Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Felony – An open-source PGP keychain

github.com

Post reply on HN
Print view View original

211–220 of 241 posts

Re: Felony – An open-source PGP keychain

#211

Post by e12e »

cyphar wrote: post #163
iancarroll wrote: post #120

Earlier quoted context omitted.

PGP is a great choice when you want to be able to send encrypted messages over any channel you want. It sounds like you do not understand how PGP works -- you exchange public keys over a trusted medium and then use public key cryptography to encrypt the AES key used to encrypt the rest of the message. The OpenPGP library it uses has been audited (twice). Most of the mistakes that could have be made are avoided this w…

> PGP is a great choice when you want to be able to send encrypted messages over any channel you want. That has nothing to do with PGP. You could do the same by base64-ing an OTR session (in fact, people do that all the time). I don't like the choice of PGP because it has non-repudability. If you send me a message, I can prove to anyone in the world that you sent me the message. OTR and Axolotl don't have this proble…

> That has nothing to do with PGP. You could do the same by base64-ing an OTR session (in fact, people do that all the time).

But PGP also works for printing stuff on a post-card (or you know, email) - asynchronous communication. While Axolotl does push OTR-like modes towards asynchronous use - they do involve a lot more than getting hold of a public key (say, one published in a magazine, or shown in a frame of a movie, or...).

There's been an argument since the early crypto-wars about whether gpg/pgp could (should) be made easier to use. And I absolutely think it could (and should).

Key distribution is still hard, but it's not helped by a silly cli app, and no great recommendations on how to manage trust (I suppose the gist is: get a hw token for your key, print a backup and store a revocation order in a safe, sign keys you trust and upload them to the keyservers. But even if that list seems easy, users are left with questions like: which hw tokens should I use? When I lose it, "re-trusting" keys? How big a problem is it that I've just exported meta-data about who I communicate with? Which clients easily integrates with my hw token so that I can use gpg on my smart phones, my laptop and my desktop? What if my phone lacks NFC? Can't use USB host? And last, but certainly not least -- why isn't there a fork of gpg2 that does "the right thing(tm)" out of the box -- and make this "best of breed" flow easy, rather than making all kinds of sub-key shenanigans equally cryptic?)

Re: Felony – An open-source PGP keychain

#212

Post by cyphar »

brightball wrote: post #187
cyphar wrote: post #95

Earlier quoted context omitted.

1. Why did you choose PGP, when we have OTR and Axolotl -- which are specifically designed for informal communication where repudiation (recipient Y not being able to prove to others that X sent the original message) matters. 2. How are the public keys securely distributed? You say that "a public key is like a username", but without a central authority you hit a lot of issues (essentially the CAP tradeoff, but for us…

As for #3 I would think that it makes fun of the idea that encryption is somehow a crime. That's how I read it at least.

I get the joke, it's just not funny. And literally nobody outside of our community would get the joke.

Re: Felony – An open-source PGP keychain

#213

Post by cyphar »

e12e wrote: post #211
cyphar wrote: post #163

Earlier quoted context omitted.

> PGP is a great choice when you want to be able to send encrypted messages over any channel you want. That has nothing to do with PGP. You could do the same by base64-ing an OTR session (in fact, people do that all the time). I don't like the choice of PGP because it has non-repudability. If you send me a message, I can prove to anyone in the world that you sent me the message. OTR and Axolotl don't have this proble…

> That has nothing to do with PGP. You could do the same by base64-ing an OTR session (in fact, people do that all the time). But PGP also works for printing stuff on a post-card (or you know, email) - asynchronous communication. While Axolotl does push OTR-like modes towards asynchronous use - they do involve a lot more than getting hold of a public key (say, one published in a magazine, or shown in a frame of a mov…

If you don't need PFS (which you should need) then you can use DH to create the shared key you use for the HMAC. Maybe you could even do an original OTR-like ratchet scheme (only change the key once the recipient shows that they are using the new key) to get PFS. But in principle if you assume that key distribution is "solved" then you can implement the unique parts of OTR.

Re: Felony – An open-source PGP keychain

#214

Post by LnxPrgr3 »

everfree wrote: post #147
Mithaldu wrote: post #76

Earlier quoted context omitted.

Will this thing ever use less than 130MB of RAM? If so, how do you plan to do that?

Just curious: Are you running on a Raspberry Pi or other machine with constrained resources? 130MB is less than 4% of the memory in most modern computers, and less than 10% of most mid-range phones.

