5 ms·

Moxie on GPG: > The protocol reflects layers of cruft built up over the 20 years that it took for cryptography (and software engineering) to really come of age

Moxie on GPG: > The protocol reflects layers of cruft built up over the 20 years that it took for cryptography (and software engineering) to really come of age, and the fundamental architecture of PGP also leaves no room for now critical concepts like forward secrecy. [0] > We could try to slap a GUI on top of it, but I don't believe great products are made that way. Good UX requires thinking about interactions all the way down to the protocol. [1] [0] http://www.thoughtcrime.org/blog/gpg-and-me/ http://www.thoughtcrime.org/blog/gpg-and-me/ [1] https://news.ycombinator.com/item?id=9104562 https://news.ycombinator.com/item?id=9104562

pmoriarty 11y ago
What's a good alternative?
- bkeroack 11y ago
  Amateurs aren't allowed to write any crypto, so unless one of the few accredited elite like djb decide to write an alternative, we're all out of luck.
  - viraptor 11y ago
    That's not true. Everyone's allowed to write crypto as long as they understand what they're doing. The difference is that if djb releases new crypto code, I believe it will be correct and he's going to publish a few papers on why it's correct. If anyone else does it, they better write some really good papers about it and get reviews from the trusted people. (and they usually don't)
  - ycmbntrthrwaway 11y ago
    Look at how OTR was created. It failed the first version hard, but it was fixed in later versions because authors published their protocol and it was reviewed by "elite". Now it is an easy to use and secure protocol, which "elite" builds upon. TextSecure is based on OTR.
- ashitlerferad 11y ago
  moxie's stuff is, but it is designed for the always-online mobile world: https://whispersystems.org/ https://whispersystems.org/
  - simoncion 11y ago
    > ...it is designed for the always-online mobile world Soft disagree with that. Signal text and voice chat works just fine if all of your communicating party's machines are offline. (Well, I mean, obviously your voice call won't be answered, but otherwise...)
    - Freak_NL 11y ago
      You can't use Signal without a smartphone running Android or IOS. Even the webapp requires a linked smartphone; a phone number is a hard requirement of Signal.
      - masklinn 11y ago
        1. that's not a property of the protocol, it's the way they implemented verification 2. it absolutely doesn't require a smartphone, just a routable phone number, that can be a cell phone, a landline, a voip number or a google voice number: http://support.whispersystems.org/hc/en-us/articles/212476118-Will-any-phone-number-work-How-do-I-get-a-verification-number- http://support.whispersystems.org/hc/en-us/articles/21247611...
      - kpcyrd 11y ago
        The jolla store for sailfish has a patched version of signal that doesn't require the google play service.
      - simoncion 11y ago
        > Even the webapp requires a linked smartphone; a phone number is [currently] a hard requirement of Signal. I never said otherwise. What I said was: > Signal text and voice chat works just fine if all of your communicating party's machines are offline. This was in response to an assertion that Signal was designed for the "always-online" world. Signal works just fine when your contact is completely offline for extended periods of time.
- rakoo 11y ago
  minilock (https://github.com/kaepora/miniLock/ https://github.com/kaepora/miniLock/), see the video for a good overview of how easy it is to use. I'm with moxie and Matthew Green (http://blog.cryptographyengineering.com/2014/08/whats-matter-with-pgp.html http://blog.cryptographyengineering.com/2014/08/whats-matter...), I think that we should seriously thank PGP for what it's done, understand what to do and what to not do (I believe Web of Trust is part of these) and take advantage of the fact that PGP has relatively few users to create something better.
- joveian 11y ago
  Unfortunately there isn't really one at this point that I know about. There are some in development. The one I am most hopeful about is briar: https://briarproject.org https://briarproject.org
DyslexicAtheist 11y ago
>> We could try to slap a GUI on top of it, but I don't believe great products are made that way. Good UX requires thinking about interactions all the way down to the protocol. unsure if I agree. A lot of the user-space Unix/Linux Gui applications are built that way: command line interface first and GUI to control that. (the opposite of windows where often a cmdline interface is built to control the functionality provided by the GUI application). So by that logic the majority of applications that have a GUI are labelled "not great products". Hmmmm ...
- schwarrrtz 11y ago
  I think what he means is that building a GUI wrapper around a CLI can't make up for deficiencies in the CLI itself. I don't think he's against GUIs in general.
- masklinn 11y ago
  > So by that logic the majority of applications that have a GUI are labelled "not great products". Hmmmm ... When it comes to Linux GUI applications, that's a pretty fair description. Understated and over-praising if anything.

