4 ms·

You may think you're being sarcastic, but you are just stating a true fact here. For about 99.9% of this planet's population, it's not just hard, it's something

by smsm42 1y ago

You may think you're being sarcastic, but you are just stating a true fact here. For about 99.9% of this planet's population, it's not just hard, it's something they'd never ever know how to do and have no intention to ever learn. Like it or hate it, but that's what it is. And, for 99.9% of people who know how to do that, they'd still be too lazy to do it properly (hint: where do you keep secret.txt exactly? What happens if your dog eats it?) and will use some third-party solution instead.

deleted 1y ago
[deleted]
mystifyingpoi 1y ago
> where do you keep secret.txt Reminds me of using Ansible Vault and preciously encrypting every secret (so we can say that repos doesn't contain any secrets), then just putting ~/.vault_pass in plaintext on every Ansible controller to be taken by anyone with access to the servers.
- alexpotato 1y ago
  The author of AGE has a great point in the below blog post [0]: If you use something like SOPS or just check age secrets into a git repository next to source code, you need an authentication story for the whole repository. Having authentication for the secrets will do nothing if the attacker can change the source code that decrypts and uses them. That story can simply be “we trust GitHub” like most projects. Encrypting secrets with age will keep them confidential even if the project is Open Source, and anyone wanting to replace them will have to make a PR even if they can generate a new valid age file. 0 - https://words.filippo.io/age-authentication/ https://words.filippo.io/age-authentication/
jcynix 1y ago
>where do you keep secret.txt exactly? Hidden. Encrypted. And the passphrase is: at 5,21 which is the 5th line on page 21 of your favorite book. Which you have more than one copy of, because you like it that much. And you need copies to lend. Or you have the PDF from Gutenberg.org? And 5/21 might be the birthday of your first child, or your wedding day, or whatever? It might be a favorite quote, like "Those who would give up essential Liberty, to purchase a little temporary Safety, deserve neither Liberty nor Safety." Augmented by the above date if needed?
- smsm42 1y ago
  Hidden where? Are you writing it on a post-it and putting it on top of your screen? Are you keeping it in your wallet? In a safe? What if you lose it or your house is flooded? > And 5/21 might be the birthday of your first child, or your wedding day, or whatever? How sure are you that you'd remember all that scheme for 20 years? How about 50 years? Some documents may be relevant for a very long time. What about if you need more than one key? What about if you need to give access to one document to specific set of persons? Once you consider all the scenarios that can happen through a lifetime, you start to understand why managing all those complexities correctly is not trivial. And that's why people pay third parties to do it for them. It's not because encrypting a bag of bytes is hard. It's because of all the things that surround it.
  - seb1204 1y ago
    A post it with master password on the fridge seems much safer to me than simple repeatedly used passwords. Computer can get hacket but the post it on the fridge is harder to hack.
- raincole 1y ago
  > And the passphrase is: at 5,21 which is the 5th line on page 21 of your favorite book Yeah, it's one of those things that you'll forget in N years. That's exactly what prompted "where do you keep secret.txt" question.
  - jcynix 1y ago
    As of now I have to care for my (digital) backups, that is, I cannot ignore them for N years. I had to copy things from discettes to magnetic tape, from tape to hard drives, etc. I have to periodically check my backups if they are restorable. That's life. It's the same for documents, as for secrets, which I have to transfer from one medium to another, I have to check that I remember secrets and passphrases. And places. As I already said, that's life.
    - seb1204 1y ago
disambiguation 1y ago
The double entendre occurred to me, I don't disagree. But the relative ease does not merely apply to users, but to the barrier of entry for alt products as well. Consider that the current paradigm is contingent on the "blind trust" users have held in tech for a long time. It's possible that a new kind of app will thrive in a different paradigm. For example, is there any reason we couldn't have a simple "message wrapper" which only sends encrypted payloads via SMS or Email and decrypts on the fly in a secure sandbox? Easy for the user and hard to regulate.
- wbadart 1y ago
  I think that's what Silence was (for SMS): https://f-droid.org/packages/org.smssecure.smssecure/ https://f-droid.org/packages/org.smssecure.smssecure/
arevno 1y ago
> it's something they'd never ever know how to do There are hundreds of millions of people who have memorized megabytes of baseball statistics, pop song lyrics, celebrity relationship trivia, vehicle model data, sitcom character biographies, comic book plots, makeup shades, travel routes, mixed drink recipes, MtG card modifiers, etc. At a certain point, one has to realize that pulling the "normie card" is not a viable excuse, given the wide array of knowledge that humans routinely pack into their brains.

