4 ms·
This is an example where a short answer is better than a long answer. There is so much detail provided by the CEO in his explanation, that it is very difficult
by mckoss 15y ago
This is an example where a short answer is better than a long answer. There is so much detail provided by the CEO in his explanation, that it is very difficult to understand the outline of the protocol and structure of the system. Security does not derive from complexity, but rather a careful analysis of the potential attacks and their difficulty.
So, rather than allay fears about his service, I'm left feeling more skeptical about their claims.
I would love hear from people more versed in cryptographic key exchange protocols as to the basis for their claims.
And, seriously, a Michael Scott protocol?
- xcallmejudasx 15y agoThe short answer was supplied at the end of his response. He gives a step by step run down of how the encryption and decryption works. The only thing most people not familiar with crypto would probably have an issue with is understanding D-PKG(Distributed-Public Key Generators) and ECCSI(Elliptic Curve-based Certificate-less Signatures for Identifier Based Encryption). I personally wasn't familiar with D-PKGs but his response allowed me to understand what they were pretty easily.
- pbsd 15y ago> And, seriously, a Michael Scott protocol? Can you elaborate?
- dhugiaskmak 15y agohttp://en.wikipedia.org/wiki/Michael_Scott_%28The_Office%29 http://en.wikipedia.org/wiki/Michael_Scott_%28The_Office%29
- myersgp 15y agohttp://scholar.google.com/citations?user=GsM-aeEAAAAJ&hl=en http://scholar.google.com/citations?user=GsM-aeEAAAAJ&hl... Seriously
- andyshora 15y agoHow about this guy: http://www.computing.dcu.ie/people/michael-scott http://www.computing.dcu.ie/people/michael-scott
- divtxt 15y agoThe real short answer seems to be: encryption is done client-side by Javascript. I'd worry about the extra attack vectors because of that - man in the middle, snooping browser extensions, etc (or even just strong-arming them into silently changing their javascript do no encryption) To his credit, he writes about this as well: > On a trust scale, is it better to use PGP or PrivateSky if you want to be 100% sure that no one can see your data? Answer: There is no question that [...] a system such as PGP is better [...] > There is only one problem. PGP and the current state of the art are too damn hard for the general population at large to use. [...]
- Splines 15y ago> There is only one problem. PGP and the current state of the art are too damn hard for the general population at large to use. [...] I use enigmail + thunderbird, and it's pretty simple to use. It's only difficult because the tools are immature. Sending a mail and seeing a "verified from foo@bar.com", or "can only be viewed by foo@bar.com" isn't difficult to understand. The smartphone vendors are in a unique position where they could make this happen.
- ef4 15y agoThe thing is, doing it correctly still actually requires quite a bit of understanding. The hard part has always been key management. If a user doesn't have a properly managed web of trust, they have no real assurance of privacy or authenticity. I think the people who are actually in a position to fix this problem are the social networks. Imagine if the act of joining Facebook caused a keypair to be generated by you, and friending someone brought their key into your web of trust with some sensible defaults. Unfortunately Facebook has no incentive to build such a thing. But maybe something third party can leverage all those social connections to help users manage keys in a more natural way.