3 ms·

I’m not sure what you’re pitching at this point. I said long-lived keys for data encryption is a pitfall, you pointed out SSH uses long-lived keys, I said it d

by akerl_ 5y ago

I’m not sure what you’re pitching at this point. I said long-lived keys for data encryption is a pitfall, you pointed out SSH uses long-lived keys, I said it doesn’t use them for data encryption, and now you’ve just said an unrelated true thing about SSH? There’s a huge valley of users between “casual privacy” and “nuclear launch codes”. Most humans live there. If your pitch is that your system is a casual privacy tool, just use email. Casual threats aren’t doing dragnet email surveillance or hacking email providers.

WalterBright 5y ago
> If your pitch is that your system is a casual privacy tool, just use email The lock on my front door is easily circumvented by anyone determined to get in. But we still use door locks, and locks are far more effective than otherwise. My proposal is ridiculously simple. All it requires is to standardize a single tag in the email protocol which provides a public key and agrees on a particular public key method. That's it. Email apps can support it, or not, it still works. Even if just gmail supported it, or Thunderbird, or Outlook, it will be viable.
- usrbinbash 5y ago
  >But we still use door locks, An Email is not analogous to a house, it's more akin to a tent, or a lean-to; A simple solution to a simple problem. Tent: How can we build a serviceable shelter that can be quickly un/packed, built, and costs next to nothing? Email: How can we enable everyone to send messages to everyone else with as little inconvenience as possible? Both solutions solve the stated problem, and that's it. If I want a secure shelter, a tent alone will not suffice, I have to build a ditch&wall around it. Similarly, if I want secure communication, I have to encrypt the message before sending it via Email. SMTP is not made to be secure, because that's not the problem domain it concerns itself with.

by akerl_ 5y ago

WalterBright 5y ago

> If your pitch is that your system is a casual privacy tool, just use email The lock on my front door is easily circumvented by anyone determined to get in. But we still use door locks, and locks are far more effective than otherwise. My proposal is ridiculously simple. All it requires is to standardize a single tag in the email protocol which provides a public key and agrees on a particular public key method. That's it. Email apps can support it, or not, it still works. Even if just gmail supported it, or Thunderbird, or Outlook, it will be viable.

usrbinbash 5y ago
>But we still use door locks, An Email is not analogous to a house, it's more akin to a tent, or a lean-to; A simple solution to a simple problem. Tent: How can we build a serviceable shelter that can be quickly un/packed, built, and costs next to nothing? Email: How can we enable everyone to send messages to everyone else with as little inconvenience as possible? Both solutions solve the stated problem, and that's it. If I want a secure shelter, a tent alone will not suffice, I have to build a ditch&wall around it. Similarly, if I want secure communication, I have to encrypt the message before sending it via Email. SMTP is not made to be secure, because that's not the problem domain it concerns itself with.