3 ms·

Browsers just need to actually get on the security bandwagon and build support for public key crypotagraphy into an api. Then you could generate keys, export th

Browsers just need to actually get on the security bandwagon and build support for public key crypotagraphy into an api. Then you could generate keys, export them to back them up / use them on different machines, and these solutions would actually be usable. As in, I could type in someone's email address, and it would find their public key and encrypt the message to them. People have known since the 70s that symmetric encryption is just not easy enough to use for normal people (key exchange is hard). We have local storage - why can't be have local keys? Realistically, I bet the way this will mostly be used is that people will exchange keys through an unsecure medium (like, a non-encrypted GMail message, or if people are being clever, GTalk...), and the whole thing will feel good but be nothing that a little bit of work on Googles end couldn't undo.

LoganCale 13y ago
It doesn't matter if public keys are exchanged through an insecure medium as long as there is a way to verify them. Someone else seeing the key is not a problem, so Google being able to find them after the fact would be fine. The problem comes from being able to MITM them and swap it out with a fake key controlled by the attacker. Verifying the key fingerprint (using GPG terminology here, don't know how it applies elsewhere) after via another means (ideally voice or video) would confirm it's a legitimate key.
- ams6110 13y ago
  A cool idea I saw a while back, http://robohash.org http://robohash.org Generating an easy-to-recognize image from the key fingerprint would be a lot more approachable to the casual user than trying to verify a long hexadecimal number. I guess you're then trusting whatever 3rd party handles the image generation.... but at some point you have to trust software that you didn't write yourself.
  - IgorPartola 13y ago
    Collisions and subtle differences that make the two robots look close enough would make this a vector of attack.

LoganCale 13y ago

It doesn't matter if public keys are exchanged through an insecure medium as long as there is a way to verify them. Someone else seeing the key is not a problem, so Google being able to find them after the fact would be fine. The problem comes from being able to MITM them and swap it out with a fake key controlled by the attacker. Verifying the key fingerprint (using GPG terminology here, don't know how it applies elsewhere) after via another means (ideally voice or video) would confirm it's a legitimate key.

ams6110 13y ago
A cool idea I saw a while back, http://robohash.org http://robohash.org Generating an easy-to-recognize image from the key fingerprint would be a lot more approachable to the casual user than trying to verify a long hexadecimal number. I guess you're then trusting whatever 3rd party handles the image generation.... but at some point you have to trust software that you didn't write yourself.
- IgorPartola 13y ago
  Collisions and subtle differences that make the two robots look close enough would make this a vector of attack.