7 ms·
Love this idea. Surprising that it hasn't been done yet, has it?
by tankbot 14y ago
Love this idea. Surprising that it hasn't been done yet, has it?
- javajosh 14y agoWell, the bump service itself can be the MITM. And it's not clear to me that MITM is really the biggest threat out there - seems like endpoint security is the weak link these days.
- nitrogen 14y agoFor public key exchange, it doesn't matter who gets the keys along their path from phone to phone. But, for the paranoid, you would use Bluetooth or NFC, and show a key fingerprint on both phones (ideally in the form of an algorithmically generated graphic plus the original hexadecimal) so the users can compare the images side by side and make sure the keys are valid. As for endpoint security being the weak link, I tend to agree with you, but it also depends on who is trying to snoop on your conversations, and what level of resources they have.
- mike-cardwell 14y agoThe Android application "TextSecure" for encrypting SMS using Elliptic Curve public key cryptography, by Moxie Marlinspike, allows you to validate the authenticity of keys by displaying a QR code on your phone, which the verifier scans using their phones camera.
- mike-cardwell 14y agoSounds like "STEED", which was announced about 11 months ago by the author of GnuPG: http://www.gossamer-threads.com/lists/gnupg/users/56053 http://www.gossamer-threads.com/lists/gnupg/users/56053 Although I'm not aware of any implementations yet.
- tankbot 14y agoI've seen this pop up a few times on HN now, seems a good candidate for this type of setup. Tomorrow on HN: "Hi, we're Stump! It's like Bump for messaging but with the encryption of STEED!"