Hacker News Reader

Comment by lemming | Hacker News Reader

There are strong cryptographers who are working on much, much better systems than PGP.

Could you give us some examples of these? How far away from prime time usage do you estimate they are? Are any of them usable right now?

View on HN

I would if I could, but another distinction between real cryptographers and amateur ones is a desire not to publicize things until the design is trustworthy. I think you'll have to take my word for this (but I'll try to think of one I can share).

No problem, I believe you - I was just curious.

Are they better in that they are easier to use (and thus promote security)?

What does this mean? We just got finished talking about a system that was profoundly less secure because it tried too hard to be easy to use.

I understand this discussion is about avoiding snake oil, and only using good quality trusted respected systems, and using them carefully, but making them easier to use.

Some examples from PGP include Bob signing Ann's key without sufficient verification, or people publishing their private and public keys by accident.

Remembering that many people are just hopeless at security ('123456' used as passwords; people clicking through browser certificate warnings; people installing malware and ignoring OS warnings about untrusted sources) it seems a reasonable point to make: "Secure products can be made easier to use, and if they are both good and easy to use it will enhance security".

I know tptacek was talking about systems still under development, but I immediately thought of DJB's NaCl (http://nacl.cr.yp.to/) when I read that statement.

Reply on news.ycombinator.com