29 ms·

There's a paragraph endorsing various HTTPS form solutions that are not Google Form midway through the article, including the specific comment: > The specific

There's a paragraph endorsing various HTTPS form solutions that are not Google Form midway through the article, including the specific comment: > The specific implementation of that form really depends on your circumstances, I am not trying to sell you Google Forms specifically. Based on that and the surrounding context, the author understands that a Google Form is not always the right solution. They do tend to suggest centralized solutions rather than self-hosted ones, but that aligns with my perception that DIY sites are exponentially more likely to be hacked than Google or Zendesk are. So it seems like you're combining the argument for PGP when the argument against centralized solutions, but your footnote walks back the argument against PHP as long as the solution is not centralized. Do you agree with the author of the post that an HTTPS form is more effective than PGP, but only as long as it's not centrally hosted?

eqvinox 6y ago
> The specific implementation of that form really depends on your circumstances, I am not trying to sell you Google Forms specifically. And that's followed by a footnote: > Still, a Google Form going to a Gmail mailbox enrolled in the Advanced Protection Program is probably the most secure reporting channel against real-world threats. PGP will get misused and anything else phished before anyone gets into an APP’d Google Account. ... so it's back and forth on it. Since this is security we're talking about, I don't think it's a good idea to communicate in a style like that. People's brains will condense it down and then you're stuck with "use Google Forms", and that's what I'm arguing against. > So it seems like you're combining the argument for PGP when the argument against centralized solutions, but your footnote walks back the argument against PGP as long as the solution is not centralized. The decentralization is very high on the priorities for me on this, and the argument I really want to make is that you should be using something decentralized. PGP seems to be the established practice, and that gives it a huge edge just because people still need to deal with it anyway (and hopefully spend a bit of time learning how to use it correctly.) I also think that a message-level encryption system will beat account-level access control; I really don't want my phone to have access to security exchanges. > Do you agree with the author of the post that an HTTPS form is more effective than PGP, but only as long as it's not centrally hosted? Honestly, no, because I agree with you that I can't host a HTTPS form and get better security out of it than I do with PGP. And I think a huge part of people is in the same boat with me there. But that may not be the case for all people, hence my "If you're more comfortable with that than PGP, anyway." (…especially since that form is only half the way, you still need to somehow read the submissions…) But this is something that could change with the introduction of a pre-made FOSS kit to run a page like that.

eqvinox 6y ago

> The specific implementation of that form really depends on your circumstances, I am not trying to sell you Google Forms specifically. And that's followed by a footnote: > Still, a Google Form going to a Gmail mailbox enrolled in the Advanced Protection Program is probably the most secure reporting channel against real-world threats. PGP will get misused and anything else phished before anyone gets into an APP’d Google Account. ... so it's back and forth on it. Since this is security we're talking about, I don't think it's a good idea to communicate in a style like that. People's brains will condense it down and then you're stuck with "use Google Forms", and that's what I'm arguing against. > So it seems like you're combining the argument for PGP when the argument against centralized solutions, but your footnote walks back the argument against PGP as long as the solution is not centralized. The decentralization is very high on the priorities for me on this, and the argument I really want to make is that you should be using something decentralized. PGP seems to be the established practice, and that gives it a huge edge just because people still need to deal with it anyway (and hopefully spend a bit of time learning how to use it correctly.) I also think that a message-level encryption system will beat account-level access control; I really don't want my phone to have access to security exchanges. > Do you agree with the author of the post that an HTTPS form is more effective than PGP, but only as long as it's not centrally hosted? Honestly, no, because I agree with you that I can't host a HTTPS form and get better security out of it than I do with PGP. And I think a huge part of people is in the same boat with me there. But that may not be the case for all people, hence my "If you're more comfortable with that than PGP, anyway." (…especially since that form is only half the way, you still need to somehow read the submissions…) But this is something that could change with the introduction of a pre-made FOSS kit to run a page like that.