4 ms·

So make something better that people will actually use--then the question of what to use will become a no-brainer. "Just use Foo." The "best" alternative to som

So make something better that people will actually use--then the question of what to use will become a no-brainer. "Just use Foo." The "best" alternative to something like Cryptocat is Pidgin/Adium+OTR plugins, and you can't seriously claim they're as usable (nor are their implementations actually perfect.) If not that, then help to fix whatever issues the popular tools have. (They're open source, after all.) Make formal security proofs, implement them, open source your prototypes, and have them vetted by as many cryptographers as possible (so one or two if you're lucky.) Then figure out how to market your product. By far the hardest aspect of cryptography engineering is getting people to use your software in the first place. It doesn't matter how good you are at crypto if your software is never used. It's very easy to criticize. Much harder to actually make more secure, more usable alternatives. (And, ironically, the people who ought to be doing this the most are much more hesitant to do so since they know of many more subtle ways to make mistakes.)

Joeboy 13y ago
> By far the hardest aspect of cryptography engineering is getting people to use your software in the place. I think perhaps a neglected aspect of the problem is how to turn difficult social / political problems (eg. nobody uses PGP and people think you're a weirdo if you try to persuade them to) into tractable technical problems (the kind cryptographers mostly talk about). I sometimes think it would be preferable to start from a point where everybody had public and private keys and knew how to use them, but the crypto was no better then ROT13, than the current situation where the crypto is pretty good but getting people to use it is nearly impossible. I also think the emotive "bad crypto puts lives at risk" argument only really makes sense if you're talking about crypto for the military or a small number of political activists, who will in any case benefit if their encrypted transmissions are buried among everybody else's. Those people need to be more careful than the rest of us with our more quotidian privacy concerns. I would rather have more bad (but tractable) crypto than great crypto that is used by nobody. Hopefully somebody will persuade me I am wrong about this so I can stop feeling like a crypto heretic.
- zAy0LfpBZLC8mAC 13y ago
  Cryptographic communication tools have a network effect (just like any other communication system), so it's kinda pointless if only the few high-profile activists use it. Also, that would make them stick out, thus reducing their security in some ways. If you can detect the important people by the communications protocol that they are using, you already have the most important part of the information without any need to decrypt anything. Them being buried among bad cryptoraphy most likely won't work - making cryptography indistinguishable is one of the hard parts, so it's one of the properties that bad tools are unlikely to have. Also, a part of the social/political problem is that people tend to not know that the crypto they are using is bad, and political activists tend to not necessarily be cryptography experts either, so how would they know that they are in danger when everyone around them tells them that the broken crypto they are using is the thing to use?
  - Joeboy 13y ago
    Your first paragraph seems to be more or less agreeing with what I said - maybe I misunderstand. > Also, a part of the social/political problem is that > people tend to not know that the crypto they are using is > bad, and political activists tend to not necessarily be > cryptography experts either, so how would they know that > they are in danger when everyone around them tells them > that the broken crypto they are using is the thing to use? But there is always going to be a problem with telling people "use our software and you can organise the overthrow of your government without fear". There is no way around the fact that people who are doing that need to understand the risks better than most people do. (How are you supposed to blockquote text on HN?)
    - zAy0LfpBZLC8mAC 13y ago
      I at least did not intend to agree ;-) - my point is that cryptographic communication tools are kindof useless for activists unless they are used by a large number of people in general, both because otherwise they are isolated and can not actually communicate with anyone using the system (except for a few other activists), and because using the tool would make them stick out, which is why they are also indirectly somewhat useless for the general public, because part of the function of a secure cryptographic communication tool is to give the general public the benefits of the activism by making the general public help in hiding the activists. So, I guess my point kindof is that "crypto for <x>" doesn't actually work because using it marks you as <x> - secure crypto has to be used by everybody in order to provide protection to those who need it the most. As for the fact that people who do risky things need to be a bit more cautious anyway: Well, yes, but that does not mean that they would not benefit if everyone knew which crypto tools are secure and how to use them, and in contrast to most of physical security, there really is not that much need to distinguish between "professional" and "end customer" tools - proofing your vault against bombs might be a bit more expensive than proofing it against a burglar, but secure cryptography does not need more expensive computers or anything like that. And also no clue how you to quote here ... ;)
