5 ms·

>You don't. The same way that you don't ensure your recipient doesn't leak screenshots of signal conversations to icloud. Again, if your counter party is an id

>You don't. The same way that you don't ensure your recipient doesn't leak screenshots of signal conversations to icloud. Again, if your counter party is an idiot nothing will save you.

joshuamorton 7y ago
Good protocols prevent people from shooting themselves in the foot. A good protocol will get in your way if you try to do something insecure. PGP doesn't do that, see "oops I accidentally forwarded the plaintext of my encrypted email" vs. Gmail and Outlook's "confidential" modes, which prevent accidental exfiltration via forwarding or copying. They're possible to circumvent, but you have to make an effort to do it. PGP requires that you not only not be careless, but be near-perfect, and that every counterparty does the same. Good protocols prevent you from making mistakes that spew your plaintexts everywhere. In other words, I want a protocol that doesn't necessarily protect me from idiots, but does protect me from humans who occasionally act imperfectly.
- blacklion 7y ago
  It is not problem of protocol. It is problem of user agent. And, yes, all webmails is incredibly crappy user agents. Stop using webmails! On the other hand, UA (for any protocl) which will not allow copy'n'paste from is crappy by definition and nobody could stop your recipient to copy'n'paste plain text from your message. Ultimately, it is THEIR message as much as YOUR message! On the side note, I think that GMail is worst thing that has happened both to the web and to e-mail.
  - GoblinSlayer 7y ago
    People don't share information in text anymore, they share screenshots and screen photos, it's infuriating.
  - joshuamorton 7y ago
    Secure protocols ensure that user agents are secure, as part of the protocol. A secure protocol would, for example, not mix plaintext and encyrpted text messages, but would ensure that all messages were always encrypted. This way a we'll designed user agent couldn't accidentally mix cypher and plaintext messages. I'm not arguing that UAs should do user hostile things in the name of security, which is the straw man you're arguing against. Nor did I mention anything webmail specific. I'm saying that a security protocol shouldn't have, in practice, fail open attributes that user agents have to put warnings up about. A good protocol should allow the UA to entirely hide those dangers. This is abundantly clear if you try to use any pgp mail client vs any signal protocol client. The protocol makes it easier for UAs to be both more secure and more user friendly.

>You don't. The same way that you don't ensure your recipient doesn't leak screenshots of signal conversations to icloud. Again, if your counter party is an idiot nothing will save you.

joshuamorton 7y ago

Good protocols prevent people from shooting themselves in the foot. A good protocol will get in your way if you try to do something insecure. PGP doesn't do that, see "oops I accidentally forwarded the plaintext of my encrypted email" vs. Gmail and Outlook's "confidential" modes, which prevent accidental exfiltration via forwarding or copying. They're possible to circumvent, but you have to make an effort to do it. PGP requires that you not only not be careless, but be near-perfect, and that every counterparty does the same. Good protocols prevent you from making mistakes that spew your plaintexts everywhere. In other words, I want a protocol that doesn't necessarily protect me from idiots, but does protect me from humans who occasionally act imperfectly.

blacklion 7y ago
It is not problem of protocol. It is problem of user agent. And, yes, all webmails is incredibly crappy user agents. Stop using webmails! On the other hand, UA (for any protocl) which will not allow copy'n'paste from is crappy by definition and nobody could stop your recipient to copy'n'paste plain text from your message. Ultimately, it is THEIR message as much as YOUR message! On the side note, I think that GMail is worst thing that has happened both to the web and to e-mail.
- GoblinSlayer 7y ago
  People don't share information in text anymore, they share screenshots and screen photos, it's infuriating.
- joshuamorton 7y ago
  Secure protocols ensure that user agents are secure, as part of the protocol. A secure protocol would, for example, not mix plaintext and encyrpted text messages, but would ensure that all messages were always encrypted. This way a we'll designed user agent couldn't accidentally mix cypher and plaintext messages. I'm not arguing that UAs should do user hostile things in the name of security, which is the straw man you're arguing against. Nor did I mention anything webmail specific. I'm saying that a security protocol shouldn't have, in practice, fail open attributes that user agents have to put warnings up about. A good protocol should allow the UA to entirely hide those dangers. This is abundantly clear if you try to use any pgp mail client vs any signal protocol client. The protocol makes it easier for UAs to be both more secure and more user friendly.