Follow Slashdot blog updates by subscribing to our blog RSS feed

 



Forgot your password?
typodupeerror
×

Comment Re:Scriptural (Score 1) 58

"There's no need to sympathize with the baker any more than we have to sympathize with useless art degree majors whining how they only job offers they get (if any) is "beneath" them."

And yet, I do. A mark of civilization is providing every human being with enough profitable work to keep body and soul together.

Comment Re: No point encrypting if you're the only one... (Score 1) 108

Usually don't reply to anonymous cowards, but I gather you're the same guy, so here goes:

And you're argument of "joe-normal's email program of choice doesn't make encryption easy" sounds like a complaint for the program or webpage, not against encryption.

That's because I'm not at all opposed to encryption. I'm saying that this stunt to advocate encryption will be ineffective. My argument is basically that we need to standardize on forms of encryption that will then be built into all platforms natively, including effective methods of key management, that make the whole process transparent to end-users. If end users need to install software, if they even need to understand that their email is encrypted in order to access it, then you're doing it wrong.

the discussion i had with my mother...

That's all well and good. Your mother sounds much more sensible than most people. You may think that she's clueless, but most people are both clueless and stubborn. They barely understand the concept of encryption, don't understand anything about how it works, are not very interested in security, and will outright refuse to accept changes in their workflow. If I were to set something up like this for my own mother, I wouldn't trust her to do it. I would have to set it up for her and then keep a copy of the keys myself as a safeguard. Even then, I'd worry that at some point, she'd decide to generate her own new keys and then lose them, because you just don't know what the hell that woman is going to do.

Myself, I wouldn't use GPG because there's not wide enough support. I use Outlook for work, and last time I tried it, the GPG plugin didn't work in Outlook and just crashed everything. I would sooner try to use S/MIME, which is more widely supported. But that's sort of my point-- you need a single set of standards that everyone is using, or else the encryption schemes have limited utility.

Comment Re:No point encrypting if you're the only one... (Score 1) 108

There is something nice and convenient about Web based E-mail, but it is at a cost of end to end security.

Not necessarily. We would just need a standard protocol for handling encrypted webmail, and then universal browser implementation for that protocol. Like maybe you wrap the output in <encrypted></encrypted> tags, and then browsers know how to interpret the tags and have access to the private keys. Google already syncs settings and extensions with your chrome profile, so if you trusted Google to do it, they could even sync your private keys. If you didn't trust Google, then we'd just need to figure out a different way to get access to your keys if you want to access your webmail away from your own computer.

Of course, then mail clients and mobile devices would need to support the same form of encryption as what the web browsers are using. That's the biggest issue: developing a standard for handling these things that everyone can agree on, and that everyone will implement. We already know how to do this. We're just not doing it.

User Journal

Journal Journal: These are the things in my head at night 7

Then-PFC, now-SGT Bergdahl may in fact have deserted his post. There are certainly credible accusations to that effect, and if so, then he should be tried and convicted for the crime. But it's a whole lot easier to investigate those charges with him here, and we don't let the Taliban mete out justice for us.

Comment Re:No point encrypting if you're the only one... (Score 1) 108

What is the value of every message being encrypted if Apple can decrypt them at will?

IIRC Apple doesn't get your encryption keys in their system. I don't remember exactly how it works, but I remember reading that the encryption is from one endpoint to the other, and Apple doesn't actually have the ability to decrypt the message in transit. Now you could complain that they might have put in a back door. Well sure. That's possible with any closed source software-- and really even with FOSS software that hasn't been audited by someone you trust.

Of course its easy. But its also completely POINTLESS.

Well it really really depends. If you think that security is binary-- either "secure" or "not secure"-- then you grossly misunderstand the issue. Even if Apple can read your messages, which I could be wrong about but I believe they officially say that they can't, I would still trust Apple with a lot more information than I would trust the Internet are large. It's not locking your car to keep the valet out, it's asking the valet to lock your car once he's parked it.

And besides, as I've said, I don't really care about Apple. I'm not saying, "Don't encrypt your email! Just use Apple's Messenger instead because it's way better and secure!" I'm saying that if you want people to encrypt their email, look at what Apple's done as a possible model for how to accomplish that, because they succeeded in making it an easy process.

If you DO trust the endpoints, and they are the same entity as the intermediary then WHAT IS THE POINT OF IMPLEMENTING END TO END ENCYRPTION?

Yeah, kind of my point in saying, "Only if you assume that Apple is a burglar don't trust them with anything." There's levels of trust. I've given Apple my credit card before, and I trust that they're not going to charge me for anything that I didn't buy. Therefore, if I were going to send credit card information over the internet, I'd prefer to use their encryption over nothing.

But again, this isn't about Apple. I have no problem with you distrusting Apple. Still, you're going to have to trust someone sometime. You trust Mozilla? Fine, then let them implement an encryption scheme as simple for users to work with as Apple's is. I'd be perfectly happy with that.

If it hasn't come through in our discussions, my preference is for there to be improvements to be made to email, according to open standards that can be implemented by Mozilla, Apple, Google, and everyone else, that make encryption dead-simple. The fact is, email could stand to be improved in many ways, but it won't be anytime soon because you have Apple running off and doing it their own way, Google running off and doing it their own way, and Mozilla allowing you to install a plugin that calls another application that most people don't have installed, which then allows you to run a wizard, that dumps out a key, that needs to be backed up in some unspecified way or you lose all of your email, which also renders your email unreadable anywhere else.

Comment Re:No point encrypting if you're the only one... (Score 2) 108

Did you read their instructions?

Yes. And I'm an IT guy, and I'll tell you that an awful lot of people would have trouble with those directions even if they wanted to follow them. For your average person, they'd have to install Thunderbird, GPG, and Enigmail-- and with that, you've already lost 90% of users. You haven't even gotten to dealing with the encryption keys, but give those instructions to most people and they'll say, "But can't I just use the Internet?" by which they mean, they would rather use webmail than install 3 applications. They won't even understand what those 3 applications are. You can forget about Linux.

Plus, let's say they follow those directions and encrypt all of their email in Thunderbird. Now they're traveling and they want to read their email in webmail. Uh oh. It looks all weird. No problem, they'll just access it on their iPhone-- but it looks like gibberish there too!

Sorry, it's not going to work like this. It needs to be much much easier than this.

Slashdot Top Deals

This place just isn't big enough for all of us. We've got to find a way off this planet.

Working...