8 ms·
This is great, it fills a gap that I've long defended as PGP's remaining legitimate use case. Of course, now we just need to work on the adoption problem. Despi
by bscphil 7y ago
This is great, it fills a gap that I've long defended as PGP's remaining legitimate use case. Of course, now we just need to work on the adoption problem. Despite the fact that PGP adoption is a well-known joke in itself, all the tools designed to replace it (with the exception of the IM space) have somehow managed to achieve even lower use rates.
It's been almost five years since Magic Wormhole first released, and about half a year since that popular Latacora post recommended it for transferring files, and said "Someone stick a Windows installer on a Go or Rust implementation of Magic Wormhole right away". Guess what you're still not going to find a reliable Windows build (let alone a GUI) for? Yep that's right. Despite the fact that most of these projects come from a felt need for better alternatives to PGP for the average user, very few of them have actually come up with a product that's more accessible to the average person.
- K2L8M11N2 7y agohttps://github.com/schollz/croc https://github.com/schollz/croc is written in Go, doesn’t need an installer and has worked reasonably well for me on Windows.
- psanford 7y agoThere's also https://github.com/psanford/wormhole-william https://github.com/psanford/wormhole-william. It's written in Go, doesn't need an installer and is compatible with the official wormhole client.
- qrv3w 7y agocroc does not interop with magic-wormhole but tries to accomplish the same thing. I made croc because it was really hard to install wormhole on Windows (especially for my non-dev friends). Also I wanted croc to support resuming transfers which has been stalled in wormhole for awhile now. [1] [1]: https://github.com/warner/magic-wormhole/issues/88 https://github.com/warner/magic-wormhole/issues/88
- rakoo 7y agoWhy doesn't croc use magic-wormhole's protocol ? Obviously its selling point is in the ease of installation, performance and portability, it's too bad that in doing those the compatibility is lost.
- stilisstuk 7y agoWhy is the problem with pgp? Everybody agrees? But why? It's secure and versatile?
- zaarn 7y agoPGP is secure and versatile. It's also somewhat dated and GPG is quite an awful implementation to interact with. It barely composes with anything that wants to abstract it's insane UI into something an average user understands. It has dated defaults and supports outdated cryptography, while GPG has very dated UI and refuses to properly support bindings so applications can safely interact with it.
- psanford 7y ago> about half a year since that popular Latacora post recommended it for transferring files, and said "Someone stick a Windows installer on a Go or Rust implementation of Magic Wormhole right away". I read this and then went and ported wormhole to Go: https://github.com/psanford/wormhole-william https://github.com/psanford/wormhole-william. There's no Windows installer but it's pure Go so building on Windows or cross compiling for Windows is easy. Besides Windows I also want to support iOS and Android (I have a very rough working react native frontend right now).
- tialaramex 7y agoFWIW I'd be much more comfortable recommending Magic Wormhole if the default was tweaked to give bad guys only say 1-in-2^32 or worse chance of success. It's roughly the same reasoning as for your Windows GUI argument. This tool is now very suitable for people who understand what it does, but it is not yet well adjusted for users who lack that understanding. Today - when most Magic Wormhole users can probably explain what a PAKE is - if you attack a Magic Wormhole transfer and cause errors (by guessing wrong) those users will react by increasing the length of the Wormhole code. But if we popularize it without fixing this default, do you think my sister knows to do that?
- dathinab 7y agoBut in a certain way this thinks are aspects of the magic wormhole CLI not the underlying tech. It should be trivial to increase security on failed attempts or use a higher default security for an GUI frontend. The CLI is clearly meant for somewhat technical versatile users (I mean it's a CLI) so I think it's normal to do some aprons when targeting other user groups. E.g. adding explanations over some aspects atonal to the thinks I already mentioned is quite doable for a GUI.
- globular-toast 7y agoSo how do I send an email securely without PGP? I've never been aware of any real alternative. The problem is just that people don't care enough to use it.
- brians 7y agoYou don’t. But you don’t with PGP either: bad crypto primitive defaults, no header protection including From or Subject or Reply-to, bad typical UI showing up authenticated text/plain in with authenticated parts. The case where I still use PGP is receiving reports of bugs from unaffiliated researchers, and I should replace it with a form on an HTTPS web site.
- upofadown 7y ago>no header protection including From or Subject or Reply-to This is email, not IM we are talking about. There is no good way to do that without a lot of added complexity and hassle once the email ends up in your archive. >bad crypto primitive defaults If you mean forward secrecy then see the proceeding comment.
- UncleMeat 7y agoIts not forward secrecy. Its literally that the default ciphers and modes for PGP are a mess and it is so configurable that it is full of footguns.
- deleted 7y ago[deleted]
- kjs3 7y agoI'm missing the email header issues, unless I'm trusting PGP public keys without any thought. If someone forges an email to me, has a PGP encrypted message in it, it doesn't validly decrypt unless my crypto discipline is already so lax I'm going to have issues with any system.
- tptacek 7y agoThere is now a solid Go implementation of `wormhole` (it's my daily wormhole driver). It works on Windows. It just needs a UI. Since PGP has almost no serious real-world adoption (search your feelings; you know it to be true), it's wide open for replacement. People should use `wormhole` for file transfer in preference to `age`-encrypted files, if the only reason they're encrypting is to get the file safely across the wires.
- CiPHPerCoder 7y ago> It just needs a UI. Would you consider an Electron app adequate? ;)
- oefrha 7y ago200MB binary consuming 300MB of memory and 1% CPU at idle, hell no...
- CiPHPerCoder 7y agoI asked the guy who wrote "JavaScript Cryptography Considered Harmful" if a JS app would be adequate followed by a winky face. The /s was implied.
- oefrha 7y agoYeah I did see the sarcasm.
- Dylan16807 7y agoThe document that says right at the start that it's only talking about browser Javascript crypto, and not standalone? Not that the crypto itself would be handled by Javascript in an Electron app in the first place...
- tptacek 7y agoSeriously I'm just fine with Electron applications. It's 2019, and that only for a couple more days. We have RAM, this is a good thing to burn it for.