4 ms·

I love PGP, but let's be honest, it's not user friendly in the slightest. It's an esoteric bolt-on to email that requires both ends to want to use it and go thr

by Sanzig 5y ago

I love PGP, but let's be honest, it's not user friendly in the slightest. It's an esoteric bolt-on to email that requires both ends to want to use it and go through the trouble of setting it up, which basically means that it's really only useful to nerds and people with sufficient requirement for secrecy that they actually go through the trouble. Services like Signal are great because they're E2EE by default and they're user friendly. We got my tech illiterate mother and stepfather on Signal so they could participate in family group chats. No way she would have been able to navigate GPG. As for the issue you're bringing up about the endpoint getting compromised, the simple solution is a retention policy (disappearing messages), which Signal has supported for some time now. It doesn't help if the allegiance of owner of that endpoint is flipped (they can simply screenshot future messages), but it does prevent the adversary from getting a full text dump of previous conversations if they swipe the phone for example.

upofadown 5y ago
>Services like Signal are great because they're E2EE by default and they're user friendly. Signal might be a bad example because it is not really that user friendly when it comes to the hard bit. That is: confirming that you are actually connected to who you think you are connected to and not some third party. In a usability study involving Signal[1], 21 out of 28 computer science students failed to establish and maintain a secure end to end encrypted connection. We should not kid ourselves into thinking that the usability of end to end encrypted messaging has been solved. It is very much still an outstanding issue. [1] https://www.ndss-symposium.org/wp-content/uploads/2018/03/09-when-signal-hits-the-fan-on-the-usability-and-security-of-state-of-the-art-secure-mobile-messaging.pdf https://www.ndss-symposium.org/wp-content/uploads/2018/03/09...

by Sanzig 5y ago

upofadown 5y ago

>Services like Signal are great because they're E2EE by default and they're user friendly. Signal might be a bad example because it is not really that user friendly when it comes to the hard bit. That is: confirming that you are actually connected to who you think you are connected to and not some third party. In a usability study involving Signal[1], 21 out of 28 computer science students failed to establish and maintain a secure end to end encrypted connection. We should not kid ourselves into thinking that the usability of end to end encrypted messaging has been solved. It is very much still an outstanding issue. [1] https://www.ndss-symposium.org/wp-content/uploads/2018/03/09-when-signal-hits-the-fan-on-the-usability-and-security-of-state-of-the-art-secure-mobile-messaging.pdf https://www.ndss-symposium.org/wp-content/uploads/2018/03/09...