<div dir="ltr"><div class="">On 21/08/14 00:54, Joseph Bonneau wrote:<br>
</div>
<blockquote cite="mid:CAOe4UikchLMuBSC_Y+ngjD7XS1sAem7WFx9avCQhA6EVUjFf=g@mail.gmail.com" type="cite">
<div dir="ltr"><div class="gmail_extra"><br><div class="gmail_quote">On Wed, Aug 20, 2014 at 1:01 PM, Wasa Bee <span dir="ltr"><<a href="mailto:wasabee18@gmail.com" target="_blank">wasabee18@gmail.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div dir="ltr"><div><div><div class=""><div>>*Perhaps work in this space should focus on security against a passive
adversary first, which can be done with ~0 changes to the UI (examples
include >Apple iMessage and BBM Protected). In practice, this covers
90-99% of threat models depending on who you ask. Others in the room
were uncomfortable >both philosophically and practically (post-Snowden)
with accepting the ability for a central party to perform MITM attacks.
The room generally agreed it is a >worthwhile goal for the EFF and others
to push large providers not providing any E2E encryption to do so, even
with centralized public key servers to start >with<br><br></div></div><div>I like this idea, but have 2 questions:<br></div></div></div></div></blockquote><div><br></div><div>To
be clear, Apple iMessage and BBM Protected are both E2E encrypted (with
public keys distributed by centralized servers). So this is already
happening at some large services.</div>
<div> </div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div dir="ltr"><div>- E2E support does not necessarily mean user awareness of the feature.</div>
</div></blockquote><div><br></div><div>That's kind of the whole point.
If you can turn on E2E encryption with users not needing to know about
it at all, that's the ultimate level of usability.</div></div></div></div>
</blockquote>
<br>
my bad. I misunderstood the original idea. Makes sense.<br>
<br>
<blockquote cite="mid:CAOe4UikchLMuBSC_Y+ngjD7XS1sAem7WFx9avCQhA6EVUjFf=g@mail.gmail.com" type="cite">
<div dir="ltr">
<div class="gmail_extra">
<div class="gmail_quote"><div> </div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
<div dir="ltr">- more importantly, is there a successful business model
one can build when not having access to user data? What shall it look
like? Having plug-ins available and good UI is important, but to reach a
large audience, someone has to make a living out of it somewhere....
was there any discussion on that?</div>
</blockquote><div><br></div><div>Fortunately, for messaging apps it's
(hopefully) now established in user's minds that they shouldn't have to
see ads. With WhatsApp this has been a clearly-stated policy and I
believe most of its competitors don't show ads. Maybe the "get big and
hope somebody buys you out" model isn't sustainable, but ad-free
messaging seems to be the norm.</div></div>
</div>
</div>
</blockquote>
<br>
Because we don't see ads does not mean these companies' business model
is not based on mining personal data... and selling it to someone
else... We don't see ads in whatsapps, yet facebook presumably acquired
it so it could mine users' data and put ads in their corresponding
facebook page.<br>
If the idea is to get UI experts to enhance the UI on top of OTR, I surely like the
idea. But I am not convinced that a good UI would be enough to push private messaging to the mass without a proper business model that does not rely on
mining data. Any idea?<br>
<br>
<br>
<br>
</div><div class="gmail_extra"><br><br><div class="gmail_quote">On Thu, Aug 21, 2014 at 12:54 AM, Joseph Bonneau <span dir="ltr"><<a href="mailto:jbonneau@gmail.com" target="_blank">jbonneau@gmail.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr"><div class="gmail_extra"><br><div class="gmail_quote"><div class="">On Wed, Aug 20, 2014 at 1:01 PM, Wasa Bee <span dir="ltr"><<a href="mailto:wasabee18@gmail.com" target="_blank">wasabee18@gmail.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr"><div><div><div><div>>*Perhaps work in this space should focus on security against a passive
adversary first, which can be done with ~0 changes to the UI (examples
include >Apple iMessage and BBM Protected). In practice, this covers
90-99% of threat models depending on who you ask. Others in the room
were uncomfortable >both philosophically and practically (post-Snowden)
with accepting the ability for a central party to perform MITM attacks.
The room generally agreed it is a >worthwhile goal for the EFF and others
to push large providers not providing any E2E encryption to do so, even
with centralized public key servers to start >with<br><br></div></div><div>I like this idea, but have 2 questions:<br></div></div></div></div></blockquote><div><br></div></div><div>To be clear, Apple iMessage and BBM Protected are both E2E encrypted (with public keys distributed by centralized servers). So this is already happening at some large services.</div>
<div class="">
<div> </div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr"><div><div><div></div></div>- E2E support does not necessarily mean user awareness of the feature.</div>
</div></blockquote><div><br></div></div><div>That's kind of the whole point. If you can turn on E2E encryption with users not needing to know about it at all, that's the ultimate level of usability.</div><div class="">
<div> </div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div dir="ltr">- more importantly, is there a successful business model one can build when not having access to user data? What shall it look like? Having plug-ins available and good UI is important, but to reach a large audience, someone has to make a living out of it somewhere.... was there any discussion on that?</div>
</blockquote><div><br></div></div><div>Fortunately, for messaging apps it's (hopefully) now established in user's minds that they shouldn't have to see ads. With WhatsApp this has been a clearly-stated policy and I believe most of its competitors don't show ads. Maybe the "get big and hope somebody buys you out" model isn't sustainable, but ad-free messaging seems to be the norm.</div>
</div></div></div>
</blockquote></div><br></div>