Not the parent, but that stuff adds up when just about everything's written as if it owns the machine and the machine's guaranteed to be blatant overkill.

Disclaimer: it's not my only machine, but I'm posting from a Pi 3. 1GB RAM is roomy for most things that aren't Web browsers and apps that embed Web browsers.

Re: Felony – An open-source PGP keychain

#215

Post by 746F7475 »

yoklov wrote: post #17
henryboldi wrote: post #2

Hi I'm Henry, the creator of Felony I’ve had a passion for politics, history, and programming since the age of 12 growing up in a suburb of Chicago. During my freshman year, I developed an interest in software. A couple of apps and hackathons (programming competitions) later, I was working on my own startups when I made the leap to drop out of high school to become a software engineer at a venture-backed tech startup…

You dropped out of high school your freshman year? i mean you seem smart enough to get by but uh, wow. (fwiw i say this as a college dropout who doesnt regret it at all)

Why are all dropouts who "made it" making such a big deal out of it.

Re: Felony – An open-source PGP keychain

#216

Post by 746F7475 »

henryboldi wrote: post #2

Hi I'm Henry, the creator of Felony I’ve had a passion for politics, history, and programming since the age of 12 growing up in a suburb of Chicago. During my freshman year, I developed an interest in software. A couple of apps and hackathons (programming competitions) later, I was working on my own startups when I made the leap to drop out of high school to become a software engineer at a venture-backed tech startup…

Did you really have a passion for politics at age 12? This coupled with "I had no trouble using command-line encryption to communicate." makes this read like a farce. First you act like ultimate prodigy that peaked at tender age of 12 and then go boast with mad skills of running a cli command.

Re: Felony – An open-source PGP keychain

#217

Post by LnxPrgr3 »

JimmyAustin wrote: post #201
Mithaldu wrote: post #157

Earlier quoted context omitted.

Just to be nice i'll assume you ask earnestly and answer earnestly: I have 16 GB of RAM. However i also always have more than one app running at any given time. In fact, my system usually has 200+ things running. I also don't mind if things use a lot of memory if: They either use it to give me a lot of bang for my buck, or are not long-running processes. Felony ticks neither of these boxes. Also do keep in mind that…

I'm not sure that the doubling guess is going to be accurate. The majority of that 130MB is going to be in the overhead of keeping a seperate copy of Chromium in memory, not in the implementation of current features.

My experience with Web browsers is they expand to fill all available memory and then some. This Firefox process has grown more than 50% since launch, and will stay mostly that big even if I close all but one new tab.

Chrome does a better job of containing the damage to individual tabs, but I'm not how much that really helps with something like this. And of course, eventually I still end up killing Chrome periodically to get RAM back for real work, like running VMs without the host thrashing.

Re: Felony – An open-source PGP keychain

#218

Post by crucialfelix »

cdnsteve wrote: post #16
henryboldi wrote: post #2

Hi I'm Henry, the creator of Felony I’ve had a passion for politics, history, and programming since the age of 12 growing up in a suburb of Chicago. During my freshman year, I developed an interest in software. A couple of apps and hackathons (programming competitions) later, I was working on my own startups when I made the leap to drop out of high school to become a software engineer at a venture-backed tech startup…

This looks like an interesting project but has a poor name choice. If it's targeted at non technical users, it may actually prevent them from using it, out of fear that just using it is illegal.

M.Y.O.B. - Mind Your Own Business

Re: Felony – An open-source PGP keychain

#219

Post by SNvD7vEJ »

mathiasrw wrote: post #178
SNvD7vEJ wrote: post #93

Earlier quoted context omitted.

Please change the name of the app. I'm Swedish, and to me the name sounds really repelling. Maybe someone could fork the application and rename it to something cool that I can use?

What do you think the app should be named?

How about "PGPal"?

Re: Felony – An open-source PGP keychain

#220

Post by tokenizerrr »

slacka wrote: post #182
cdnsteve wrote: post #16

Earlier quoted context omitted.

This looks like an interesting project but has a poor name choice. If it's targeted at non technical users, it may actually prevent them from using it, out of fear that just using it is illegal.

How about "The Fourth"? The name denotes privacy and won't scare off people by sounding illegal.

It would make me unwilling to use it, due to being clearly pro-American. While it's the american government that is most likely to be spying on me. Awful name, felony is better.

I'm not an American, by the way.

Post reply on HN