3 ms·
Summary: The author decided that being connected to long term keys does more harm than good, partly due to the pressure to stay with potentially compromised key
by joveian 10y ago
Summary: The author decided that being connected to long term keys does more harm than good, partly due to the pressure to stay with potentially compromised keys due to the difficulty of starting over. The author will instead focus on secure IM using short term keys bootstrapped by social media accounts.
1) As others have pointed out, I really think the author is overestimating the effort required to compromise a twitter or other social media account. There are many accounts of this happening, including to people like Brian Krebs who knows he is a target and does everything possible to avoid the attacks.
2) Encrypted IM as the primary higher security communication channel seems to be a popular option these days, mostly leaving those of us who don't like IM to look at alternatives.
3) Briar (briarproject.org) is a promising alternative for messaging, although not ready yet and currently only targeting android, which has its own major security issues. Due to the focus on enabling offline, forward secure messaging, it can be used to defeat mass (network) survailance. It can also be used online and addresses some of the specific concerns raised.
4) General purpose computers are both handy and necessarily have security issues. Special purpose devices for more limited secure communication would help with many issues.
5) Secure communication isn't much of a goal; it is more helpful to consider specific threats. If you do something non-trivial towards a vague goal, it is easy to find a way it doesn't meet that goal when you feel like not doing it any more. I'm not sure what the author was trying to achieve with PGP in the first place.
- colejohnson66 10y agoKind of off topic: I really like iMessage. Not to be an Apple fanboi, but it really is one of those things where It Just Works(tm). Encryption shouldn't have to be something the end user has to worry about; it should be transparent to the user while still being as secure as possible (HTTPS and TLS are a great example of this). For the user who cares about encryption, they don't have to configure anything. For the user that doesn't care, they still benefit. By baking it into the OS, Apple ensures that anyone with an iDevice benefits from it. Compare that to having to download an app that may change depending on possible compromises. Anyone who's tried to convince a family member to use Signal, Telegram, etc. knows how much of a pain it is.
- click170 10y ago> By baking it into the OS, Apple ensures that anyone with an iDevice benefits from it. But only people with iDevices benefit from it. I prefer Signal to iMessage because iMessage is iOS only, and I'm disappointed with Google for not including an iMessage equivalent with secure messaging by default. > Compare that to having to download an app that may change depending on possible compromises. If you mean what I think you mean, using iMessage will not save you/them from this any more than using Signal would, the only benefit to iMessage is that it's already installed on iDevices when you buy them and has secure-messaging enabled by default. Which is still a step above Android currently - which has no default-installed secure messaging app at all. I'm lookin at you Google!