3 ms·

Actually we went down the gpg public/private key path first, and realized that was way worse in terms of usability. Even though with symmetric you have to enter

Actually we went down the gpg public/private key path first, and realized that was way worse in terms of usability. Even though with symmetric you have to enter the password, at least average users know what that means. Try to get an an average user to do a key exchange, backup their private key or even know what a key is as some other solutions require.....

ams6110 13y ago
This is so true. At work, I never cease to be astounded at the number of people (supposedly computer literate, e.g. CS graduate students) who are just flummoxed by ssh keys. And ssh keys are relatively simple compared to GPG.
- recursive 13y ago
  As a supposedly computer literate software developer, the only place I ever hear ssh keys mentioned is on HN. I haven't encountered them anywhere else. I doubt I'm alone.
  - jlgaddis 13y ago
    Do you develop exclusively on Windows?
    - recursive 13y ago
      Correct! And there are many like me.
dfc 13y ago
Users do not need to back up their secret keys for your system? Update: I wrote my question hastily; originally this read "private keys" instead of "secret keys."
- ams6110 13y ago
  It's symmetric. There are no private keys.
- rdl 13y ago
  I don't think they do any key management.
deleted 13y ago
[deleted]
napoleond 13y ago
We're trying an approach with http://parley.co http://parley.co that involves storing a symmetrically encrypted OpenPGP keyring on the server for our users. That, combined with a UI that automatically takes care of key sharing and discovery, results in a system that's easy for the average user, integrates with the existing PGP ecosystem, and is at least as secure as a symmetric scheme (like symmetric systems, the strength is limited by the passphrase, but at least users can each have their own).
- devinhosea 13y ago
  now THAT is the way to do it! Yes, the average user has trouble grasping the CRITICAL IMPORTANCE that the user, AND ONLY THE USER, must physically hold the private key. There's no problem with having the public keyring in the cloud, and I don't even see any reason to keep it encrypted. It's called the PUBLIC key for a reason, to paraphrase Whit Diffie. You guys are on the right track...tools that make REAL 4096-bit PKE EASY are what are needed (Certainly it is an understatement to say that a 4096-bit elliptical curve DH cryptogram is "at least as secure as symmetric keys" - indeed, symmetric schemes are several orders of magnitude weaker, even with the same size passphrase) . But users will have the "inconvenience" of having to store their PRIVATE KEY on all their devices; but hey, that's not much work to be virtually impregnable. I applaud Parley's efforts!
  - kbaker 13y ago
    minor nitpick - it sounds like parley is storing the encrypted private keys on their server, encrypted with the user's passphrase. This method is the best tradeoff with cloud encryption IMO - convenience of having the key file accessible anywhere, even if it is not as secure as copying it yourself to all your devices. Also, much much better than using symmetric keys.
    - napoleond 13y ago
      Our thoughts exactly :)
  - napoleond 13y ago
medde 13y ago
If everyone teaches one person, it will not be too long before everyone knows.

ams6110 13y ago

This is so true. At work, I never cease to be astounded at the number of people (supposedly computer literate, e.g. CS graduate students) who are just flummoxed by ssh keys. And ssh keys are relatively simple compared to GPG.

recursive 13y ago
As a supposedly computer literate software developer, the only place I ever hear ssh keys mentioned is on HN. I haven't encountered them anywhere else. I doubt I'm alone.
- jlgaddis 13y ago
  Do you develop exclusively on Windows?
  - recursive 13y ago
    Correct! And there are many like me.

dfc 13y ago

Users do not need to back up their secret keys for your system? Update: I wrote my question hastily; originally this read "private keys" instead of "secret keys."

ams6110 13y ago
It's symmetric. There are no private keys.
rdl 13y ago
I don't think they do any key management.

deleted 13y ago

[deleted]

napoleond 13y ago

We're trying an approach with http://parley.co http://parley.co that involves storing a symmetrically encrypted OpenPGP keyring on the server for our users. That, combined with a UI that automatically takes care of key sharing and discovery, results in a system that's easy for the average user, integrates with the existing PGP ecosystem, and is at least as secure as a symmetric scheme (like symmetric systems, the strength is limited by the passphrase, but at least users can each have their own).

devinhosea 13y ago
now THAT is the way to do it! Yes, the average user has trouble grasping the CRITICAL IMPORTANCE that the user, AND ONLY THE USER, must physically hold the private key. There's no problem with having the public keyring in the cloud, and I don't even see any reason to keep it encrypted. It's called the PUBLIC key for a reason, to paraphrase Whit Diffie. You guys are on the right track...tools that make REAL 4096-bit PKE EASY are what are needed (Certainly it is an understatement to say that a 4096-bit elliptical curve DH cryptogram is "at least as secure as symmetric keys" - indeed, symmetric schemes are several orders of magnitude weaker, even with the same size passphrase) . But users will have the "inconvenience" of having to store their PRIVATE KEY on all their devices; but hey, that's not much work to be virtually impregnable. I applaud Parley's efforts!
- kbaker 13y ago
  minor nitpick - it sounds like parley is storing the encrypted private keys on their server, encrypted with the user's passphrase. This method is the best tradeoff with cloud encryption IMO - convenience of having the key file accessible anywhere, even if it is not as secure as copying it yourself to all your devices. Also, much much better than using symmetric keys.
  - napoleond 13y ago
    Our thoughts exactly :)
- napoleond 13y ago

medde 13y ago

If everyone teaches one person, it will not be too long before everyone knows.