TE
科技回声
首页24小时热榜最新最佳问答展示工作
GitHubTwitter
首页

科技回声

基于 Next.js 构建的科技新闻平台,提供全球科技新闻和讨论内容。

GitHubTwitter

首页

首页最新最佳问答展示工作

资源链接

HackerNews API原版 HackerNewsNext.js

© 2025 科技回声. 版权所有。

Dark Mail Technical Alliance

185 点作者 happyman超过 10 年前

22 条评论

dang超过 10 年前
<a href="https://news.ycombinator.com/item?id=8816806" rel="nofollow">https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=8816806</a><p><a href="https://news.ycombinator.com/item?id=8821847" rel="nofollow">https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=8821847</a>
substack超过 10 年前
The proposal for forward secrecy in the spec (<a href="https://darkmail.info/downloads/dark-internet-mail-environment-december-2014.pdf" rel="nofollow">https:&#x2F;&#x2F;darkmail.info&#x2F;downloads&#x2F;dark-internet-mail-environme...</a>) is not great and does not reflect the current state of the art:<p>&gt; PFS for message objects, as the description above suggests, is far more difficult, and contrary to the nature of email.<p>It recommends just rotating public keys every few days with a paranoid mode. A much better solution is to implement the Axolotl Ratchet pioneered by Open Whisper Systems for TechSecure:<p><a href="https://www.whispersystems.org/blog/advanced-ratcheting/" rel="nofollow">https:&#x2F;&#x2F;www.whispersystems.org&#x2F;blog&#x2F;advanced-ratcheting&#x2F;</a><p><a href="https://github.com/trevp/axolotl/wiki" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;trevp&#x2F;axolotl&#x2F;wiki</a><p>With Axolotl Ratchet, you get:<p>* forward secrecy - disclosure of private keys doesn&#x27;t let an attacker in the future go back and read encrypted communication<p>* future secrecy - disclosure of ephemeral private keys doesn&#x27;t disclose (much) future content<p>I also get the feeling from a glance reading the spec that way too much trust is being placed on service providers. That there is even such a category as &quot;trustful&quot; where the server has access to your private keys is a huge red flag and that was exactly the problem with lavabit: <a href="http://www.thoughtcrime.org/blog/lavabit-critique/" rel="nofollow">http:&#x2F;&#x2F;www.thoughtcrime.org&#x2F;blog&#x2F;lavabit-critique&#x2F;</a>
评论 #8823008 未加载
评论 #8823040 未加载
iagooar超过 10 年前
Is &quot;Dark Mail&quot; going to be the official name? I am no marketing expert, but I am pretty sure it&#x27;s not a good name. People associate darkness with negative feelings, thus a lot of people might start thinking that encryption is for hiding &quot;illegal&quot; things, and not for keeping privacy.<p>And please, don&#x27;t even try using the silly X.0 naming, as some tech-ignorant journalists started doing over a decade ago.<p>Besides the naming thing, I wish them the best, as I hope that this will spread and become a new standard, even with the masses.
评论 #8822971 未加载
ajb超过 10 年前
3 of 5 comments so far mentioning that the name is a mistake. Allow me to make that 4 of 6. Come on guys, authoritarians are going to argue that this is just about defending criminals and terrorists, do you want to make that argument for them? Call it &#x27;Liberty mail&#x27; or something.
评论 #8822784 未加载
评论 #8822838 未加载
评论 #8822727 未加载
评论 #8823224 未加载
zaroth超过 10 年前
The spec is pretty intense, I think the first thing to work on is better high level documentation and overview. There is a lot going on with how this proposed system formats, encrypts, signs, routes, and validates.<p>I&#x27;ve only glanced over less than half of the spec so far, but I&#x27;m not convinced of the design just yet. For starters, I&#x27;m not sure I fully understand the trust model, or even the baseline limitations on things like one-to-many emails, key exchange, PFS. Before jumping straight into packet formats and field layouts, I want to read more about the basic operational model.
评论 #8823140 未加载
bitL超过 10 年前
Call it just email3, new version number can be hyped to regular Joe customers as being newer, therefore better.
评论 #8822842 未加载
chhantyal超过 10 年前
