7 ms·

For the tech savvy, there are plenty of solutions to "fix the internet". From Tor to I2P, I use many of these tools regularly. Many more can be found here. http

by slacka 13y ago

For the tech savvy, there are plenty of solutions to "fix the internet". From Tor to I2P, I use many of these tools regularly. Many more can be found here. https://gist.github.com/postmodern/5018337 https://gist.github.com/postmodern/5018337 We don't need more tools, we need tools that non-geeks can use. For example, ten years ago, I worked at a company with a policy to use PGP with Symantec PGP software installed on PCs. Even the engineers sill failed to use it regularly. On several occasions I had to use logmein because the other company's IT department was incapable of setting up PGP for their own users. Ten years later and the Ask Slashdot is how get someone to send them their public key. http://ask.slashdot.org/story/13/08/10/0028235/ask-slashdot-.. http://ask.slashdot.org/story/13/08/10/0028235/ask-slashdot-.... I only have 2 contacts that I can use PGP to communicate with. Usability is the issue. Unfortunately most GNU Projects have never excelled in this area. It's too bad Mozilla dropped support for Thunderbird. Tight integration with GnuPG + a Mozilla cloud Public key directory could have made mainstream PGP a reality.

northwest 13y ago
Well, Thunderbird has the add-on called "Enigmail" which makes it easy. AFAIK there's no key directory integrated, but then again, is a key directory really a good idea? It adds another attack vector. And then of course, this only "solves" the email problem, unlike darknet solutions.
- slacka 13y ago
  Yes, it is, but the alternative is what we have now. Practically no one using PGP. You have a better idea to fix usability of PGP?
  - northwest 13y ago
    No Sir.
  - mtgx 13y ago
    Integrate it in an e-mail service that is very popular like Gmail, lead everyone through an initial set-up to create their public keys, and then tie that key to their profile. Then you won't have to know anyone's public key anymore, and everyone would be using PGP by default. The only issue is that Google would have to ensure you're creating the private key as "locally" and securely as possible, without them being able to copy that key to their servers when they're creating them. That might be very tricky, while still remaining convenient, and they may have to allow for independent audits so we can make sure they aren't transmitting the data.
- steveklabnik 13y ago
  You can ask enigmail to look at three or four different key directories if you don't have someone's key saved locally.
Joeboy 13y ago
> It's too bad Mozilla dropped support for Thunderbird. Enigmail seems to work well. At least as far as I can tell, I haven't had much of a chance to use it as I don't know anybody that uses PGP either.
- slacka 13y ago
  Enigmail is just an add-ons for Thunderbird, which Mozilla has basically end-of-lifed. My point was for a PGP client to take off, it's going to need some major backing. This is unlikely to come from Mozilla, since they've announced they're no longer dedicating resources to Thunderbird.
at-fates-hands 13y ago
>>> Even the engineers still failed to use it regularly. I used to work at a very large, publicly held company. When I got my new laptop, I realized the PGP whole disc encryption was blocking one of my video cards so I could only run one monitor with my laptop. After asking around, I soon realized exactly none of the engineers had PGP installed on their PC's. I was pretty surprised when I was told they simply asked for a clean install with nothing on their laptops and the IT people gave them what they wanted - a completely unsecured laptop with which they could customize to their own specifications. As shocking as it seemed, I was told by several of the team members that the IT support staff allowed it because they "trusted" the software engineers not to install sketchy stuff and thought they could keep their stuff more secure than say a PM. I think back now and wonder why they would take such a huge security risk.
- andrewljohnson 13y ago
  Why wonder, you answered your own question already. Its just convenience... Hard to measure security against the productivity of dual displays.
pron 13y ago
> We don't need more tools, we need tools that non-geeks can use. Why? Suppose someone comes up with these tools for the non tech-savvy, and the internet is "fixed". Now the evil government would no longer be able to spy on innocent citizens and obtain private information for its nefarious purposes, whatever those may be. Would people stop being so easily manipulated by private corporations' campaigns and will no longer surrender their private information so willingly? After all, much more information is yielded voluntarily due to deceitful corporate propaganda than due to clandestine government surveillance. How are tools going to help with that? Will tools educate the public of the ways Google and Facebook use private information to exploit their users? We don't need more tools. We need politics. We need laws to regulate both government and corporate aggregation and handling of private information.
- mikegerwitz 13y ago
  > [...] We need politics. We need laws to regulate both government and corporate aggregation and handling of private information. Sure, but I don't think the "why bother when another obstacle stands in the way?" argument is a good one. We have also seen that secret laws make regulation difficult since public oversight is not possible without government transparency; your final paragraph seems to imply current-situation + politics = trust in government and no need for privacy software.
  - pron 13y ago
