5 ms·

I think keybase has the best attempt at a solution. They solve two fundamental problems. 1. Identity. its the sum of your online presence. 2. Insecure devices

by nickik 11y ago

I think keybase has the best attempt at a solution. They solve two fundamental problems. 1. Identity. its the sum of your online presence. 2. Insecure devices. In keybase devices have unique keys and can can be revoked when lost I have been trying Protonmail, they have been deploying gpg in browser and apps. The interface is nice and I would have no problem recommending it to my parents. The problem is that it currently only works with other Protonmail users. Once they allow adding public keys for contacts and searching keyservers/keybase it will be quite nice and useful. They have no solution for the key security on the mobile phone. I personally dont want my key on my phone. I would really like to see a product that interfaces keybase and protonmail. Nicely designed apps and webinterface that all have different keys. Directly integrated with my social media contacts. Thanks to everybody working these problems.

cm2187 11y ago
Your mobile should be one of the safest places to store a key. Think of the work it takes the FBI to open an iphone. You have a closed, encrypted device which runs app whitelisting. Nothing is perfect but compared to a desktop computer it is a safe vs a shoe box. You just need to keep a copy offline in case the device is stolen.
- tdkl 11y ago
  Because "mobile" somehow means "iphone" eh ?
  - cm2187 11y ago
    Given their market share this is not a ridiculous link.
    - kuschku 11y ago
      Which is in Europe at 14%? That is a ridiculous link IMO.
    - CrystalGamma 11y ago
      Depends on where. Here in Germany nobody in my family and only one of my coworkers (AFAIK) has an iPhone, and only two have iPads, while basically everyone I know has an Android device.
- nickik 11y ago
  Their is a huge difference between a phone that is encrypted and turned off and a phone that is turned on, is constantly moving threw unkown wifi networks, has tons of app with to many permissions on it and can auto upgrades most of them.
- tombrossman 11y ago
  > "Your mobile should be one of the safest places to store a key." I have to take issue with this. I think your mobile is probably one of the least secure places to store a key, due to the 'baseband problem'[0]. Your mobile in its normal (powered-on and connected to a network) state is probably less secure than using a fresh un-patched install of Windows XP today. I mean the original version of XP, pre-SP1 with the firewall disabled. This is why people say to choose a device without a mobile radio chip at all for secure communication, such as an iPod Touch[1]. I'd really like to have PGP/GPG encrypted emails on my mobile and I had it tested and working for a little while before looking into the baseband issue. I've since revoked the keys I used for that test and I am resigned to the fact that I will not be able to securely use encrypted email on my mobile phone for the foreseeable future. I keep my keys off the phone now, along with an unpublished email address at a different domain which is to be used for account recovery for those email accounts in use on the phone. [0]http://mobile.osnews.com/story.php/27416/The_second_operating_system_hiding_in_every_mobile_phone http://mobile.osnews.com/story.php/27416/The_second_operatin... [1]https://twitter.com/csoghoian/status/686035633949818881 https://twitter.com/csoghoian/status/686035633949818881
  - nickik 11y ago
    On Android you can use a Smartcard over NFC (K-9 Mail and OpenKeychain). Yubico should release an Bluetooth LE Smartcard and then it should be possible on IPhone.
  - mindslight 11y ago
    There are phones with separate application/baseband chips. I have a Samsung i9500 (one of the many models called "Galaxy S4"), which I believe is the most recent of such phones that can run Cyanogenmod. Also, I think most Apple devices are separated in such a manner as well? Of course there's likely still a whole collection of closed software that takes constant network connectivity for granted, and does who-knows-what. The Android code is open, but it seems like there won't be enough eyes looking at vulnerabilities to the vendor with regards to say the GApps suite. And making the choice of utility between Google Maps and K-9 mail, I picked Maps. It also doesn't help that phone models are so varied as to diffuse the interest in investigation/teardown/auditing.
tracker1 11y ago
I have to agree... I keep hoping that someone build something easier to use on top of keybase... (assuming keybase sticks to it's single purpose, and doesn't try to build it's own systems on top) It also makes sense to separate the public key aggregation from the services that use the keys, and the plugin systems that translate... it would be easy enough to create a browser plugin that exposes an API that can be used to encryptMessage or signMessage, where the plugin notified/asked the user.. and all the in-browser app will get is the encrypted message... same for decryptMessage and verifyMessage... Hmm...
- nickik 11y ago
  Keybase will be doing that. They already have Saltpack (saltpack.org). They want to first do the file system and then massenging.

