5 ms·

I'm not really positioning TextSecure as a secure mail solution, but this article says that the TextSecure protocol can't support asynchronous operations or fed

by moxie 12y ago

I'm not really positioning TextSecure as a secure mail solution, but this article says that the TextSecure protocol can't support asynchronous operations or federated namespaces. To clarify, that's incorrect, the TextSecure protocol was actually designed from the ground up for asynchronous communication, and is designed to support a federated namespace: https://whispersystems.org/blog/asynchronous-security/ https://whispersystems.org/blog/asynchronous-security/ That leaves these points for PGP: > It’s been around for a long time, so it’s cryptographically well understood. Yes, but it's cryptographically well understood not to provide the properties we need. > There are a variety of implementations and there is a small but vibrant and highly committed developer community. > A small but active and committed user community. Small can't be emphasized enough, and this is the most important part to me. I think people have a tendency to look at PGP and conclude that while it might be painful, we have to put up with it for backwards compatibility. The truth is that it's a protocol with few contemporary redeeming qualities, and an active user base of ~50k. So why bother with backwards compatibility?

zobzu 12y ago
Still would like to see your source for the "50k active user base" claim.
- deleted 12y ago
  [deleted]
- viccuad 12y ago
  He doesn't have one. Sometimes I wonder how difficult would be to sneak a sabouteur into the crypto community, who advocated for ditching proven and safe crypto tools, wanted his solutions on top of centralized servers owned by others, opposed distribution of signed binaries in FOSS markets, recommended the people to use stock OSs with binary and who-knows-what google libs inside, instead of installing the free counterparts, etc.. Is like people have forgotten that they should trust only the algorithms and the implementations, not the persona behind them. And that persona, should be the first saying "don't trust me! trust my algorithms!".
  - mike_hearn 12y ago
    The 50k number comes from the number of people who can reach each other through the web of trust. If you take every key uploaded to the key servers ever, then it's more like 4 million. However most of those aren't active. TextSecure, in contrast, has vastly more users than PGP has ever had, despite being a lot newer. Sometimes I wonder how difficult would be to sneak a sabouteur into the crypto community, who advocated for ditching proven and safe crypto tools Sometimes I wonder if the best way to sabotage the crypto community would be to fill it with people aggressively advocating for obsolete technologies that have zero chance of any meaningful impact :) Moxie is unusual in the strong crypto space, in that he is willing to make pragmatic engineering choices in order to ship a working product. That is why he and his team have had a lot more impact than most others have.
    - zobzu 12y ago
      Having it installed doesn't mean using it, like you said, for the PGP keys being generated but not necessarily in use. On textsecure usage In my experience, very very few people actually sign keys, and few people upload them on keyservers. Also, I know very very few people who use textsecure. I used it for a few month, trying to get others to talk to me with it and gave up. And I'm in the bay area working with IT people, most of my friends are IT people mind you, we're exactly the people who try that stuff all the time. It doesn't mean its bad tech or a bad attempt at all, heck, I would LOVE for it to catch up. But I seriously doubt it has 4 millions active users or