8 ms·

To me, a person that doesn't (and never did) live in the US, faxes there seem to be even more ubiquitous than this article paints. Imagine my amusement when I r

To me, a person that doesn't (and never did) live in the US, faxes there seem to be even more ubiquitous than this article paints. Imagine my amusement when I registered an Amazon account only to get it suspended with the request to verify it by... faxing bank statements and whatnot. Internationally on a +1 number. [0] And yes, support was not been able to offer any alternative to that. [0] https://www.amazon.com/gp/help/customer/display.html/?nodeId=201742120 https://www.amazon.com/gp/help/customer/display.html/?nodeId...

metildaa 8y ago
Fax has a carve out in PCI & HIPPA compliance, and there is a huge existing momentum behind continuing to use fax. Alternatives for actually secure document transmission boil down to difficult to use private messaging/"secure" email systems (that only work in their walled garden). Many in the general public get frustrated with these walled gardens, as it is another login & interface to remember, and their credit union/bank, healthcare provider, company, etc will each have its own totally unique system
- Zak 8y ago
  > Alternatives for actually secure document transmission boil down to difficult to use private messaging/"secure" email systems (that only work in their walled garden). Oh bloody hell. Begin rant. We've had PGP for 27 years. Twenty seven years. Since 1991. Why the hell haven't we, the tech community, gotten the rest of the world to use it? I think the only person I've had a PGP-encrypted email exchange with is my mother. It's not a walled garden, and it solves the problem described here perfectly. We could have vote-by-email (using the key registered when registering to vote). We could have universal passwordless login. We could have virtually all communications secure from eavesdropping all the time. But no, nobody uses it outside of a few computer geeks, spies, and journalists.
  - metildaa 8y ago
    I use PGP, but it is a pain in the ass to use, severely stunting its usr. Normal people can't effectively use PGP without significant training, hence no one outside some DMCA notice bots using PGP in production for the common person to see. Even Riot with its fucked up key mismanagement is easier to use as a normie than PGP, though its looking like Riot will fix most of those trusted key management issues soon with the PRs that are about to land. Signal is the gold standard for secure, easy to use crypto at this point IMO. Hopefully Briar continues to improve tho, normie friendly metadata free communication is highly alluring, and the key management is a middle ground between Riot and Signal.
    - Zak 8y ago
      PGP isn't that hard to learn, and 20 years ago when the main form of online messaging was email, using a desktop email client, it was easier. It would be considerably harder now with everyone communicating in walled-garden platforms. I think we really missed an opportunity, and I don't see a way forward to a world where PGP keys are a widely-used basis for security communication and verifying identity online.
      - qrbLPHiKpiux 8y ago
        Key strokes required. Everyone taps today. Tapping input on a device is horribly inefficient.
        Zak 8y ago
        This is one of several reasons about 1998 would have been the right time to popularize it, not 2018.
        tim333 8y ago
        Though a plus of 2018 is people are being forced to sort out public and private keys if they want to muck about with cryptocurrency.
  - walterbell 8y ago
    IETF is working on a protocol for interoperable E2E encrypted messaging, https://datatracker.ietf.org/wg/mls/about/ https://datatracker.ietf.org/wg/mls/about/
    - Zak 8y ago
      That's cool and all, but it seems to me this is more a problem of user adoption than technology. PGP provided a pretty good solution for end-to-end encrypted messaging, and a whole bunch of people who should really be adopting that solution are using fax machines.
      - walterbell 8y ago
        Cisco, Google, Facebook, Apple and others are participating in MLS. The scale of messenger adoption is already much larger than PGP ever achieved, but they are not yet interoperable (like fax) with strong E2E encryption.
        Zak 8y ago
        Participating in the creation of a standard doesn't always lead to integration into end-user products, but we can hope.
        walterbell 8y ago
        Ubiquity is a goal, similar to WebRTC. Both protocol availability and support in widely deployed messengers will be necessary. Key/identity management will need to pass regulatory/legal scrutiny, but once we have interoperable, multi-vendor encrypted messaging that is usable by mere mortals and globally available at low cost, various groups can start lobbying for regulations that encourage migration to MLS-enabled communication. The other issue with digital messaging is endpoint security and message archives, after the message has been transported. A pile of faxes is not easily accessed remotely, unlike a disk with message archives.
  - tim333 8y ago
    I was just reading '15 reasons not to start using PGP' https://secushare.org/PGP https://secushare.org/PGP and it's quite impressive the number of issues I never would have thought of.
  - someguydave 8y ago
    >why nobody uses pgp? Well, the simple answer is that it's really only in the interest of the end-user and not in the interest of the telecom firms, platforms, or governments intermediating end-users.
  - mlindner 8y ago
    > We could have vote-by-email (using the key registered when registering to vote). This doesn't work. You still have all the problems of denial of service, hidden hacking leaking of keys, among many other issues.
- nradov 8y ago
  Direct Project secure messaging can be fully HIPAA compliant when properly implemented. Multiple vendors offer that service; it's an open standard and not a walled garden. http://wiki.directproject.org/Main_Page http://wiki.directproject.org/Main_Page
gambiting 8y ago
Until literally 3-4 years ago, if you wanted to open an Apple Developer account from outside of US, you had to fill out a "payment form" with your credit card details and fax it(!!!!) to a US-based number for "verification". And no, Apple couldn't provide any other payment options for non-US residents.