    I would guess that at least 99.9% of all leaked private information is given voluntarily to corporations. Privacy software is a solution to the remaining 0.1% (probably far less than that). That's neither a solution nor a step in the right direction. In fact, I would say that it's a step in the wrong direction, as it calls attention to a far smaller threat while hiding the far bigger one. This is yet another misdirection, that only serves to give a false sense of security. Privacy software will be needed when criminal electronic surveillance becomes prevalent (as it will, some day soon). But the way it's presented now plays into the hands of those who wish to use the NSA fiasco (which, to be sure, it is) to hide a much more serious problem. It's not a solution — it's a diversion.
gasull 13y ago
> I only have 2 contacts that I can use PGP to communicate with. Usability is the issue. This is why Bitmessage is so promising. Everything is encrypted and anonymous by default. The PGP/GPG setup is a huge barrier. With Bitmessage you just need to install it and it just works.
- yapcguy 13y ago
  Bitmessage is a bad idea, read the white paper. Every message is retained forever by every BM client.
  - gasull 13y ago
    But it's encrypted.
    - unethical_ban 13y ago
      And encryption schemes never become outdated.
      - foobarqux 13y ago
        The greater risk is from having your key compromised. Forward secrecy would have protected your past messages.
  - tagawa 13y ago
    But it's better than what we have at the moment, IMO. I'd be happier using Bitmessage now (and hoping it improved with time) rather than regular email while waiting for the perfect solution to appear someday.
    - deleted 13y ago
      [deleted]
  - InXorWeTrust 13y ago
    > Every message is retained forever by every BM client. That is not true. From the white paper [0] under section 6: > We propose that nodes store all objects for two days and then delete them. It's also on the FAQ[1]: > Yes. However, if you go offline then they must come back online within 2 days of the message being sent. Nodes delete data, and do not accept data, older than 2 days. The sender will not delete the message until it's received an acknowledge from the receiver. It instead will recompute the proof of work and resend in an exponential growing interval. This is also in section 6 of [0]. > If a node is offline for more than two days, the sending node will notice that it never received an acknowledgement and rebroadcasts the message after an additional two days. It will continue to rebroadcast the message, with exponential backoff, forever. [0] https://bitmessage.org/bitmessage.pdf https://bitmessage.org/bitmessage.pdf [1] https://bitmessage.org/wiki/FAQ#Can_I_send_a_message_to_someone_that_is_offline https://bitmessage.org/wiki/FAQ#Can_I_send_a_message_to_some...
erkose 13y ago
We need technology convergence so that systems work collectively rather than in isolation. Once momentum favors the collective, ease-of-use will follow. I too am frustrated by the lack of PGP adoption.
lmm 13y ago
Gnunet isn't a new tool but a very old one. AFAIK it still provides the best P2P filesharing experience, which is good for mass adoption. And by participating in that users fuel the rest of the network, which exists and gives you the upsides of something like freenet at the same time. You're right that the UI is dated. But the code is good, with a clean, well-documented library interface. It's probably the best starting point available to build a friendly-looking layer on top of.
m0nty 13y ago
On my current contract, we go to great trouble to install whole-disk, multiuser encryption on all laptops. And then we use a trivial default password, as in one of the first few you would try if you were guessing passwords. Tech-savvy people for sure, but lazy, I guess.
- drdaeman 13y ago
  I believe, passwords, if required to be set to some default value, should be "changeme" or similar variants.
  - m0nty 13y ago
    But people don't change them unless forced to. Another place I worked, half the passwords were qwerty123 because the tech set them up in the expectation they would be changed. Another place, the passwords were usually "password". I once set up a bunch of accounts for a new domain with strong passwords which I printed on a credit card-sized laminated card, which people could keep in a wallet or purse. Mostly, this worked well, but still some people blu-tacked the cards to their desks or keyboards. It's unwinnable unless you force people to do the right thing.
anonymous 13y ago
I'm perfectly fine with there being a by-geeks-for-geeks-only-because-of-required-expertise exclusive internet club. That's how it used to be.
- Cowen 13y ago
  If it were still that way today, most of the startups that this site revolves around wouldn't exist.
  - cenhyperion 13y ago
    So let's have both!
  - sublimit 13y ago
    And that would be better, the world could do without a trillion photo apps and dazed kids trying to be businessmen.
  - deerpig 13y ago
    > If it were still that way today, most of the startups > that this site revolves around wouldn't exist. In what way? The startups wouldn't exist because the founders can't handle the tools? Or, are you saying they wouldn't exist because there wouldn't be huge markets of people sharing cats pictures. The more I think about it, both cases could both be correct, seeing how many people who call themselves developers would find it impossible to write a line of code if they didn't have eclipse....
    - FedRegister 13y ago
      I knew someone during our senior year of college that couldn't start a new Java class without using the "New Class" menu option in Eclipse. It was painful, to say the least.
awt 13y ago
Gnunet appears to be far from ready for the main stream. For anything to be useful it really needs to work on mobile, and after trying for a few hours, I can't even get it to work on my mac.

