6 ms·

I wonder why moxie's Convergence [0] didn't take off. To me it sounds near-perfect. It could handle multiple layers of authenticity, including DNS. The project

by _jomo 10y ago

I wonder why moxie's Convergence [0] didn't take off. To me it sounds near-perfect. It could handle multiple layers of authenticity, including DNS. The project has been inactive on GitHub for 5 years [1], however the Namecoin project picked it up [2] as "FreeSpeechMe" and added support for IPv6, and .bit, .onion, .b32.i2p domains. Now this, too, has been discontinued "because Mozilla removed the relevant API's as of Firefox 33". They "intend to release a replacement soon". According to Jeremy Rand [3] "A replacement is in the works (and is mostly working already)", but the source doesn't seem to be public or I can't find it. Are there any downsides of Convergence? 0: https://www.youtube.com/watch?v=Z7Wl2FW2TcA https://www.youtube.com/watch?v=Z7Wl2FW2TcA 1: https://github.com/moxie0/Convergence/ https://github.com/moxie0/Convergence/ 2: https://github.com/namecoin/Convergence/ https://github.com/namecoin/Convergence/ 3: https://twitter.com/biolizard89/status/712525859194798080 https://twitter.com/biolizard89/status/712525859194798080

CiPHPerCoder 10y ago
> Are there any downsides of Convergence? Your web browser grinds to a halt because almost no one runs a notary. I tried using it for a while.
StavrosK 10y ago
IIRC, Google didn't want to run it because they'd end up running all the notaries themselves, which they didn't want to do.
- _jomo 10y ago
  So according to this and CiPHPerCoder's comment, the only reason it didn't take off is that it didn't take off? Edit: found the comment from Adam Langley [0]. They didn't want to add it to Chrome because it wouldn't meet standards for the preferences UI inclusion, practically everyone would just rely on the default notaries, so Google would have to guarantee notary uptime, thus being forced to run them on their own. He doesn't really point out why they don't include it as an optional alternative without any notaries pre-configured. He does however say that running it as an extension would be fine, but the required APIs weren't available at the time of writing. 0: https://www.imperialviolet.org/2011/09/07/convergence.html https://www.imperialviolet.org/2011/09/07/convergence.html
tptacek 10y ago
To me, HPKP, surveillance, and God willing a better UX for certificates would get us 80% of the way to Convergence.
internals 10y ago
One big challenge was it didn't account for gated hotspots (hotels, Starbucks, etc) where you need to authenticate to reach the Internet.
y0ghur7_xxx 10y ago
I like it too. The cons just don't exist in my pow: one downside was that it didn't work on things like airport access points, but those break regular tls too. an other downside was the fact that google didn't want to integrate it in chrome because the notaries would have to be always up. now they run transparency logs that have to be always up anyway. so.. what's the difference? The Perspectives Project piked up the idea, and it seems less dead that Convergence: https://perspectives-project.org/ https://perspectives-project.org/

by _jomo 10y ago

CiPHPerCoder 10y ago

> Are there any downsides of Convergence? Your web browser grinds to a halt because almost no one runs a notary. I tried using it for a while.

StavrosK 10y ago

IIRC, Google didn't want to run it because they'd end up running all the notaries themselves, which they didn't want to do.

_jomo 10y ago
So according to this and CiPHPerCoder's comment, the only reason it didn't take off is that it didn't take off? Edit: found the comment from Adam Langley [0]. They didn't want to add it to Chrome because it wouldn't meet standards for the preferences UI inclusion, practically everyone would just rely on the default notaries, so Google would have to guarantee notary uptime, thus being forced to run them on their own. He doesn't really point out why they don't include it as an optional alternative without any notaries pre-configured. He does however say that running it as an extension would be fine, but the required APIs weren't available at the time of writing. 0: https://www.imperialviolet.org/2011/09/07/convergence.html https://www.imperialviolet.org/2011/09/07/convergence.html

tptacek 10y ago

To me, HPKP, surveillance, and God willing a better UX for certificates would get us 80% of the way to Convergence.

internals 10y ago

One big challenge was it didn't account for gated hotspots (hotels, Starbucks, etc) where you need to authenticate to reach the Internet.

y0ghur7_xxx 10y ago

I like it too. The cons just don't exist in my pow: one downside was that it didn't work on things like airport access points, but those break regular tls too. an other downside was the fact that google didn't want to integrate it in chrome because the notaries would have to be always up. now they run transparency logs that have to be always up anyway. so.. what's the difference? The Perspectives Project piked up the idea, and it seems less dead that Convergence: https://perspectives-project.org/ https://perspectives-project.org/