7 ms·

How To CryptoParty

41 points by niels_olson 13y ago

blackaspen 13y ago
While I'm all for propagating the knowledge of cryptography, there was a kid in High School would walk around handing his public key out to people on slips of paper. That wasn't terribly effective for him.
- niels_olson 13y ago
  Here's my issue with that, and, hey, I sort of agree, I have found pgp to be useful among hackers, but no one outside that circle has any interest in it, even my mom, the college math teacher. But is this where the technorati has failed to fill their real social obligation? Are we the new Russian intellectuals who failed to engage the people? Are we so self-absorbed in navel-gazing on Hacker News that we fail to actually execute on the one idea that matters? If we can't restore the security of communications, how will history judge us?
  - stinkytaco 13y ago
    I love PGP, but I would think that history would judge us for not developing something more accessible rather than for not spreading PGP. Even I, a PGP user and geek, access my email via Gmail web or my phone's app most of the time rather than via my IMAP client because most people I communicate with don't use PGP and cannot be bothered to (because they also use webmail). And the sad part? I don't blame them. I'm not at my computer all the time. I don't carry it with me anymore and neither do they. They check it from work, from their phone or wherever. I don't have a solution for the problems that would plague a good crypto/identity system. Centralized trusted parties? That's worked just OK for websites and it entails a cost, and the paranoia that comes with it. A open solution like Persona? Maybe, but I don't know how to integrate that across browsers and devices without trust concerns. No, I don’t know. But I do know that PGP is a lot of trouble.
    - jiggy2011 13y ago
      It's a shame facebook doesn't allow for sharing PGP keys, that would solve the problem pretty well.
      - stinkytaco 13y ago
        It would go some of the way to solving the problem, but you've got to trust Facebook in that exchange and I'm not sure I do. The only real way to establish trust in PGP is in person (or over the phone if you really know the person). That said, I do think Facebook could go a long way to establishing a trust infrastructure.
        jiggy2011 13y ago
        You would to a point. However your facebook friends could verify you by signing your public key with their private keys. Private keys could be stored on facebook's servers but encrypted with a key that is not sent to facebook (so all client side). The signing interface could be built into the facebook UI (like a verify button). So hopefully the FB API could expose public keys for use by other apps. Not perfect, but the advantage is that people already have FB accounts linked to their real IDs.
        stinkytaco 13y ago
        This would all be good once trust is established. FB would basically become a large keyserver that people already use, with an exposed API. That's a good thought. But I would still need to verify the trust in person. Otherwise, Facebook could be the MITM. Which is, of course, the problem with the web of trust concept being exposed to the world at large. Too many people would simply establish trust for the expediency. I can see someone in my high school class signing my key and thus expecting me to do the same, without any understanding of the point of the whole business. If Facebook has shown us anything, it's that interpersonal concepts (like "friend") can be easily eroded.
        13y ago
Create 13y ago
“You can't solve social problems with software.” (Marcus Ranum).
- niels_olson 13y ago
  Right. You have to go meet people. Invite them over to your house, have dinner, and understand their concerns.
  - redblacktree 13y ago
    That sounds tedious.
    - niels_olson 13y ago
      To quote from the HN front page > What is there in this that is unbearable and beyond endurance? http://www.theatlantic.com/entertainment/archive/2013/05/marcus-aureliuss-one-question-to-beat-procrastination-whining-and-struggle/276288/ http://www.theatlantic.com/entertainment/archive/2013/05/mar...
- EthanHeilman 13y ago
  Yes you can, given three assumptions: 1. Social relations depend on communication flows (i.e. Marx was wrong the superstructure is informational). 2. Software allows new communication flows. 3. Communication, like water, finds its own level. Rearrange social relations by altering communications flows. Rearrange communication flows by creating a flow that is easier than the Status Quo. The Babylonians did this with cuneiform, the Romans did this with roads, Radio did this, TV did this, the Internet did this. Software allows you to create new communication flows. The question is what social problems can be solved by reordering social relations and to what extend these particular social relations depend on communication flows.
  - stinkytaco 13y ago
    I would argue that none of these developments solved the social problem we're talking about, however, i.e. keeping conversations private and creating trust. Indeed, these developments made it worse because face to face interaction is no longer necessary, and putting the means of communication out of your control (either by transmitting it over a medium you don't control or simply by making it so complicated you can't possibly control it) increasing the likelihood of the "man in the middle" either intercepting your communications or impersonating them. So I would say that you can reflow communication all you want, but that the underlying problem here is trust and knowledge and those are social problems. People either need to appreciate what these new communication flows mean and/or establish ways to bring their communications under their control (i.e. crypto). That said, I think the idea of establishing trust through key signing parties (and "crypto" parties) is an interesting one. One of the key features of this is learning from someone you likely don't know, just as when you do a key signing party everyone requires some sort of government ID. In the end, you've got to put your trust in someone, right? So, back to the social problem.
derrida 13y ago
I've participated in 5 of these now. I've noticed new bugs, and have a new appreciation for the art of a UI design because of it. Feel free to ask any questions or drop into the irc at #cryptoparty on irc.oftc.net (you can connect through Tor) There have been 100's of them in >50 cities. It took off when the Australian Government notified the public that they intended to increase the powers of the intelligence agencies. It's not so much teaching cryptography as it would be in a university or hacker to hacker as it is teaching people all of the pitfalls and what's hidden from the UI and what's really going on when you say, use Tor.
- niels_olson 13y ago
  What are some of your bugs and design improvements? I plan on attempting one of this in the next couple of weeks.
  - derrida 13y ago
    I was mostly helping people with Tor-related stuff and didn't have time to get a sense of the other usability issues out there in thinks like whole disk-encryption and PGP. There is a very literal UI bug that is also a security problem in the Tor Browser Bundle. If you resize the Firefox window, you increase your browsers uniqueness & thus make you easier to identify. Try this by switching off a toolbar and noticing the difference at panopticlick.eff.org Getting a piece of software like Pidgin to work through Tor was a challenge for many. The concepts of 'localhost' and sockets and a TCP-stream was challenging to get across. I don't really know the answer to this problem. These are hard issues to solve with software and the best we've got so far, I think, is education. If I had to imagine a piece of software: something like a packet filter that could go into 'incognito mode' set-up a transparent proxy and automatically flag packets that could reduce one's anonymity or reveal one's identity, then recommend steps to take in the relevant applications to get around that. It's not a completely thought through idea but maybe someone will come along and read this and it would spark the solution in their mind. There are more bugs than people, check out trac.torproject.org and see what you can do. The #tor irc channel on irc.oftc.net & tor-talk@lists.torproject.org are good places to ask questions.
peterwwillis 13y ago
It would be nice to have one website with a HOWTO for creating a business card QR code with a vCard embedded with your public key in it, and instructions on how to use it with every native e-mail client.