qbproger 13y ago
https://heml.is/ https://heml.is/ should be on the way. I've been keeping on eye on it. It'll be interesting what the security community thinks of it after release. There is also TextSecure (https://whispersystems.org/ https://whispersystems.org/), but it requires text messaging.
- deleted 13y ago
  [deleted]
- thirsteh 13y ago
  Definitely holding off until the open source release (and hopefully it won't just be dumps of old versions like Silent Circle's.) Agree that TextSecure and Redphone are great tools, albeit in different categories, and as far as I can tell their implementations are sound.
- deleted 13y ago
  [deleted]
zAy0LfpBZLC8mAC 13y ago
You certainly do notice that the same "argument" would apply to yourself? Also, suppose some new appliance regularly killed its users due to bad electrical isolation. Would you use the same argument when someone criticizes the manufacturer of that appliance? People doing things in a way that harms others is beyond criticism unless you yourself are doing things better? You wouldn't complain if your doctor treated you incompetently unless you could do it better yourself? Also, your basic premise is flawed: Making valid criticism is not "very easy", but also often requires considerable expertise, which in turn takes considerable work to acquire. But that doesn't matter anyhow: Criticism either points out actual problems or it doesn't, it's completely irrelevant to its validity how much work went into it.
- thirsteh 13y ago
  You sure are extracting a lot of things from my comment that I actually didn't say. I don't think anyone is above criticism, nor do I think truly understanding how a piece of software works is "very easy." All I'm saying is that we see criticism of Cryptocat over and over, yet, here we are, with people still using Cryptocat. The author wants Cryptocat shut down, but if that happens, what will the people using Cryptocat do? Communicate in plaintext? Isn't it irresponsible (and in line with your own reasoning about putting people in danger) to not present the users with a better alternative first?
  - afreak 13y ago
    > The author wants Cryptocat shut down, but if that happens, what will the people using Cryptocat do? Communicate in plaintext? Isn't it irresponsible (and in line with your own reasoning about putting people in danger) to not present the users with a better alternative first? First of all, I personally think that if you have to use Cryptocat that you might want to exhaust all other options before using it. Second of all, if you're already in a compromised situation, do you want to use a compromised communication medium? It doesn't seem sensible. Lastly, there are alternatives to Cryptocat: https://otr.cypherpunks.ca/ https://otr.cypherpunks.ca/ This is actually created by someone with a clue and isn't full of cutesy icons and faux Amiga designs.
lmm 13y ago
Crypto can't be easy and safe. You need to check fingerprints (attempts to make this "friendly" with images and the like have tended to have vulnerabilities). Beyond that, what's your issue with OTR? A separate network has the advantage of not having to do the negotiation step of OTR-over-jabber/AIM/etc, but it will have bootstrapping problems (or maybe not; maybe a well-designed app that just used OTR all the time, on a new network, would be enough).
- thirsteh 13y ago
  > Crypto can't be easy and safe. It's not that black and white. Yes, usability tends to carry with it some measure of sacrifice in security, but Skype used to have a lot more security, and was as easy to use as it is today. They're not absolutes. You can have "quite usable and very secure" and "very usable and quite secure", things none of the apps we're discussing are. I don't have any big concerns with OTR (aside from the inability to do offline messaging,) just the implementions, mainly OTR in Adium. OTR in Pidgin appears to be decent, but hasn't received a lot of review, as far as I know, and Pidgin has its own problems/provides its own attack surface.
  - lmm 13y ago
    Skype was never meaningfully secure; the code wasn't open and you had to trust their servers to handle authentication. (And IIRC the best-guess reverse engineering of the crypto looked to be RC4, which while not outright broken is not a massively secure cipher).
    - thirsteh 13y ago
      I didn't say it had a satisfactory level of security, just that it was a lot more secure than it is now, and still had the same level of usability that it does today.
      - lmm 13y ago
        I think it's misleading to say "more secure". It wasn't secure and I can't think of any realistic attack scenario that it would have been secure against (but now isn't); for the NSA to intercept everyone's messages while it was more distributed would have required releasing a version update and waiting for the supernodes to pick it up, but that's not a high bar.

