5 ms·
For example, being able to communicate in an encrypted way with anyone. This is not yet a solved problem, because now I can do that only with someone who is ab
by greyman 13y ago
For example, being able to communicate in an encrypted way with anyone.
This is not yet a solved problem, because now I can do that only with someone who is able and is willing to install PGP or other tools - a very limited number of people. That would be quite an achievement.
- contingencies 13y agoThat would be nice, but such a goal faces at least five major challenges: not everyone has or wants computers, those with computers these days often don't control them anymore (OTA updates to or vendor-locked devices), most people aren't educated enough to use any solutions that do exist, global discoverability requires central or at least hierarchical registration prior to key exchange, and secure key management is still so painful that average individuals are not going to opt in to it without some kind of serious requirement on their part... or deal well with a potential scenario of key loss.
- greyman 13y agoYes, that was exactly my point - solution based on secure key management doesn't work for most people, so probably something completely different should be invented. I don't have solution that would work, I was just answering the question what "cypherpunks" can work on.
- contingencies 13y agoYes, I wasn't criticizing just thinking out loud!
- mpyne 13y agoDon't forget identity management. It's easy to want to say you should be able to carry on an encrypted conversation with anyone as long as you think you can reasonably identify the other party as not being a government agent (or man-in-the-middle).
- Zigurd 13y agoEncryption using ephemeral keys is UI transparent, and requires no key management.
- contingencies 13y agoHow do you know who you're talking to?
- Zigurd 13y agoIf there is a voice or video medium in the call, you can be pretty sure. If you are concerned about MITM for text and other data media, better to use non-real-time system that would use signed keys and public key crypto. It sure would be nice if some major internet service offered a PKI-like service.
- contingencies 13y agoMost online communications (web, forums, emails) are not real time, so that kind of weighs heavily against OTR-like solutions for everything. PKI offered by a central party is not really any different to X.509 CA's today.
- Zigurd 13y agoThat's right re PKIs, which is why I said "PKI-like service." I don't believe the conventional definition of PKI is useful. What would you call it?
- contingencies 13y agoI'd call it X.509 Certificate Authorities. Unfortunately, the root of that is busted, so we should build on something else. The same thing could be done with GPG, via identity validation (jumping through whichever hoops are required to link people's claimed 'real' world identities with their keys; probably checking documentation and then signing a key). However, that's probably best achieved via some decentralized method rather than trusting a centralized corporate intermediary as per X.509 CA's.