41 points by niels_olson 13y ago

While I'm all for propagating the knowledge of cryptography, there was a kid in High School would walk around handing his public key out to people on slips of paper. That wasn't terribly effective for him.

niels_olson 13y ago
Here's my issue with that, and, hey, I sort of agree, I have found pgp to be useful among hackers, but no one outside that circle has any interest in it, even my mom, the college math teacher. But is this where the technorati has failed to fill their real social obligation? Are we the new Russian intellectuals who failed to engage the people? Are we so self-absorbed in navel-gazing on Hacker News that we fail to actually execute on the one idea that matters? If we can't restore the security of communications, how will history judge us?
- stinkytaco 13y ago
  I love PGP, but I would think that history would judge us for not developing something more accessible rather than for not spreading PGP. Even I, a PGP user and geek, access my email via Gmail web or my phone's app most of the time rather than via my IMAP client because most people I communicate with don't use PGP and cannot be bothered to (because they also use webmail). And the sad part? I don't blame them. I'm not at my computer all the time. I don't carry it with me anymore and neither do they. They check it from work, from their phone or wherever. I don't have a solution for the problems that would plague a good crypto/identity system. Centralized trusted parties? That's worked just OK for websites and it entails a cost, and the paranoia that comes with it. A open solution like Persona? Maybe, but I don't know how to integrate that across browsers and devices without trust concerns. No, I don’t know. But I do know that PGP is a lot of trouble.
  - jiggy2011 13y ago
    It's a shame facebook doesn't allow for sharing PGP keys, that would solve the problem pretty well.
    - stinkytaco 13y ago
      It would go some of the way to solving the problem, but you've got to trust Facebook in that exchange and I'm not sure I do. The only real way to establish trust in PGP is in person (or over the phone if you really know the person). That said, I do think Facebook could go a long way to establishing a trust infrastructure.
      - jiggy2011 13y ago
        You would to a point. However your facebook friends could verify you by signing your public key with their private keys. Private keys could be stored on facebook's servers but encrypted with a key that is not sent to facebook (so all client side). The signing interface could be built into the facebook UI (like a verify button). So hopefully the FB API could expose public keys for use by other apps. Not perfect, but the advantage is that people already have FB accounts linked to their real IDs.
        stinkytaco 13y ago
        This would all be good once trust is established. FB would basically become a large keyserver that people already use, with an exposed API. That's a good thought. But I would still need to verify the trust in person. Otherwise, Facebook could be the MITM. Which is, of course, the problem with the web of trust concept being exposed to the world at large. Too many people would simply establish trust for the expediency. I can see someone in my high school class signing my key and thus expecting me to do the same, without any understanding of the point of the whole business. If Facebook has shown us anything, it's that interpersonal concepts (like "friend") can be easily eroded.
        13y ago