Joeboy 13y ago

> By far the hardest aspect of cryptography engineering is getting people to use your software in the place. I think perhaps a neglected aspect of the problem is how to turn difficult social / political problems (eg. nobody uses PGP and people think you're a weirdo if you try to persuade them to) into tractable technical problems (the kind cryptographers mostly talk about). I sometimes think it would be preferable to start from a point where everybody had public and private keys and knew how to use them, but the crypto was no better then ROT13, than the current situation where the crypto is pretty good but getting people to use it is nearly impossible. I also think the emotive "bad crypto puts lives at risk" argument only really makes sense if you're talking about crypto for the military or a small number of political activists, who will in any case benefit if their encrypted transmissions are buried among everybody else's. Those people need to be more careful than the rest of us with our more quotidian privacy concerns. I would rather have more bad (but tractable) crypto than great crypto that is used by nobody. Hopefully somebody will persuade me I am wrong about this so I can stop feeling like a crypto heretic.

zAy0LfpBZLC8mAC 13y ago
Cryptographic communication tools have a network effect (just like any other communication system), so it's kinda pointless if only the few high-profile activists use it. Also, that would make them stick out, thus reducing their security in some ways. If you can detect the important people by the communications protocol that they are using, you already have the most important part of the information without any need to decrypt anything. Them being buried among bad cryptoraphy most likely won't work - making cryptography indistinguishable is one of the hard parts, so it's one of the properties that bad tools are unlikely to have. Also, a part of the social/political problem is that people tend to not know that the crypto they are using is bad, and political activists tend to not necessarily be cryptography experts either, so how would they know that they are in danger when everyone around them tells them that the broken crypto they are using is the thing to use?
- Joeboy 13y ago
  Your first paragraph seems to be more or less agreeing with what I said - maybe I misunderstand. > Also, a part of the social/political problem is that > people tend to not know that the crypto they are using is > bad, and political activists tend to not necessarily be > cryptography experts either, so how would they know that > they are in danger when everyone around them tells them > that the broken crypto they are using is the thing to use? But there is always going to be a problem with telling people "use our software and you can organise the overthrow of your government without fear". There is no way around the fact that people who are doing that need to understand the risks better than most people do. (How are you supposed to blockquote text on HN?)
  - zAy0LfpBZLC8mAC 13y ago
    I at least did not intend to agree ;-) - my point is that cryptographic communication tools are kindof useless for activists unless they are used by a large number of people in general, both because otherwise they are isolated and can not actually communicate with anyone using the system (except for a few other activists), and because using the tool would make them stick out, which is why they are also indirectly somewhat useless for the general public, because part of the function of a secure cryptographic communication tool is to give the general public the benefits of the activism by making the general public help in hiding the activists. So, I guess my point kindof is that "crypto for <x>" doesn't actually work because using it marks you as <x> - secure crypto has to be used by everybody in order to provide protection to those who need it the most. As for the fact that people who do risky things need to be a bit more cautious anyway: Well, yes, but that does not mean that they would not benefit if everyone knew which crypto tools are secure and how to use them, and in contrast to most of physical security, there really is not that much need to distinguish between "professional" and "end customer" tools - proofing your vault against bombs might be a bit more expensive than proofing it against a burglar, but secure cryptography does not need more expensive computers or anything like that. And also no clue how you to quote here ... ;)

qbproger 13y ago

https://heml.is/ https://heml.is/ should be on the way. I've been keeping on eye on it. It'll be interesting what the security community thinks of it after release. There is also TextSecure (https://whispersystems.org/ https://whispersystems.org/), but it requires text messaging.

