How To CryptoParty

http://cryptoparty.informatick.net/parties/howto

by niels_olson • 13 years ago

41 28 13 years ago

cryptoparty.informatick.net

blackaspen• 13 years ago

While I'm all for propagating the knowledge of cryptography, there was a kid in High School would walk around handing his public key out to people on slips of paper. That wasn't terribly effective for him.

niels_olson4• 13 years ago

Here's my issue with that, and, hey, I sort of agree, I have found pgp to be useful among hackers, but no one outside that circle has any interest in it, even my mom, the college math teacher.

But is this where the technorati has failed to fill their real social obligation? Are we the new Russian intellectuals who failed to engage the people? Are we so self-absorbed in navel-gazing on Hacker News that we fail to actually execute on the one idea that matters? If we can't restore the security of communications, how will history judge us?

stinkytaco6• 13 years ago

I love PGP, but I would think that history would judge us for not developing something more accessible rather than for not spreading PGP. Even I, a PGP user and geek, access my email via Gmail web or my phone's app most of the time rather than via my IMAP client because most people I communicate with don't use PGP and cannot be bothered to (because they also use webmail). And the sad part? I don't blame them. I'm not at my computer all the time. I don't carry it with me anymore and neither do they. They check it from work, from their phone or wherever.

I don't have a solution for the problems that would plague a good crypto/identity system. Centralized trusted parties? That's worked just OK for websites and it entails a cost, and the paranoia that comes with it. A open solution like Persona? Maybe, but I don't know how to integrate that across browsers and devices without trust concerns.

No, I don’t know. But I do know that PGP is a lot of trouble.

Create• 13 years ago

“You can't solve social problems with software.” (Marcus Ranum).

niels_olson4• 13 years ago

Right. You have to go meet people. Invite them over to your house, have dinner, and understand their concerns.

redblacktree• 13 years ago

That sounds tedious.

EthanHeilman4• 13 years ago

Yes you can, given three assumptions:

1. Social relations depend on communication flows (i.e. Marx was wrong the superstructure is informational). 2. Software allows new communication flows. 3. Communication, like water, finds its own level.

Rearrange social relations by altering communications flows. Rearrange communication flows by creating a flow that is easier than the Status Quo. The Babylonians did this with cuneiform, the Romans did this with roads, Radio did this, TV did this, the Internet did this. Software allows you to create new communication flows.

The question is what social problems can be solved by reordering social relations and to what extend these particular social relations depend on communication flows.

stinkytaco6• 13 years ago

I would argue that none of these developments solved the social problem we're talking about, however, i.e. keeping conversations private and creating trust. Indeed, these developments made it worse because face to face interaction is no longer necessary, and putting the means of communication out of your control (either by transmitting it over a medium you don't control or simply by making it so complicated you can't possibly control it) increasing the likelihood of the "man in the middle" either intercepting your communications or impersonating them.

So I would say that you can reflow communication all you want, but that the underlying problem here is trust and knowledge and those are social problems. People either need to appreciate what these new communication flows mean and/or establish ways to bring their communications under their control (i.e. crypto).

That said, I think the idea of establishing trust through key signing parties (and "crypto" parties) is an interesting one. One of the key features of this is learning from someone you likely don't know, just as when you do a key signing party everyone requires some sort of government ID. In the end, you've got to put your trust in someone, right? So, back to the social problem.

derrida3• 13 years ago

I've participated in 5 of these now. I've noticed new bugs, and have a new appreciation for the art of a UI design because of it. Feel free to ask any questions or drop into the irc at #cryptoparty on irc.oftc.net (you can connect through Tor)

There have been 100's of them in >50 cities. It took off when the Australian Government notified the public that they intended to increase the powers of the intelligence agencies.

It's not so much teaching cryptography as it would be in a university or hacker to hacker as it is teaching people all of the pitfalls and what's hidden from the UI and what's really going on when you say, use Tor.

niels_olson4• 13 years ago

What are some of your bugs and design improvements? I plan on attempting one of this in the next couple of weeks.

derrida3• 13 years ago

I was mostly helping people with Tor-related stuff and didn't have time to get a sense of the other usability issues out there in thinks like whole disk-encryption and PGP.

There is a very literal UI bug that is also a security problem in the Tor Browser Bundle. If you resize the Firefox window, you increase your browsers uniqueness & thus make you easier to identify. Try this by switching off a toolbar and noticing the difference at panopticlick.eff.org

Getting a piece of software like Pidgin to work through Tor was a challenge for many. The concepts of 'localhost' and sockets and a TCP-stream was challenging to get across. I don't really know the answer to this problem. These are hard issues to solve with software and the best we've got so far, I think, is education. If I had to imagine a piece of software: something like a packet filter that could go into 'incognito mode' set-up a transparent proxy and automatically flag packets that could reduce one's anonymity or reveal one's identity, then recommend steps to take in the relevant applications to get around that. It's not a completely thought through idea but maybe someone will come along and read this and it would spark the solution in their mind.

There are more bugs than people, check out trac.torproject.org and see what you can do. The #tor irc channel on irc.oftc.net & tor-talk@lists.torproject.org are good places to ask questions.

peterwwillis• 13 years ago

It would be nice to have one website with a HOWTO for creating a business card QR code with a vCard embedded with your public key in it, and instructions on how to use it with every native e-mail client.

How To CryptoParty

Related Stories