5 ms·

I don't know much about Cryptography but this article made me want to ask this: In his example with facebook and trump, the original handshake to get facebook'

I don't know much about Cryptography but this article made me want to ask this: In his example with facebook and trump, the original handshake to get facebook's public key isn't encrypted, isn't that a problem ? I may be totally not understanding this at all, but lets say when somebody connect to Tor if the original connection isn't encrypted and everybody know that I just connected to Tor isn't that bad even though they can't tell what I'm doing afterward ?

tialaramex 6y ago
That example used is a bit weird and I'm not sure it really motivates the rest of the article well. Encryption can deliver a variety of desirable features, and which you need in particular occasions will vary. For example for getting Facebook's public key you would certainly care about Integrity - the key you received should be the one sent, and about Authenticity - you want to get an answer from Facebook and not the CIA or your kid sister but you may not care about Confidentiality - maybe it doesn't matter to you who knows what you asked, and as a Public key it isn't important to Facebook who knows what it is. Tor itself is not designed to ensure that people can't tell you are using Tor. Its purpose is to ensure adversaries, including an adversary who controls some Tor nodes, can't tell what information you are sending and receiving and who you are sending it to/ receiving it from. Hiding Tor usage from a sophisticated adversary is difficult, technologies such as ScrambleSuit and OBFS try to help you do this, but it can be difficult to assess how well they work unless the adversary is actively blocking you. Perhaps they know exactly what you're doing but are choosing not to intervene?
ozim 6y ago
I down voted the other responder. Because Trump is using public key to encrypt the message. You can share your public key as much as you want and people will be able to send you messages that only you(owner of private key) can decrypt. There is no problem. That is normal use of public key to send encrypted messages to the owner of private key. You can do it also the other way around, encrypt data with private key and only people who have your public key will be able to decrypt it. Which is a bit less useful but it can confirm your identity. So they can be sure that you sent the message.

tialaramex 6y ago

That example used is a bit weird and I'm not sure it really motivates the rest of the article well. Encryption can deliver a variety of desirable features, and which you need in particular occasions will vary. For example for getting Facebook's public key you would certainly care about Integrity - the key you received should be the one sent, and about Authenticity - you want to get an answer from Facebook and not the CIA or your kid sister but you may not care about Confidentiality - maybe it doesn't matter to you who knows what you asked, and as a Public key it isn't important to Facebook who knows what it is. Tor itself is not designed to ensure that people can't tell you are using Tor. Its purpose is to ensure adversaries, including an adversary who controls some Tor nodes, can't tell what information you are sending and receiving and who you are sending it to/ receiving it from. Hiding Tor usage from a sophisticated adversary is difficult, technologies such as ScrambleSuit and OBFS try to help you do this, but it can be difficult to assess how well they work unless the adversary is actively blocking you. Perhaps they know exactly what you're doing but are choosing not to intervene?

ozim 6y ago

I down voted the other responder. Because Trump is using public key to encrypt the message. You can share your public key as much as you want and people will be able to send you messages that only you(owner of private key) can decrypt. There is no problem. That is normal use of public key to send encrypted messages to the owner of private key. You can do it also the other way around, encrypt data with private key and only people who have your public key will be able to decrypt it. Which is a bit less useful but it can confirm your identity. So they can be sure that you sent the message.