by nickik 11y ago

cm2187 11y ago

Your mobile should be one of the safest places to store a key. Think of the work it takes the FBI to open an iphone. You have a closed, encrypted device which runs app whitelisting. Nothing is perfect but compared to a desktop computer it is a safe vs a shoe box. You just need to keep a copy offline in case the device is stolen.

tdkl 11y ago
Because "mobile" somehow means "iphone" eh ?
- cm2187 11y ago
  Given their market share this is not a ridiculous link.
  - kuschku 11y ago
    Which is in Europe at 14%? That is a ridiculous link IMO.
  - CrystalGamma 11y ago
    Depends on where. Here in Germany nobody in my family and only one of my coworkers (AFAIK) has an iPhone, and only two have iPads, while basically everyone I know has an Android device.
nickik 11y ago
Their is a huge difference between a phone that is encrypted and turned off and a phone that is turned on, is constantly moving threw unkown wifi networks, has tons of app with to many permissions on it and can auto upgrades most of them.
tombrossman 11y ago
> "Your mobile should be one of the safest places to store a key." I have to take issue with this. I think your mobile is probably one of the least secure places to store a key, due to the 'baseband problem'[0]. Your mobile in its normal (powered-on and connected to a network) state is probably less secure than using a fresh un-patched install of Windows XP today. I mean the original version of XP, pre-SP1 with the firewall disabled. This is why people say to choose a device without a mobile radio chip at all for secure communication, such as an iPod Touch[1]. I'd really like to have PGP/GPG encrypted emails on my mobile and I had it tested and working for a little while before looking into the baseband issue. I've since revoked the keys I used for that test and I am resigned to the fact that I will not be able to securely use encrypted email on my mobile phone for the foreseeable future. I keep my keys off the phone now, along with an unpublished email address at a different domain which is to be used for account recovery for those email accounts in use on the phone. [0]http://mobile.osnews.com/story.php/27416/The_second_operating_system_hiding_in_every_mobile_phone http://mobile.osnews.com/story.php/27416/The_second_operatin... [1]https://twitter.com/csoghoian/status/686035633949818881 https://twitter.com/csoghoian/status/686035633949818881
- nickik 11y ago
  On Android you can use a Smartcard over NFC (K-9 Mail and OpenKeychain). Yubico should release an Bluetooth LE Smartcard and then it should be possible on IPhone.
- mindslight 11y ago
  There are phones with separate application/baseband chips. I have a Samsung i9500 (one of the many models called "Galaxy S4"), which I believe is the most recent of such phones that can run Cyanogenmod. Also, I think most Apple devices are separated in such a manner as well? Of course there's likely still a whole collection of closed software that takes constant network connectivity for granted, and does who-knows-what. The Android code is open, but it seems like there won't be enough eyes looking at vulnerabilities to the vendor with regards to say the GApps suite. And making the choice of utility between Google Maps and K-9 mail, I picked Maps. It also doesn't help that phone models are so varied as to diffuse the interest in investigation/teardown/auditing.

tracker1 11y ago

I have to agree... I keep hoping that someone build something easier to use on top of keybase... (assuming keybase sticks to it's single purpose, and doesn't try to build it's own systems on top) It also makes sense to separate the public key aggregation from the services that use the keys, and the plugin systems that translate... it would be easy enough to create a browser plugin that exposes an API that can be used to encryptMessage or signMessage, where the plugin notified/asked the user.. and all the in-browser app will get is the encrypted message... same for decryptMessage and verifyMessage... Hmm...

nickik 11y ago
Keybase will be doing that. They already have Saltpack (saltpack.org). They want to first do the file system and then massenging.