4 ms·

So convergence.io is only available over HTTP, yet it offers the plugin for download. It seems an ironically bad practice to install security software over an

So convergence.io is only available over HTTP, yet it offers the plugin for download. It seems an ironically bad practice to install security software over an untrusted connection. Meanwhile, https://convergence.io https://convergence.io yields a certificate for whispersystems.org and is in fact the https://whispersystems.org/ https://whispersystems.org/ main page (nothing to do with convergence.io). There appears to be no secure way to obtain Moxie's plugin (it is not available from mozilla.org, though a fork is available, based on this repo: https://github.com/mk-fg/convergence https://github.com/mk-fg/convergence). My understanding is that more recently, Moxie has been focusing on http://tack.io http://tack.io which offers improved security without overturning the CA model.

sparkie 13y ago
I'm not sure what would be more ironic, this, or it delivering a "secure" download over the protocol it intends to replace for not providing sufficient security guarantees. The other irony is that a self-signed cert is basically as good as any CA issued cert with Convergence on, if only there were a secure way to bootstrap it. Perhaps a secure way to obtain it would be to email Moxie using GPG and ask him to send you a copy, but as you suggest, it appears to be unmaintained aside from the fork anyway, so it isn't much more than research material for now. I hadn't heard of Tack yet, but that also appears to have a lack of activity.