by slacka 13y ago

northwest 13y ago

Well, Thunderbird has the add-on called "Enigmail" which makes it easy. AFAIK there's no key directory integrated, but then again, is a key directory really a good idea? It adds another attack vector. And then of course, this only "solves" the email problem, unlike darknet solutions.

slacka 13y ago
Yes, it is, but the alternative is what we have now. Practically no one using PGP. You have a better idea to fix usability of PGP?
- northwest 13y ago
  No Sir.
- mtgx 13y ago
  Integrate it in an e-mail service that is very popular like Gmail, lead everyone through an initial set-up to create their public keys, and then tie that key to their profile. Then you won't have to know anyone's public key anymore, and everyone would be using PGP by default. The only issue is that Google would have to ensure you're creating the private key as "locally" and securely as possible, without them being able to copy that key to their servers when they're creating them. That might be very tricky, while still remaining convenient, and they may have to allow for independent audits so we can make sure they aren't transmitting the data.
steveklabnik 13y ago
You can ask enigmail to look at three or four different key directories if you don't have someone's key saved locally.

Joeboy 13y ago

> It's too bad Mozilla dropped support for Thunderbird. Enigmail seems to work well. At least as far as I can tell, I haven't had much of a chance to use it as I don't know anybody that uses PGP either.

slacka 13y ago
Enigmail is just an add-ons for Thunderbird, which Mozilla has basically end-of-lifed. My point was for a PGP client to take off, it's going to need some major backing. This is unlikely to come from Mozilla, since they've announced they're no longer dedicating resources to Thunderbird.

at-fates-hands 13y ago

>>> Even the engineers still failed to use it regularly. I used to work at a very large, publicly held company. When I got my new laptop, I realized the PGP whole disc encryption was blocking one of my video cards so I could only run one monitor with my laptop. After asking around, I soon realized exactly none of the engineers had PGP installed on their PC's. I was pretty surprised when I was told they simply asked for a clean install with nothing on their laptops and the IT people gave them what they wanted - a completely unsecured laptop with which they could customize to their own specifications. As shocking as it seemed, I was told by several of the team members that the IT support staff allowed it because they "trusted" the software engineers not to install sketchy stuff and thought they could keep their stuff more secure than say a PM. I think back now and wonder why they would take such a huge security risk.

andrewljohnson 13y ago
Why wonder, you answered your own question already. Its just convenience... Hard to measure security against the productivity of dual displays.

pron 13y ago

> We don't need more tools, we need tools that non-geeks can use. Why? Suppose someone comes up with these tools for the non tech-savvy, and the internet is "fixed". Now the evil government would no longer be able to spy on innocent citizens and obtain private information for its nefarious purposes, whatever those may be. Would people stop being so easily manipulated by private corporations' campaigns and will no longer surrender their private information so willingly? After all, much more information is yielded voluntarily due to deceitful corporate propaganda than due to clandestine government surveillance. How are tools going to help with that? Will tools educate the public of the ways Google and Facebook use private information to exploit their users? We don't need more tools. We need politics. We need laws to regulate both government and corporate aggregation and handling of private information.

mikegerwitz 13y ago
> [...] We need politics. We need laws to regulate both government and corporate aggregation and handling of private information. Sure, but I don't think the "why bother when another obstacle stands in the way?" argument is a good one. We have also seen that secret laws make regulation difficult since public oversight is not possible without government transparency; your final paragraph seems to imply current-situation + politics = trust in government and no need for privacy software.
- pron 13y ago
  I would guess that at least 99.9% of all leaked private information is given voluntarily to corporations. Privacy software is a solution to the remaining 0.1% (probably far less than that). That's neither a solution nor a step in the right direction. In fact, I would say that it's a step in the wrong direction, as it calls attention to a far smaller threat while hiding the far bigger one. This is yet another misdirection, that only serves to give a false sense of security. Privacy software will be needed when criminal electronic surveillance becomes prevalent (as it will, some day soon). But the way it's presented now plays into the hands of those who wish to use the NSA fiasco (which, to be sure, it is) to hide a much more serious problem. It's not a solution — it's a diversion.

