4 ms·

I don't think we need serious secure messengers, because we mostly don't need to send secure messages. Email is "mail on the internet". Mail isn't secure. We u

I don't think we need serious secure messengers, because we mostly don't need to send secure messages. Email is "mail on the internet". Mail isn't secure. We use mail everywhere for everything. Occasionally there can be some security problems with conventional mail, but they're fairly rare and we tend to get on with life. And if you need to send a secret via the mail, you can do what the military has been doing for 2,000 years and encrypt your message contents. So I agree, we should stop freaking out about mail. But we need a secure messaging system? We didn't seem to need it for the post. For the average hacker it's nearly impossible to break into modern messaging systems, centralized and encrypted as they are today. And a lot of us live in free societies where repressive regimes don't legally get to spy on our messages. Now, this will change in 20 years when China starts spreading its form of Communism around the world similar to how we spread Democracy, as more nations will start adopting internet censorship. But as we've seen with a lot of censorship-circumvention technology, the authorities are pretty successful at blocking or banning the means, and providing state-sponsored replacements when they can't effectively do that. If you want someone to deliver you a secret today, nearly any messaging service will do. If you don't want to rely on a particular central messaging service, you have to go back to PKI or public-key crypto, which nobody wants to do. Basically, we have "good enough" solutions today, and we have better solutions that people can use if they have to. So I don't think a new secure messaging system is warranted.

dane-pgp 9y ago
You might think we mostly don't need to send secure messages, but remember, Pervasive Monitoring Is an Attack (BCP-188): https://www.rfc-editor.org/bcp/bcp188.txt https://www.rfc-editor.org/bcp/bcp188.txt
- peterwwillis 9y ago
  First of all, most messaging platforms today are encrypted, so that rfc wouldn't really apply except to monitoring by the company providing the service, and that's the price you pay for "free stuff on the internet". Second, almost all the "attackers" are nation-states and your ISP. If it's illegal to read your mail, it should be illegal to read your email (simple regulatory fix). That just leaves spy organizations, and nobody but computer geeks and privacy nutjobs cares about that.
  - dane-pgp 9y ago
    First of all, some messaging platforms today are End-to-End encrypted, which is in keeping with the thinking behind that RFC. Given that such models of communication are available as "free stuff on the internet", we shouldn't expect anything less than that from now on (and we should be improving email protocols and implementations to offer at least an equivalent level of privacy). Second, your "simple regulatory fix" is proving to be not so simple in many nation-states, even ones which claim to be democracies, and I don't think we should ignore people's need for privacy and security while we wait for government policy to fix itself. Indeed, if we do not strengthen the level of privacy and security that people enjoy, the job of fixing government policy becomes that much harder. To give some examples of recent attacks that even non-technical users need to think about (or at least be protected from), consider these: https://www.eff.org/deeplinks/2014/11/verizon-x-uidh https://www.eff.org/deeplinks/2014/11/verizon-x-uidh https://www.washingtonpost.com/news/the-switch/wp/2015/03/30/china-has-weaponized-the-great-firewall-says-a-free-speech-group/ https://www.washingtonpost.com/news/the-switch/wp/2015/03/30...

dane-pgp 9y ago

You might think we mostly don't need to send secure messages, but remember, Pervasive Monitoring Is an Attack (BCP-188): https://www.rfc-editor.org/bcp/bcp188.txt https://www.rfc-editor.org/bcp/bcp188.txt

peterwwillis 9y ago
First of all, most messaging platforms today are encrypted, so that rfc wouldn't really apply except to monitoring by the company providing the service, and that's the price you pay for "free stuff on the internet". Second, almost all the "attackers" are nation-states and your ISP. If it's illegal to read your mail, it should be illegal to read your email (simple regulatory fix). That just leaves spy organizations, and nobody but computer geeks and privacy nutjobs cares about that.
- dane-pgp 9y ago
  First of all, some messaging platforms today are End-to-End encrypted, which is in keeping with the thinking behind that RFC. Given that such models of communication are available as "free stuff on the internet", we shouldn't expect anything less than that from now on (and we should be improving email protocols and implementations to offer at least an equivalent level of privacy). Second, your "simple regulatory fix" is proving to be not so simple in many nation-states, even ones which claim to be democracies, and I don't think we should ignore people's need for privacy and security while we wait for government policy to fix itself. Indeed, if we do not strengthen the level of privacy and security that people enjoy, the job of fixing government policy becomes that much harder. To give some examples of recent attacks that even non-technical users need to think about (or at least be protected from), consider these: https://www.eff.org/deeplinks/2014/11/verizon-x-uidh https://www.eff.org/deeplinks/2014/11/verizon-x-uidh https://www.washingtonpost.com/news/the-switch/wp/2015/03/30/china-has-weaponized-the-great-firewall-says-a-free-speech-group/ https://www.washingtonpost.com/news/the-switch/wp/2015/03/30...