Can you give some examples of half-truths?
45 karma · joined June 30, 2012
http://msdn.microsoft.com/en-us/library/system.security.cryp...
Thanks for your feedback. You're right that cryptography is not my strong point - but my hope in making the code open source is that others will help improve my code. I didn't write the AES code - I just used a popular sample, but a bad one it seems. What do you think of http://msdn.microsoft.com/en-us/library/system.security.cryp... ?
Yes, using PGP is better. Yes, I ended up implementing a poor (but much better performing) copy of PGP. It's flawed, but I did it in a few days and I think it's not broken. For the next version, I will use BouncyCastle for a true OpenPGP implementation.
The fundamental issue is whether you can trust server-side encryption. Theoretically you're right that you cannot absolutely trust my service to do what it says it does. And I would not trust it relative to client-side software either.
So, I would suggest that everyone use offline encryption, and my service exposes an API with offline encryption that works seamlessly with server-side encryption: https://cryptabyte.com/Service
Furthermore, I'm working on desktop apps which will do the encryption offline: https://cryptabyte.com/Home/Apps
But, for the average, non-technical user, the choice may be between not using encryption at all or relying on a poorly secured desktop environment and using my service. In that case, it may be more desirable to use my service than the alternative.
Regarding key strength, my hope is that most people do not enter a password, allowing the software to generate it for them. For the self-destructing emails (https://cryptabyte.com/SelfDestruct), I do not allow entering the password, but generate a secure, 32 character passphrase.