Create 13y ago

“You can't solve social problems with software.” (Marcus Ranum).

niels_olson 13y ago
Right. You have to go meet people. Invite them over to your house, have dinner, and understand their concerns.
- redblacktree 13y ago
  That sounds tedious.
  - niels_olson 13y ago
    To quote from the HN front page > What is there in this that is unbearable and beyond endurance? http://www.theatlantic.com/entertainment/archive/2013/05/marcus-aureliuss-one-question-to-beat-procrastination-whining-and-struggle/276288/ http://www.theatlantic.com/entertainment/archive/2013/05/mar...
EthanHeilman 13y ago
Yes you can, given three assumptions: 1. Social relations depend on communication flows (i.e. Marx was wrong the superstructure is informational). 2. Software allows new communication flows. 3. Communication, like water, finds its own level. Rearrange social relations by altering communications flows. Rearrange communication flows by creating a flow that is easier than the Status Quo. The Babylonians did this with cuneiform, the Romans did this with roads, Radio did this, TV did this, the Internet did this. Software allows you to create new communication flows. The question is what social problems can be solved by reordering social relations and to what extend these particular social relations depend on communication flows.
- stinkytaco 13y ago
  I would argue that none of these developments solved the social problem we're talking about, however, i.e. keeping conversations private and creating trust. Indeed, these developments made it worse because face to face interaction is no longer necessary, and putting the means of communication out of your control (either by transmitting it over a medium you don't control or simply by making it so complicated you can't possibly control it) increasing the likelihood of the "man in the middle" either intercepting your communications or impersonating them. So I would say that you can reflow communication all you want, but that the underlying problem here is trust and knowledge and those are social problems. People either need to appreciate what these new communication flows mean and/or establish ways to bring their communications under their control (i.e. crypto). That said, I think the idea of establishing trust through key signing parties (and "crypto" parties) is an interesting one. One of the key features of this is learning from someone you likely don't know, just as when you do a key signing party everyone requires some sort of government ID. In the end, you've got to put your trust in someone, right? So, back to the social problem.

derrida 13y ago

I've participated in 5 of these now. I've noticed new bugs, and have a new appreciation for the art of a UI design because of it. Feel free to ask any questions or drop into the irc at #cryptoparty on irc.oftc.net (you can connect through Tor) There have been 100's of them in >50 cities. It took off when the Australian Government notified the public that they intended to increase the powers of the intelligence agencies. It's not so much teaching cryptography as it would be in a university or hacker to hacker as it is teaching people all of the pitfalls and what's hidden from the UI and what's really going on when you say, use Tor.

niels_olson 13y ago
What are some of your bugs and design improvements? I plan on attempting one of this in the next couple of weeks.
- derrida 13y ago
  I was mostly helping people with Tor-related stuff and didn't have time to get a sense of the other usability issues out there in thinks like whole disk-encryption and PGP. There is a very literal UI bug that is also a security problem in the Tor Browser Bundle. If you resize the Firefox window, you increase your browsers uniqueness & thus make you easier to identify. Try this by switching off a toolbar and noticing the difference at panopticlick.eff.org Getting a piece of software like Pidgin to work through Tor was a challenge for many. The concepts of 'localhost' and sockets and a TCP-stream was challenging to get across. I don't really know the answer to this problem. These are hard issues to solve with software and the best we've got so far, I think, is education. If I had to imagine a piece of software: something like a packet filter that could go into 'incognito mode' set-up a transparent proxy and automatically flag packets that could reduce one's anonymity or reveal one's identity, then recommend steps to take in the relevant applications to get around that. It's not a completely thought through idea but maybe someone will come along and read this and it would spark the solution in their mind. There are more bugs than people, check out trac.torproject.org and see what you can do. The #tor irc channel on irc.oftc.net & tor-talk@lists.torproject.org are good places to ask questions.

peterwwillis 13y ago

It would be nice to have one website with a HOWTO for creating a business card QR code with a vCard embedded with your public key in it, and instructions on how to use it with every native e-mail client.