4 ms·
That's why I wrote you should research all the new info like the Doom principal (encrypt then MAC) www.thoughtcrime.org/blog/the-cryptographic-doom-principle/
by dobbsbob 13y ago
That's why I wrote you should research all the new info like the Doom principal (encrypt then MAC) www.thoughtcrime.org/blog/the-cryptographic-doom-principle/
I dont think this is easy at all just lots of articles saying dont even try it, when I bet theres more than competent people here like you who could probably pull off impressive alpha software for long and thorough peer review instead of us all being stuck with decades old clunky software like Truecrypt or GnuPG Assistant.
Who knows maybe in a year cryptocat will be excellent software at least the devs listen to auditors now
- tptacek 13y agoIn other words, you think that the people writing crypto software should simply do the work to become competent cryptographers. I strongly agree with you. I find your sentiment about GnuPG a little galling. GnuPG is widely trusted and one of the most reviewed cryptosystems in the world; you advocate that it should be replaced --- by Cryptocat, no less --- because you find it "clunky". It's as if the thought hadn't occurred to you that a better exercise than designing one's own vanity cryptosystem might instead be to come up with a new UX for an existing trustworthy system. I'm curious as to what web application you foresee supplanting Truecrypt, which is a full-disk encryption system whose entire UX is "enter the password to access this disk".
- dobbsbob 13y agoI wrote replace GnuPG Assistant not GnuPG. I have never had a problem using command line gpg or GPA but seems millions of ppl can't figure it out so they don't use it, thus NSA wins. I also dont think cryptocat should replace it (dont know where I inferred it should). TC is clunky and has distro rights problems so a lot of releases like Tails are dumping it.