I watched Citizenfour yesterday and one of the really disturbing parts of movie was Lavabit founder talking at European Parliament about why he had to shut it down. I am glad that something good is coming up.<p>But can we please change name from &#x27;dark&#x27; to something like &#x27;secure, encrypted etc&#x27;? Dark inherently sounds negative, at least in my part of the world.
评论 #8822701 未加载
评论 #8822811 未加载
okasaki超过 10 年前
I don&#x27;t think email encryption will ever be more widespread than it is today. People simply don&#x27;t care, and even those few that can be convinced to use it will invariably do something that invalidates the whole exercise like bring their key to a public library, use it on their phone, resend the entire conversation in plain text accidentally, lose the key and generate a new one with you having no way to verify that it&#x27;s not actually mitm, etc. All of this has happened to me.
评论 #8822804 未加载
评论 #8822920 未加载
评论 #8823376 未加载
评论 #8822985 未加载
评论 #8822783 未加载
sobkas超过 10 年前
So who will be able to use this wonderful protocol? Because I don&#x27;t think it will be available on gmail(or any other big provider). How it isn&#x27;t going to end like a pgp right now, when I can sent encrypted emails only to myself, because no one in my circle uses encryption?
评论 #8823375 未加载
lottin超过 10 年前
I&#x27;d love that e-mail encryption became widespread, but I&#x27;m doubtful that it&#x27;ll ever happen. I think keeping private keys private may prove to be an impossible task. Systems are too insecure. Even security experts may fall victim to sophisticated attacks. Let alone the other 99.9% who are not security experts.
评论 #8822764 未加载
mrmondo超过 10 年前
I truly wish them all the best with this project. It would be a momentous win for privacy to have email encrypted by default and easy enough for the general public to use and that is no easy task. Will be interesting to see how this plays out and if they can get some quality email companies like Fastmail onboard early on.
jabgrabdthrow超过 10 年前
Stop calling privacy-conscious software &quot;dark&quot;. You are hurting your cause.
mrmondo超过 10 年前
I&#x27;d rename it &#x27;Trustmail&#x27;
评论 #8823118 未加载
sandstrom超过 10 年前
As others have mentioned, I think a new name is necessary. It wouldn&#x27;t be fair to the project to handicap it with such as name.<p>Name it after Voltaire, John Stuart Mill, Locke or similar.<p>Interestingly, a previous HN discussion also suggested a name change: <a href="https://news.ycombinator.com/item?id=8157922" rel="nofollow">https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=8157922</a><p>(The abbreviation DIME, Dark Internet Mail Environment, sometimes mentioned is also terrible. Hiding &#x27;dark&#x27; with an abbreviation isn&#x27;t enough)
getsat超过 10 年前
.info domain, SSL cert but no HSTS, email list subscription posts to non-SSL endpoint, empty forums. Is this real? WHOIS info appears real and it&#x27;s over a year old, but still...
mike-cardwell超过 10 年前
Who cares what the name is? End users aren&#x27;t going to see it anyway... Bittorrent has a completely neutral name, yet it didn&#x27;t stop it from getting a bad rep with people who don&#x27;t know better, and that bad rep hasn&#x27;t stopped it from being hugely successful.<p>The chances of this project succeeding or failing has nothing to do with the name. There are much bigger barriers which they need to overcome.
sasas超过 10 年前
HTTPS appears available [1], interesting that they don&#x27;t force a redirect.<p>[1] <a href="http://darkmail.info" rel="nofollow">http:&#x2F;&#x2F;darkmail.info</a>
评论 #8823000 未加载
comboy超过 10 年前
I appreciate detailed spec, but it would be nice to have some TL;DR version of how is this supposed to work.<p>I do like putting names on the front page though.
Rapzid超过 10 年前
Freedom Mail.
评论 #8822807 未加载
xiaoma超过 10 年前
Safe Mail
erlend_sh超过 10 年前
For the love of all that is holy, please use <i>any</i> forum software other than phpBB. We have Discourse, NodeBB and Vanilla forum now.
Aissen超过 10 年前
Would be nice to publish the spec in HTML form instead of pdf, for ease of readability.