more. On PGP usage From a key server perspective there are still a large number of keys being downloaded, refreshed and updated daily. Let's look at Mozilla's stats and they just seem to peer with one low traffic guy and themselves... http://gpg.mozilla.org/pks/lookup?op=stats http://gpg.mozilla.org/pks/lookup?op=stats that's 1k new keys a day, and about 500 updated a day. We're far from the 50k claim since it would reach that in 50 days no matter what. Of course saying there's only, say a few millions PGP users doesnt mean AT ALL the same as 50k. On misinformation Thus I'm calling bullshit. Purposefully misrepresenting data (large order of magnitudes, at that) is a big minus in my book. Being well-known shouldn't mean you can tell people bullshit - if anything, you have a greater responsibility when you do.
- mnem 12y ago
  I think he's referring to the number of keys in the "strong set" as described here: http://pgp.cs.uu.nl/plot/ http://pgp.cs.uu.nl/plot/
  - zobzu 12y ago
    Yeah and thats a flawed number since most ppl dont get a zillion signatures. What it really means is that people don't use the web of trust that much. Most people I encounter do not sign keys, they just verify they've seen the same key before.
lmm 12y ago
> Yes, but it's cryptographically well understood not to provide the properties we need. If you're talking about perfect forward secrecy, surely that's fundamentally impossible for a protocol that is both asynchronous and decentralized? If one party can only send a single async message to another, then that message necessarily must be decryptable by that second party using only what that second party knows, and you lose PFS. PFS only works for synchronous communications where both parties can use a key exchange protocol, or centralized communications where an asynchronous message can be implemented as a synchronous message to a central authority. No?
- pbsd 12y ago
  It is not fundamentally impossible. It has been shown [1] that forward-secure public-key encryption can be done without the key size blowing up with the expected number of encrypted messages, though it's not very practical. The trivial case of §3.2, in which the key is simply a tuple of N keys which are erased as messages are encrypted/decrypted, seems similar to what TextSecure does. [1] https://eprint.iacr.org/2003/083 https://eprint.iacr.org/2003/083
- moxie 12y ago
  https://whispersystems.org/blog/asynchronous-security/ https://whispersystems.org/blog/asynchronous-security/ https://whispersystems.org/blog/advanced-ratcheting/ https://whispersystems.org/blog/advanced-ratcheting/ https://whispersystems.org/blog/simplifying-otr-deniability/ https://whispersystems.org/blog/simplifying-otr-deniability/
  - e12e 12y ago
    > With the initial key exchange out of the way, both parties can then continue communicating with an OTR-style protocol as usual. Since the server never hands out the same prekey twice (and the client would never accept the same prekey twice), we are able to provide forward secrecy in a fully asynchronous environment. So, my laptop is off-line, and I have access to a recipients public key. How do I encrypt my message, before moving it to a machine that's on-line for sending via smtp? This isn't really asynchronous in the sense that email is (stop-forwards-stop-forward). Nor does it appear to work for writing and encrypting an sms while on an air-plane (the message will only be encrypted when the pre-key can be retrieved). It doesn't seem quite fair to claim (or rather imply) that the scheme does for email what pgp does. It also carries more state around (on the "server" and on the "client") so it's not decentralized. It might be closer to pgp than classic otr, but it's not really a replacement for pgp as far as I can tell.