metildaa 8y ago

Fax has a carve out in PCI & HIPPA compliance, and there is a huge existing momentum behind continuing to use fax. Alternatives for actually secure document transmission boil down to difficult to use private messaging/"secure" email systems (that only work in their walled garden). Many in the general public get frustrated with these walled gardens, as it is another login & interface to remember, and their credit union/bank, healthcare provider, company, etc will each have its own totally unique system

Zak 8y ago
> Alternatives for actually secure document transmission boil down to difficult to use private messaging/"secure" email systems (that only work in their walled garden). Oh bloody hell. Begin rant. We've had PGP for 27 years. Twenty seven years. Since 1991. Why the hell haven't we, the tech community, gotten the rest of the world to use it? I think the only person I've had a PGP-encrypted email exchange with is my mother. It's not a walled garden, and it solves the problem described here perfectly. We could have vote-by-email (using the key registered when registering to vote). We could have universal passwordless login. We could have virtually all communications secure from eavesdropping all the time. But no, nobody uses it outside of a few computer geeks, spies, and journalists.
- metildaa 8y ago
  I use PGP, but it is a pain in the ass to use, severely stunting its usr. Normal people can't effectively use PGP without significant training, hence no one outside some DMCA notice bots using PGP in production for the common person to see. Even Riot with its fucked up key mismanagement is easier to use as a normie than PGP, though its looking like Riot will fix most of those trusted key management issues soon with the PRs that are about to land. Signal is the gold standard for secure, easy to use crypto at this point IMO. Hopefully Briar continues to improve tho, normie friendly metadata free communication is highly alluring, and the key management is a middle ground between Riot and Signal.
  - Zak 8y ago
    PGP isn't that hard to learn, and 20 years ago when the main form of online messaging was email, using a desktop email client, it was easier. It would be considerably harder now with everyone communicating in walled-garden platforms. I think we really missed an opportunity, and I don't see a way forward to a world where PGP keys are a widely-used basis for security communication and verifying identity online.
    - qrbLPHiKpiux 8y ago
      Key strokes required. Everyone taps today. Tapping input on a device is horribly inefficient.
      - Zak 8y ago
        This is one of several reasons about 1998 would have been the right time to popularize it, not 2018.
        tim333 8y ago
        Though a plus of 2018 is people are being forced to sort out public and private keys if they want to muck about with cryptocurrency.
- walterbell 8y ago
  IETF is working on a protocol for interoperable E2E encrypted messaging, https://datatracker.ietf.org/wg/mls/about/ https://datatracker.ietf.org/wg/mls/about/
  - Zak 8y ago
    That's cool and all, but it seems to me this is more a problem of user adoption than technology. PGP provided a pretty good solution for end-to-end encrypted messaging, and a whole bunch of people who should really be adopting that solution are using fax machines.
    - walterbell 8y ago
      Cisco, Google, Facebook, Apple and others are participating in MLS. The scale of messenger adoption is already much larger than PGP ever achieved, but they are not yet interoperable (like fax) with strong E2E encryption.
      - Zak 8y ago
        Participating in the creation of a standard doesn't always lead to integration into end-user products, but we can hope.
        walterbell 8y ago
        Ubiquity is a goal, similar to WebRTC. Both protocol availability and support in widely deployed messengers will be necessary. Key/identity management will need to pass regulatory/legal scrutiny, but once we have interoperable, multi-vendor encrypted messaging that is usable by mere mortals and globally available at low cost, various groups can start lobbying for regulations that encourage migration to MLS-enabled communication. The other issue with digital messaging is endpoint security and message archives, after the message has been transported. A pile of faxes is not easily accessed remotely, unlike a disk with message archives.
- tim333 8y ago
  I was just reading '15 reasons not to start using PGP' https://secushare.org/PGP https://secushare.org/PGP and it's quite impressive the number of issues I never would have thought of.
- someguydave 8y ago
  >why nobody uses pgp? Well, the simple answer is that it's really only in the interest of the end-user and not in the interest of the telecom firms, platforms, or governments intermediating end-users.
- mlindner 8y ago
  > We could have vote-by-email (using the key registered when registering to vote). This doesn't work. You still have all the problems of denial of service, hidden hacking leaking of keys, among many other issues.
nradov 8y ago
Direct Project secure messaging can be fully HIPAA compliant when properly implemented. Multiple vendors offer that service; it's an open standard and not a walled garden. http://wiki.directproject.org/Main_Page http://wiki.directproject.org/Main_Page

gambiting 8y ago

Until literally 3-4 years ago, if you wanted to open an Apple Developer account from outside of US, you had to fill out a "payment form" with your credit card details and fax it(!!!!) to a US-based number for "verification". And no, Apple couldn't provide any other payment options for non-US residents.