deleted 13y ago
[deleted]
thirsteh 13y ago
Definitely holding off until the open source release (and hopefully it won't just be dumps of old versions like Silent Circle's.) Agree that TextSecure and Redphone are great tools, albeit in different categories, and as far as I can tell their implementations are sound.
deleted 13y ago
[deleted]

zAy0LfpBZLC8mAC 13y ago

You certainly do notice that the same "argument" would apply to yourself? Also, suppose some new appliance regularly killed its users due to bad electrical isolation. Would you use the same argument when someone criticizes the manufacturer of that appliance? People doing things in a way that harms others is beyond criticism unless you yourself are doing things better? You wouldn't complain if your doctor treated you incompetently unless you could do it better yourself? Also, your basic premise is flawed: Making valid criticism is not "very easy", but also often requires considerable expertise, which in turn takes considerable work to acquire. But that doesn't matter anyhow: Criticism either points out actual problems or it doesn't, it's completely irrelevant to its validity how much work went into it.

thirsteh 13y ago
You sure are extracting a lot of things from my comment that I actually didn't say. I don't think anyone is above criticism, nor do I think truly understanding how a piece of software works is "very easy." All I'm saying is that we see criticism of Cryptocat over and over, yet, here we are, with people still using Cryptocat. The author wants Cryptocat shut down, but if that happens, what will the people using Cryptocat do? Communicate in plaintext? Isn't it irresponsible (and in line with your own reasoning about putting people in danger) to not present the users with a better alternative first?
- afreak 13y ago
  > The author wants Cryptocat shut down, but if that happens, what will the people using Cryptocat do? Communicate in plaintext? Isn't it irresponsible (and in line with your own reasoning about putting people in danger) to not present the users with a better alternative first? First of all, I personally think that if you have to use Cryptocat that you might want to exhaust all other options before using it. Second of all, if you're already in a compromised situation, do you want to use a compromised communication medium? It doesn't seem sensible. Lastly, there are alternatives to Cryptocat: https://otr.cypherpunks.ca/ https://otr.cypherpunks.ca/ This is actually created by someone with a clue and isn't full of cutesy icons and faux Amiga designs.

lmm 13y ago

Crypto can't be easy and safe. You need to check fingerprints (attempts to make this "friendly" with images and the like have tended to have vulnerabilities). Beyond that, what's your issue with OTR? A separate network has the advantage of not having to do the negotiation step of OTR-over-jabber/AIM/etc, but it will have bootstrapping problems (or maybe not; maybe a well-designed app that just used OTR all the time, on a new network, would be enough).

thirsteh 13y ago
> Crypto can't be easy and safe. It's not that black and white. Yes, usability tends to carry with it some measure of sacrifice in security, but Skype used to have a lot more security, and was as easy to use as it is today. They're not absolutes. You can have "quite usable and very secure" and "very usable and quite secure", things none of the apps we're discussing are. I don't have any big concerns with OTR (aside from the inability to do offline messaging,) just the implementions, mainly OTR in Adium. OTR in Pidgin appears to be decent, but hasn't received a lot of review, as far as I know, and Pidgin has its own problems/provides its own attack surface.
- lmm 13y ago
  Skype was never meaningfully secure; the code wasn't open and you had to trust their servers to handle authentication. (And IIRC the best-guess reverse engineering of the crypto looked to be RC4, which while not outright broken is not a massively secure cipher).
  - thirsteh 13y ago
    I didn't say it had a satisfactory level of security, just that it was a lot more secure than it is now, and still had the same level of usability that it does today.
    - lmm 13y ago
      I think it's misleading to say "more secure". It wasn't secure and I can't think of any realistic attack scenario that it would have been secure against (but now isn't); for the NSA to intercept everyone's messages while it was more distributed would have required releasing a version update and waiting for the supernodes to pick it up, but that's not a high bar.