by smsm42 1y ago

deleted 1y ago

[deleted]

mystifyingpoi 1y ago

> where do you keep secret.txt Reminds me of using Ansible Vault and preciously encrypting every secret (so we can say that repos doesn't contain any secrets), then just putting ~/.vault_pass in plaintext on every Ansible controller to be taken by anyone with access to the servers.

alexpotato 1y ago
The author of AGE has a great point in the below blog post [0]: If you use something like SOPS or just check age secrets into a git repository next to source code, you need an authentication story for the whole repository. Having authentication for the secrets will do nothing if the attacker can change the source code that decrypts and uses them. That story can simply be “we trust GitHub” like most projects. Encrypting secrets with age will keep them confidential even if the project is Open Source, and anyone wanting to replace them will have to make a PR even if they can generate a new valid age file. 0 - https://words.filippo.io/age-authentication/ https://words.filippo.io/age-authentication/

jcynix 1y ago

>where do you keep secret.txt exactly? Hidden. Encrypted. And the passphrase is: at 5,21 which is the 5th line on page 21 of your favorite book. Which you have more than one copy of, because you like it that much. And you need copies to lend. Or you have the PDF from Gutenberg.org? And 5/21 might be the birthday of your first child, or your wedding day, or whatever? It might be a favorite quote, like "Those who would give up essential Liberty, to purchase a little temporary Safety, deserve neither Liberty nor Safety." Augmented by the above date if needed?

smsm42 1y ago
Hidden where? Are you writing it on a post-it and putting it on top of your screen? Are you keeping it in your wallet? In a safe? What if you lose it or your house is flooded? > And 5/21 might be the birthday of your first child, or your wedding day, or whatever? How sure are you that you'd remember all that scheme for 20 years? How about 50 years? Some documents may be relevant for a very long time. What about if you need more than one key? What about if you need to give access to one document to specific set of persons? Once you consider all the scenarios that can happen through a lifetime, you start to understand why managing all those complexities correctly is not trivial. And that's why people pay third parties to do it for them. It's not because encrypting a bag of bytes is hard. It's because of all the things that surround it.
- seb1204 1y ago
  A post it with master password on the fridge seems much safer to me than simple repeatedly used passwords. Computer can get hacket but the post it on the fridge is harder to hack.
raincole 1y ago
> And the passphrase is: at 5,21 which is the 5th line on page 21 of your favorite book Yeah, it's one of those things that you'll forget in N years. That's exactly what prompted "where do you keep secret.txt" question.
- jcynix 1y ago
  As of now I have to care for my (digital) backups, that is, I cannot ignore them for N years. I had to copy things from discettes to magnetic tape, from tape to hard drives, etc. I have to periodically check my backups if they are restorable. That's life. It's the same for documents, as for secrets, which I have to transfer from one medium to another, I have to check that I remember secrets and passphrases. And places. As I already said, that's life.
  - seb1204 1y ago

disambiguation 1y ago

The double entendre occurred to me, I don't disagree. But the relative ease does not merely apply to users, but to the barrier of entry for alt products as well. Consider that the current paradigm is contingent on the "blind trust" users have held in tech for a long time. It's possible that a new kind of app will thrive in a different paradigm. For example, is there any reason we couldn't have a simple "message wrapper" which only sends encrypted payloads via SMS or Email and decrypts on the fly in a secure sandbox? Easy for the user and hard to regulate.

wbadart 1y ago
I think that's what Silence was (for SMS): https://f-droid.org/packages/org.smssecure.smssecure/ https://f-droid.org/packages/org.smssecure.smssecure/

arevno 1y ago

> it's something they'd never ever know how to do There are hundreds of millions of people who have memorized megabytes of baseball statistics, pop song lyrics, celebrity relationship trivia, vehicle model data, sitcom character biographies, comic book plots, makeup shades, travel routes, mixed drink recipes, MtG card modifiers, etc. At a certain point, one has to realize that pulling the "normie card" is not a viable excuse, given the wide array of knowledge that humans routinely pack into their brains.