3 ms·

> There should just be a client side HTML5 drag and drop that encrypts files pre-transmission. The problem is that you'd be doing crypto in JavaScript. We're n

by jarrett 13y ago

> There should just be a client side HTML5 drag and drop that encrypts files pre-transmission. The problem is that you'd be doing crypto in JavaScript. We're not currently at a point where that's viable: http://www.matasano.com/articles/javascript-cryptography/ http://www.matasano.com/articles/javascript-cryptography/ Currently, if you want to securely transmit a document, you're pretty much stuck with learning and using something like PGP/GPG. Which is a pain for a lot of people, because there are new concepts to learn, software to install, and keyrings to manage. But it's the best we have right now.

arca_vorago 13y ago
I'm curious why more people aren't setting up dmz'd ssh servers on something like raspberry pi's for communication/document transfer with others. I wonder how viable a torrent like ssh p2p system would function... mumbles thoughts to self All I know is that PGP/GPG use can be a pita, and I've noticed fewer people who used to using it these days, which seems strange. (I thought the NSA revelations would have upped adoption...)
- conradev 13y ago
  It's certainly viable: http://labs.bittorrent.com/experiments/sync.html http://labs.bittorrent.com/experiments/sync.html
- jarrett 13y ago
  I'm not sure a P2P SSH system would be any better. With SSH, you still need to manage and verify keys. This is where the PITA is with PGP. People don't like generating keys, fiddling with key rings, etc. So I don't see significant usability gains there. Conceivably, you could do something with ephemeral keys, but then you're moving away from an SSH model. And ephemeral keys have their own problems. Namely, you have to verify the other person's key every time. (Often people use voice verification for this.) So while managing keyrings in PGP is annoying, so are ephemeral keys. I think crypto inherently imposes annoying burdens on end users. Also, a big advantage with PGP is that it works asynchronously. I can send you a PGP-encrypted email, and your computer doesn't even have to be turned on at the time. With P2P, both parties have to be present and have their clients running at the same time.

by jarrett 13y ago

arca_vorago 13y ago

I'm curious why more people aren't setting up dmz'd ssh servers on something like raspberry pi's for communication/document transfer with others. I wonder how viable a torrent like ssh p2p system would function... mumbles thoughts to self All I know is that PGP/GPG use can be a pita, and I've noticed fewer people who used to using it these days, which seems strange. (I thought the NSA revelations would have upped adoption...)

conradev 13y ago
It's certainly viable: http://labs.bittorrent.com/experiments/sync.html http://labs.bittorrent.com/experiments/sync.html
jarrett 13y ago
I'm not sure a P2P SSH system would be any better. With SSH, you still need to manage and verify keys. This is where the PITA is with PGP. People don't like generating keys, fiddling with key rings, etc. So I don't see significant usability gains there. Conceivably, you could do something with ephemeral keys, but then you're moving away from an SSH model. And ephemeral keys have their own problems. Namely, you have to verify the other person's key every time. (Often people use voice verification for this.) So while managing keyrings in PGP is annoying, so are ephemeral keys. I think crypto inherently imposes annoying burdens on end users. Also, a big advantage with PGP is that it works asynchronously. I can send you a PGP-encrypted email, and your computer doesn't even have to be turned on at the time. With P2P, both parties have to be present and have their clients running at the same time.