PGPfone (1995) | Hacker News Reader

PGPfone (1995)

en.wikipedia.org

35 pointsDanBC23 comments

I've recently given a try to Jitsi [1] and seriously it works great. It really is a Skype drop-in replacement, and is fully open source. Without any need for configuration, I could discuss by text, audio, and video (and also do screen-sharing) all encrypted between my Debian laptop and a Windows PC, using existing XMPP (Jabber) account.

Really I've never seen any other free software do as good as Jitsi in the VoIP field. I've always tried SIP client and it was never perfect. Jitsi can do SIP to, but does wonder over XMPP so I didn't even try SIP.

[1] http://jitsi.org/

Does it encrypt PGP-style?

More like ZRTP style, also not sure exactly what you mean by PGP-style

PGP gathers entropy for keys using user interactions with the computer (mouse movements, keyboard input, normal usage) as well as disk and memory activity, making for more true random number generation than the PRNG that uses the pool in many modern processors, which could be 'fixed' by the NSA following recent revelations.

That's not specific to PGP at all.

No, but it's known for being commonly used in PGP. I could be wrong, but that's what I understand when someone says, "PGP-style encryption."

"PGP-style encryption" probably implies public-key cryptography.

Like the other poster said, using various computer inputs to feed the entropy source during key generation is not specific to PGP or public-key cryptography at all.

That seems like a misleadingly-broad term, but sure. IMO, public-key cryptography (or just asymmetric crypto) is already an improvement over "the Diffie-Hellman key exchange," which is what's generally implied when talking about public-key crypto.

If you're looking for encrypted and decentralized VoIP, http://retroshare.sourceforge.net/ is one handy solution (and a lot more).

Jitsi also uses ZRTP for audio and video on the desktop, and there's RedPhone on Android and Silent Eyes (Silent Circle) for both Android and iOS. There are probably a few others, too.

I'm not sure if it can be used with WebRTC clients, or if it's even needed there.

it's actually called "Silent Phone"

Personally, I'd stay away from anything that is closed-source (as we don't know what's happening inside) and/or centralized (because it's just one more attack vector and totally unnecessary for VoIP).

Which of the above don't involve a central server? A server is absolutely necessary for VoIP, if only to set up calls (its also the only way to deal with some NATs).

RetroShare is completely decentralized/p2p/OTR.

EDIT: @JshWright - Not sure I understand your question, but RS does "real-time voice communication" (besides the other things like chat, messaging, file sharing, forums, channels...)

Isn't the article about a real-time voice communication?

That's Retroshare. It's also the only one as far as I know that has P2P "e-mail", too (besides Bitmessage, which is still quite new and unproven).

BitMessage has already proven to be breakable (as usual, by tricking the user, but still). See https://news.ycombinator.com/item?id=6263850.

Twelephone gets round that by using twitter for call set up only & transmits media peer-to-peer using WebRTC.

The issue is that behind certain NATs, WebRTC's peer-to-peer component can't work. In these situations, it needs to fall back to using an ICE/STUN server, or some other form of proxy between peers.

Normal people just really don't care about security. It's super sad.

I guess the 2013 edition is silent circle...

There are a few applications that use ZRTP, but Silent Circle is the only one with direct involvement by Phil Zimmermann (AFAIK), yeah.

IIRC, Silent Circle ran into a lot of issues because their product was not open source.

Reply on news.ycombinator.com