6 ms·
Quoting Dan Geer: "Convenience, freedom, security - choose two." Solid cryptography concepts were never easy to implement and use. My main problem lies not wi
by wuschel 12y ago
Quoting Dan Geer: "Convenience, freedom, security - choose two."
Solid cryptography concepts were never easy to implement and use.
My main problem lies not with the Gnu/PG or PGP software implementations, but with the actual platforms. Do I trust my iPhone/Android/public internet cafe computer/the family computer? Is it compromised? What about your computer manufacturer? Lenovo, perhaps? Or Apple?
The problem of information safety does go far beyond software. Neglecting this is not an option.
There is certainly life in the old dog called pgp, but I am yet to be convinced of a mass market software concept that allows me to have the same level of confidence in its security as the open source packages I have installed on my offline computer.
"The paranoid will survive."
- Dylan16807 12y agoChoose two? How do I pick security and convenience without freedom? I can't think of any way giving up freedom makes those easier. Blind trust can make me ignore security problems, but I can have blind trust and freedom, or lack of freedom without blind trust. I feel like "security or convenience" is a better representation of the choice, even if it's not as cute. Freedom is off to the side.
- tomjen3 12y agoI probably shouldn't go around and disagree with quotes from people I have never heard about, but there is no law that means encryption has to be ackward, user-unfriendly or badly designed.
- Retric 12y agoCan you name a single counterexample? HTTPS: You can give up freedom and some security for convenience of 3rd party registrars! You can roll your own which is less convenient and likely less secure… Not really sure of the 3rd option here.
- tomjen3 12y agoWhatsApp.
- Retric 12y agoWhatsApp fails freedom and arguably security. Let's put things in context. Would you trust WhatsApp to be part of the US nuclear launch chain? Or talkes between the leaders of US, France, China, and North Korea.
- tomjen3 12y agoNo and yes. The type of encryption used in whatsapp is not something I want to authenticate in anything that has to be dormant and used in an emergency without a network, but that doesn't mean it is bad crypto. Yes, why not? You still need to ensure that the people involved with whatsapp can be trusted, but even the NSA can't do that in every case (ie Snowdon).
- ryanlol 12y agoOTR?
- worklogin 12y agoMore like a theorem. And Dan Geer is totally worth reading. http://geer.tinho.net/geer.rsa.28ii14.txt http://geer.tinho.net/geer.rsa.28ii14.txt https://encrypted.google.com/search?hl=en&q=site%3Ahttp%3A%2F%2Fgeer.tinho.net%2F%20filetype%3Atxt#q=site:geer.tinho.net+filetype:txt&safe=active&hl=en&filter=0 https://encrypted.google.com/search?hl=en&q=site%3Ahttp%3A%2...