pmoriarty 11y ago

What's a good alternative?

bkeroack 11y ago
Amateurs aren't allowed to write any crypto, so unless one of the few accredited elite like djb decide to write an alternative, we're all out of luck.
- viraptor 11y ago
  That's not true. Everyone's allowed to write crypto as long as they understand what they're doing. The difference is that if djb releases new crypto code, I believe it will be correct and he's going to publish a few papers on why it's correct. If anyone else does it, they better write some really good papers about it and get reviews from the trusted people. (and they usually don't)
- ycmbntrthrwaway 11y ago
  Look at how OTR was created. It failed the first version hard, but it was fixed in later versions because authors published their protocol and it was reviewed by "elite". Now it is an easy to use and secure protocol, which "elite" builds upon. TextSecure is based on OTR.
ashitlerferad 11y ago
moxie's stuff is, but it is designed for the always-online mobile world: https://whispersystems.org/ https://whispersystems.org/
- simoncion 11y ago
  > ...it is designed for the always-online mobile world Soft disagree with that. Signal text and voice chat works just fine if all of your communicating party's machines are offline. (Well, I mean, obviously your voice call won't be answered, but otherwise...)
  - Freak_NL 11y ago
    You can't use Signal without a smartphone running Android or IOS. Even the webapp requires a linked smartphone; a phone number is a hard requirement of Signal.
    - masklinn 11y ago
      1. that's not a property of the protocol, it's the way they implemented verification 2. it absolutely doesn't require a smartphone, just a routable phone number, that can be a cell phone, a landline, a voip number or a google voice number: http://support.whispersystems.org/hc/en-us/articles/212476118-Will-any-phone-number-work-How-do-I-get-a-verification-number- http://support.whispersystems.org/hc/en-us/articles/21247611...
    - kpcyrd 11y ago
      The jolla store for sailfish has a patched version of signal that doesn't require the google play service.
    - simoncion 11y ago
      > Even the webapp requires a linked smartphone; a phone number is [currently] a hard requirement of Signal. I never said otherwise. What I said was: > Signal text and voice chat works just fine if all of your communicating party's machines are offline. This was in response to an assertion that Signal was designed for the "always-online" world. Signal works just fine when your contact is completely offline for extended periods of time.
rakoo 11y ago
minilock (https://github.com/kaepora/miniLock/ https://github.com/kaepora/miniLock/), see the video for a good overview of how easy it is to use. I'm with moxie and Matthew Green (http://blog.cryptographyengineering.com/2014/08/whats-matter-with-pgp.html http://blog.cryptographyengineering.com/2014/08/whats-matter...), I think that we should seriously thank PGP for what it's done, understand what to do and what to not do (I believe Web of Trust is part of these) and take advantage of the fact that PGP has relatively few users to create something better.
joveian 11y ago
Unfortunately there isn't really one at this point that I know about. There are some in development. The one I am most hopeful about is briar: https://briarproject.org https://briarproject.org

DyslexicAtheist 11y ago

>> We could try to slap a GUI on top of it, but I don't believe great products are made that way. Good UX requires thinking about interactions all the way down to the protocol. unsure if I agree. A lot of the user-space Unix/Linux Gui applications are built that way: command line interface first and GUI to control that. (the opposite of windows where often a cmdline interface is built to control the functionality provided by the GUI application). So by that logic the majority of applications that have a GUI are labelled "not great products". Hmmmm ...

schwarrrtz 11y ago
I think what he means is that building a GUI wrapper around a CLI can't make up for deficiencies in the CLI itself. I don't think he's against GUIs in general.
masklinn 11y ago
> So by that logic the majority of applications that have a GUI are labelled "not great products". Hmmmm ... When it comes to Linux GUI applications, that's a pretty fair description. Understated and over-praising if anything.