gasull 13y ago

> I only have 2 contacts that I can use PGP to communicate with. Usability is the issue. This is why Bitmessage is so promising. Everything is encrypted and anonymous by default. The PGP/GPG setup is a huge barrier. With Bitmessage you just need to install it and it just works.

yapcguy 13y ago
Bitmessage is a bad idea, read the white paper. Every message is retained forever by every BM client.
- gasull 13y ago
  But it's encrypted.
  - unethical_ban 13y ago
    And encryption schemes never become outdated.
    - foobarqux 13y ago
      The greater risk is from having your key compromised. Forward secrecy would have protected your past messages.
- tagawa 13y ago
  But it's better than what we have at the moment, IMO. I'd be happier using Bitmessage now (and hoping it improved with time) rather than regular email while waiting for the perfect solution to appear someday.
  - deleted 13y ago
    [deleted]
- InXorWeTrust 13y ago
  > Every message is retained forever by every BM client. That is not true. From the white paper [0] under section 6: > We propose that nodes store all objects for two days and then delete them. It's also on the FAQ[1]: > Yes. However, if you go offline then they must come back online within 2 days of the message being sent. Nodes delete data, and do not accept data, older than 2 days. The sender will not delete the message until it's received an acknowledge from the receiver. It instead will recompute the proof of work and resend in an exponential growing interval. This is also in section 6 of [0]. > If a node is offline for more than two days, the sending node will notice that it never received an acknowledgement and rebroadcasts the message after an additional two days. It will continue to rebroadcast the message, with exponential backoff, forever. [0] https://bitmessage.org/bitmessage.pdf https://bitmessage.org/bitmessage.pdf [1] https://bitmessage.org/wiki/FAQ#Can_I_send_a_message_to_someone_that_is_offline https://bitmessage.org/wiki/FAQ#Can_I_send_a_message_to_some...

erkose 13y ago

We need technology convergence so that systems work collectively rather than in isolation. Once momentum favors the collective, ease-of-use will follow. I too am frustrated by the lack of PGP adoption.

lmm 13y ago

Gnunet isn't a new tool but a very old one. AFAIK it still provides the best P2P filesharing experience, which is good for mass adoption. And by participating in that users fuel the rest of the network, which exists and gives you the upsides of something like freenet at the same time. You're right that the UI is dated. But the code is good, with a clean, well-documented library interface. It's probably the best starting point available to build a friendly-looking layer on top of.

m0nty 13y ago

On my current contract, we go to great trouble to install whole-disk, multiuser encryption on all laptops. And then we use a trivial default password, as in one of the first few you would try if you were guessing passwords. Tech-savvy people for sure, but lazy, I guess.

drdaeman 13y ago
I believe, passwords, if required to be set to some default value, should be "changeme" or similar variants.
- m0nty 13y ago
  But people don't change them unless forced to. Another place I worked, half the passwords were qwerty123 because the tech set them up in the expectation they would be changed. Another place, the passwords were usually "password". I once set up a bunch of accounts for a new domain with strong passwords which I printed on a credit card-sized laminated card, which people could keep in a wallet or purse. Mostly, this worked well, but still some people blu-tacked the cards to their desks or keyboards. It's unwinnable unless you force people to do the right thing.

anonymous 13y ago

I'm perfectly fine with there being a by-geeks-for-geeks-only-because-of-required-expertise exclusive internet club. That's how it used to be.

Cowen 13y ago
If it were still that way today, most of the startups that this site revolves around wouldn't exist.
- cenhyperion 13y ago
  So let's have both!
- sublimit 13y ago
  And that would be better, the world could do without a trillion photo apps and dazed kids trying to be businessmen.
- deerpig 13y ago
  > If it were still that way today, most of the startups > that this site revolves around wouldn't exist. In what way? The startups wouldn't exist because the founders can't handle the tools? Or, are you saying they wouldn't exist because there wouldn't be huge markets of people sharing cats pictures. The more I think about it, both cases could both be correct, seeing how many people who call themselves developers would find it impossible to write a line of code if they didn't have eclipse....
  - FedRegister 13y ago
    I knew someone during our senior year of college that couldn't start a new Java class without using the "New Class" menu option in Eclipse. It was painful, to say the least.

awt 13y ago

Gnunet appears to be far from ready for the main stream. For anything to be useful it really needs to work on mobile, and after trying for a few hours, I can't even get it to work on my mac.