5 ms·

And by ideally placed, you mean for the NSA, right? I'd never put any GPG keys of mine in an American cloud provider. That sort of voids the entire point of it

And by ideally placed, you mean for the NSA, right? I'd never put any GPG keys of mine in an American cloud provider. That sort of voids the entire point of it.

mineshaftgap 11y ago
It is actually easier for the NSA if you host in Europe, but that is not really the point is it? Take America down a notch is the real goal.
scrupulusalbion 11y ago
More importantly, end-to-end encryption means that your desktop/laptop/tablet/phone/TI-83 is doing the crypto, especially signatures. On a somewhat related note, I remember reading some documentation on a one-time password scheme, which I can't find anymore. It briefly mentioned something about using DES calculators to handle crypto signatures (for what reason i cannot remember). For our purposes, a PGP/GPG hand-held device would be neat, though perhaps cumbersome to actually user.
- nyan4 11y ago
  > phone/TI-83 is doing the crypto Phone? Can we remotely trust nowadays smartphones not to have a number of backdoors?
  - scrupulusalbion 11y ago
    I don't think that phones are secure, but people do use them for things like 2-factor authentication. I suppose that it is the form-factor that is more relevant, since most phones are smaller than a TI-83, so much so that people are willing to carry them around everywhere. Ultimately, what I envision would be a cross between a Blackberry (size, QWERTY keyboard) and the TI-83 (focus on being a simpler, lower-end computer). Heck, one may as well give it a unix-like OS and leave out wireless communications and sophisticated graphics. I think this is feasible, but the market would be quite small.
superuser2 11y ago
Why do you believe non-American cloud providers aren't compromised?
- fixermark 11y ago
  In the short run, they're simply a smaller and more diverse attack surface. There's pretty valid "security through obscurity" reasoning to apply here (though that is, of course, not a train of thought one should bet the whole farm upon).

And by ideally placed, you mean for the NSA, right? I'd never put any GPG keys of mine in an American cloud provider. That sort of voids the entire point of it.

mineshaftgap 11y ago

It is actually easier for the NSA if you host in Europe, but that is not really the point is it? Take America down a notch is the real goal.

scrupulusalbion 11y ago

More importantly, end-to-end encryption means that your desktop/laptop/tablet/phone/TI-83 is doing the crypto, especially signatures. On a somewhat related note, I remember reading some documentation on a one-time password scheme, which I can't find anymore. It briefly mentioned something about using DES calculators to handle crypto signatures (for what reason i cannot remember). For our purposes, a PGP/GPG hand-held device would be neat, though perhaps cumbersome to actually user.

nyan4 11y ago
> phone/TI-83 is doing the crypto Phone? Can we remotely trust nowadays smartphones not to have a number of backdoors?
- scrupulusalbion 11y ago
  I don't think that phones are secure, but people do use them for things like 2-factor authentication. I suppose that it is the form-factor that is more relevant, since most phones are smaller than a TI-83, so much so that people are willing to carry them around everywhere. Ultimately, what I envision would be a cross between a Blackberry (size, QWERTY keyboard) and the TI-83 (focus on being a simpler, lower-end computer). Heck, one may as well give it a unix-like OS and leave out wireless communications and sophisticated graphics. I think this is feasible, but the market would be quite small.

superuser2 11y ago

Why do you believe non-American cloud providers aren't compromised?

fixermark 11y ago
In the short run, they're simply a smaller and more diverse attack surface. There's pretty valid "security through obscurity" reasoning to apply here (though that is, of course, not a train of thought one should bet the whole farm upon).