by moxie 12y ago

zobzu 12y ago

Still would like to see your source for the "50k active user base" claim.

deleted 12y ago
[deleted]
viccuad 12y ago
He doesn't have one. Sometimes I wonder how difficult would be to sneak a sabouteur into the crypto community, who advocated for ditching proven and safe crypto tools, wanted his solutions on top of centralized servers owned by others, opposed distribution of signed binaries in FOSS markets, recommended the people to use stock OSs with binary and who-knows-what google libs inside, instead of installing the free counterparts, etc.. Is like people have forgotten that they should trust only the algorithms and the implementations, not the persona behind them. And that persona, should be the first saying "don't trust me! trust my algorithms!".
- mike_hearn 12y ago
  The 50k number comes from the number of people who can reach each other through the web of trust. If you take every key uploaded to the key servers ever, then it's more like 4 million. However most of those aren't active. TextSecure, in contrast, has vastly more users than PGP has ever had, despite being a lot newer. Sometimes I wonder how difficult would be to sneak a sabouteur into the crypto community, who advocated for ditching proven and safe crypto tools Sometimes I wonder if the best way to sabotage the crypto community would be to fill it with people aggressively advocating for obsolete technologies that have zero chance of any meaningful impact :) Moxie is unusual in the strong crypto space, in that he is willing to make pragmatic engineering choices in order to ship a working product. That is why he and his team have had a lot more impact than most others have.
  - zobzu 12y ago
    Having it installed doesn't mean using it, like you said, for the PGP keys being generated but not necessarily in use. On textsecure usage In my experience, very very few people actually sign keys, and few people upload them on keyservers. Also, I know very very few people who use textsecure. I used it for a few month, trying to get others to talk to me with it and gave up. And I'm in the bay area working with IT people, most of my friends are IT people mind you, we're exactly the people who try that stuff all the time. It doesn't mean its bad tech or a bad attempt at all, heck, I would LOVE for it to catch up. But I seriously doubt it has 4 millions active users or more. On PGP usage From a key server perspective there are still a large number of keys being downloaded, refreshed and updated daily. Let's look at Mozilla's stats and they just seem to peer with one low traffic guy and themselves... http://gpg.mozilla.org/pks/lookup?op=stats http://gpg.mozilla.org/pks/lookup?op=stats that's 1k new keys a day, and about 500 updated a day. We're far from the 50k claim since it would reach that in 50 days no matter what. Of course saying there's only, say a few millions PGP users doesnt mean AT ALL the same as 50k. On misinformation Thus I'm calling bullshit. Purposefully misrepresenting data (large order of magnitudes, at that) is a big minus in my book. Being well-known shouldn't mean you can tell people bullshit - if anything, you have a greater responsibility when you do.
mnem 12y ago
I think he's referring to the number of keys in the "strong set" as described here: http://pgp.cs.uu.nl/plot/ http://pgp.cs.uu.nl/plot/
- zobzu 12y ago
  Yeah and thats a flawed number since most ppl dont get a zillion signatures. What it really means is that people don't use the web of trust that much. Most people I encounter do not sign keys, they just verify they've seen the same key before.

lmm 12y ago

> Yes, but it's cryptographically well understood not to provide the properties we need. If you're talking about perfect forward secrecy, surely that's fundamentally impossible for a protocol that is both asynchronous and decentralized? If one party can only send a single async message to another, then that message necessarily must be decryptable by that second party using only what that second party knows, and you lose PFS. PFS only works for synchronous communications where both parties can use a key exchange protocol, or centralized communications where an asynchronous message can be implemented as a synchronous message to a central authority. No?

pbsd 12y ago
It is not fundamentally impossible. It has been shown [1] that forward-secure public-key encryption can be done without the key size blowing up with the expected number of encrypted messages, though it's not very practical. The trivial case of §3.2, in which the key is simply a tuple of N keys which are erased as messages are encrypted/decrypted, seems similar to what TextSecure does. [1] https://eprint.iacr.org/2003/083 https://eprint.iacr.org/2003/083
moxie 12y ago
https://whispersystems.org/blog/asynchronous-security/ https://whispersystems.org/blog/asynchronous-security/ https://whispersystems.org/blog/advanced-ratcheting/ https://whispersystems.org/blog/advanced-ratcheting/ https://whispersystems.org/blog/simplifying-otr-deniability/ https://whispersystems.org/blog/simplifying-otr-deniability/
- e12e 12y ago
  > With the initial key exchange out of the way, both parties can then continue communicating with an OTR-style protocol as usual. Since the server never hands out the same prekey twice (and the client would never accept the same prekey twice), we are able to provide forward secrecy in a fully asynchronous environment. So, my laptop is off-line, and I have access to a recipients public key. How do I encrypt my message, before moving it to a machine that's on-line for sending via smtp? This isn't really asynchronous in the sense that email is (stop-forwards-stop-forward). Nor does it appear to work for writing and encrypting an sms while on an air-plane (the message will only be encrypted when the pre-key can be retrieved). It doesn't seem quite fair to claim (or rather imply) that the scheme does for email what pgp does. It also carries more state around (on the "server" and on the "client") so it's not decentralized. It might be closer to pgp than classic otr, but it's not really a replacement for pgp as far as I can tell.