I guess these are people who want to show off how smart they are but really don't have anything interesting to say about the topic at hand, so they go for the low-hanging fruits like spelling, layout, titles, and so on.
Of course, there are other concerns (why PGP and not Axolotl or OTR, how on earth does "your key is your username" work without causing other CAP-like issues, etc). But I'm not going to spend any time trying to improve a project that is working against encryption for everyone.
Earlier quoted context omitted.
Have you heard of or used signal? https://whispersystems.org/ Same idea -- strong crypto that's usable for anyone. It uses the OTR Ratchet protocol which uses perfect forward secrecy. The app also provides a way to verify keys through an OOB channel. I would recommend considering OTR Ratchet integration just like WhatsApp did recently. PGP is not a good design choice for a messaging app as you're always using asymmet…
PGP is a great choice when you want to be able to send encrypted messages over any channel you want. It sounds like you do not understand how PGP works -- you exchange public keys over a trusted medium and then use public key cryptography to encrypt the AES key used to encrypt the rest of the message. The OpenPGP library it uses has been audited (twice). Most of the mistakes that could have be made are avoided this w…
That has nothing to do with PGP. You could do the same by base64-ing an OTR session (in fact, people do that all the time).
I don't like the choice of PGP because it has non-repudability. If you send me a message, I can prove to anyone in the world that you sent me the message. OTR and Axolotl don't have this problem (only I can be sure you sent me the message and I cannot prove that I didn't fake it to anyone else).
Okay, I'll be the contrarian one: I HATE the name. There have already been trends in the mainstream and right wing media that "If you have nothing to hide, you have nothing to fear", that the NSA only monitors the communication of criminals, and that things like iPhone encryption help terrorists first. With that in mind, can you imagine the reaction that the average lay-person will have when they see a clickbait head…
Suggestions and/or concepts you (OP) want to evoke: Patriot Freedom Liberty Good Citizen Free Speech America Fourth Amendment Secure In Papers Right To Privacy
Although the name is ironic, it will reinforce the common vague notion that encryption is something politicized/controversial/illegal, and that's not a good thing for infosec. Looks great otherwise.
the name may be intended to be ironic, but the irony of the irony is that if you are interested in communicating about conducting one or more felonies, I would in fact urge you to use encryption. I hate when people hate the "if you have nothing to hide, why do you care?" question because it's a valid question. You can answer, "because I fear the creeping growth of a surveillance state like in 1984", but then again, i…
Oh, and it's not a slippery slope fallacy if we literally are headed towards 1984. Not even Orwell thought that social graphs would allow for automated analysis. The NSA doesn't need tele-screens when they have Facebook.
Earlier quoted context omitted.
What it could achieve is a clone that simply replaces the names and requires very little maintenance. If the community agrees and adopts, then politeness be damned. Edit: To put the converse: If it's a shitty idea, then no one will use it and it didn't matter that you were polite anyways.
To be fair, this did happen with GCC. But everyone hated everyone else for years as a result. Forking fractures a community -- for something as trivial as this it isn't worth it. But it is worth DoSing the maintainer until they realise that making an encryption program called "Felony" is a brain-dead idea.
It may be a braindead idea but it's their idea. If you don't like it, fork it.
If you don't like it, write your own.
But don't complain because someone wrote some software and kindly published it for all to use for free.
gpg -r pubkeyidhere -e filetoencrypthere.txt
Honestly if you can't work a terminal you shouldn't be left around encryption.
Or you could just use the terminal like any sane person. This is how to encrypt a message using someones public key ready? gpg -r pubkeyidhere -e filetoencrypthere.txt Honestly if you can't work a terminal you shouldn't be left around encryption.
Earlier quoted context omitted.
To be fair, this did happen with GCC. But everyone hated everyone else for years as a result. Forking fractures a community -- for something as trivial as this it isn't worth it. But it is worth DoSing the maintainer until they realise that making an encryption program called "Felony" is a brain-dead idea.
I don't think you get the point. It may be a braindead idea but it's their idea. If you don't like it, fork it. If you don't like it, write your own. But don't complain because someone wrote some software and kindly published it for all to use for free.
Because that's how PR works. The problem is that it's a publicity problem, not a technical problem. Technical problems are solved by forks, but publicity problems have to be solved by the community.
> But don't complain because someone wrote some software and kindly published it for all to use for free.
And then decided to give it a name that actively bombards the crypto community's efforts to bring encryption to the masses. Sure, it's free software and that's fine. But it's free software that will cause a PR nightmare for no good reason. "Hackers and terrorists are using a new app called 'Felony' to steal your money and freedom." -- That's the headline here.
Earlier quoted context omitted.
the name may be intended to be ironic, but the irony of the irony is that if you are interested in communicating about conducting one or more felonies, I would in fact urge you to use encryption. I hate when people hate the "if you have nothing to hide, why do you care?" question because it's a valid question. You can answer, "because I fear the creeping growth of a surveillance state like in 1984", but then again, i…
Ignoring the arrogance, "If you have nothing to hide" isn't a valid question because everyone has something to hide. People have curtains and doors for good reasons, and everyone expects a certain amount of privacy in their lives -- but they don't realise how much they care about it until after they get screwed. Oh, and it's not a slippery slope fallacy if we literally are headed towards 1984. Not even Orwell thought…
I'm in favor of crypto, privacy and the same things you are... I just don't lie about it: criminals are more interested in crypto than the average citizen, so are kiddy pornographers (for those of you who don't think that's a crime). So are "chinese dissidents", but seriously, there are more criminals out there.
my arrogance comes from my ability to be both smart and honest rather than a propagandist.