Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

> I only have 2 contacts that I can use PGP to communicate with. Usability is the issue.

This is why Bitmessage is so promising. Everything is encrypted and anonymous by default. The PGP/GPG setup is a huge barrier. With Bitmessage you just need to install it and it just works.



Bitmessage is a bad idea, read the white paper. Every message is retained forever by every BM client.


> Every message is retained forever by every BM client.

That is not true.

From the white paper [0] under section 6:

> We propose that nodes store all objects for two days and then delete them.

It's also on the FAQ[1]:

> Yes. However, if you go offline then they must come back online within 2 days of the message being sent. Nodes delete data, and do not accept data, older than 2 days.

The sender will not delete the message until it's received an acknowledge from the receiver. It instead will recompute the proof of work and resend in an exponential growing interval. This is also in section 6 of [0].

> If a node is offline for more than two days, the sending node will notice that it never received an acknowledgement and rebroadcasts the message after an additional two days. It will continue to rebroadcast the message, with exponential backoff, forever.

[0] https://bitmessage.org/bitmessage.pdf

[1] https://bitmessage.org/wiki/FAQ#Can_I_send_a_message_to_some...


The proposal in section 6 is somewhat redundant given section 5:

> ...all users receive all messages...

It would be trivial to modify the BM client to archive/save all messages it receives.


But it's better than what we have at the moment, IMO. I'd be happier using Bitmessage now (and hoping it improved with time) rather than regular email while waiting for the perfect solution to appear someday.


But it's encrypted.


And encryption schemes never become outdated.


The greater risk is from having your key compromised. Forward secrecy would have protected your past messages.


You could also bounce all email that you receive which isn't encrypted with your public key. If you think requiring all your contacts to set up GPG is too hard - what makes you think they'll adopt bitmessage?

(I know bitmessage has some different security properties than gpg+email -- but I think we'll all agree that if everyone and everything switched to email+gpg we'd be in a much better place from a security/privacy standpoint than we are now).




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: