Moxie Marlinspike

No, I call it dead because it's dead. The SKS network is dead, the strong set is moribund, and the remaining real users of PGP are instead slinging key bundles around by baking them into pre-trusted artifacts (like ISOs). But that's not a "web of trust," it's just bespoke centralized key distribution with a certification format that every single serious cryptographer agrees is terrible. (And this is before a more brute statistical argument: even at its greatest extent, the PGP ecosystem was minuscule[1].) [1]: https://moxie.org/2015/02/24/gpg-and-me.html

I don't feel the tradeoff for trying to to fix the idea of a rogue CA misissuing is addressed by the shorter life either though, the tradeoff isn't worth it. The best assessment of the whole CA problem can be summed up the best by Moxie, https://moxie.org/2011/04/11/ssl-and-the-future-of-authenticity.html And, Well the create-a-browser was a joke, its what ive seen suggested for those who don't like the new rules.

I think the fact that Apple is having to fight this fight is evidence of why they were right to make a secure walled garden. I don’t know of any other service I would recommend my mother use for securely backing up her phone. I think the UK is ultimately going to roll back this law. I don’t think this means that iCloud E2E is hostile to Apple or its users. I think Apple is going to win. The war isn’t won by telling people to use GPG https://moxie.org/2015/02/24/gpg-and-me.html

Not so puzzling; see also this classic post from Moxie Marlinspike, founder of Signal: https://moxie.org/2013/06/12/we-should-all-have-something-to-hide.html > Over the past year, there have been a number of headline-grabbing legal changes in the US, such as the legalization of marijuana in CO and WA, as well as the legalization of same-sex marriage in a growing number of US states. > As a majority of people in these states apparently favor these changes, advocates for the US democratic process cite these legal victories as examples of how the system can provide real freedoms to those who engage with it through lawful means. And it’s true, the bills did pass. > What’s often overlooked, however, is that these legal victories would probably not have been possible without the ability to break the law.

Great post. Highly recommended. Thank you for sharing it on HN. My take: Many "Web3" applications naively rely on conventional "Web2" infrastructure, so they are exposed to conventional attack vectors. The OP is just the latest example of this. Here's an earlier example showing how easy it is to mess up a Web3 app if it naively relies on Web2 infrastructure: https://moxie.org/2022/01/07/web3-first-impressions.html The author of that earlier example is none other than Moxie Marlinspike, creator of Signal.

Moxie Marlinspike did a good writeup in 2022, I can warmly recommend it: https://moxie.org/2022/01/07/web3-first-impressions.html

When the crypto crowd complains about PGP being obsolete, they don’t just knock PGP, they very often mention alternatives. One of the most frequent recommendations is instead of using ordinary email and trying to bolt PGP onto it with individual contacts, use an encrypted messenger. I have been using Signal for four years now with the same install moved from phone to phone, and it has worked just fine. I can chat with my friends and relatives with E2E encryption, while I could have never got them to use PGP at all. [0] https://moxie.org/2015/02/24/gpg-and-me.html

Moxie Marlinspike (legendary cryptographer, security researcher and creator of the Signal protocol which powers Signal and WhatsApp) wrote an apt article on privacy 10 years ago, and I highly recommend it. https://moxie.org/2013/06/12/we-should-all-have-something-to-hide.html

This criticism of the Ethereum ecosystem also does an excellent job of identifying the forces that undermine decentralization in the long run: https://moxie.org/2022/01/07/web3-first-impressions.html One reason the blockchain has persisted longer than other decentralized systems is that it introduced economic incentives for maintaining its system. I think this is the best strategy for making decentralized systems that resist the tendency toward centralization while remaining competitive with centralized ones.

Only decent explanation I read is here: https://moxie.org/2022/01/07/web3-first-impressions.html What it’s really about though: https://web3isgoinggreat.com/

I find this off-the-wall article is worth reading from Moxie. "Do whatever — but make it uncomfortable (like leaving prison!) and make it count." https://moxie.org/2013/01/07/career-advice.html

For sure no worse than the alternatives. I also don't care about downtime. But I'm looking for something that minimizes the overheads over not self-hosting. I'd love to prove Moxie Marlinspike wrong that "people don't want to run their own servers, and never will." (https://moxie.org/2022/01/07/web3-first-impressions.html) This is the key bottleneck in getting people to run their own servers.

The founder of Signal has a great article about web3 and NFTs here --> https://moxie.org/2022/01/07/web3-first-impressions.html

This typo/oversight/error/whatever shows the depth of misunderstanding the author has about the subject he or she writes. People of hacker news will still love the content, but nobody outside of this bubble will view this as an honest criticism. If you want a truly great critique from a person who REALLY understands, read Moxie Marlinspike: https://moxie.org/2022/01/07/web3-first-impressions.html

He's a great writer, his post on privacy and privacy abuse was eye opening for me https://moxie.org/2013/06/12/we-should-all-have-something-to-hide.html

Yeah this might be appreciated way more by those who have some kind of "connection" with/to him already. I first learned about Moxie by watching his sailing documentary Hold Fast[0] (I'm an avid sailor in a similar low-tech gritty way as him) although I just thought he was some random dude. It was only years later, after having used Signal for some while that I actually made the connection. I have lots of respect for the man and love his thinking, writing and outlook on things. His blog[1] has a lot of good reads. [0] https://vimeo.com/15351476 [1] https://moxie.org/blog/

For others following along: https://moxie.org/blog/the-cryptographic-doom-principle/ (2011)

This "nothing to hide" discussions always remind me of this great essay "We should all have something to hide": https://moxie.org/blog/we-should-all-have-something-to-hide/

All of Moxie's stories are great and I highly recommended them: https://moxie.org/stories.html The train stories in particular made me recall reading Days of War, Nights of Love in a really good way.

Fantastic comment, this is to me the crux of what makes privacy so important. "How could people have decided that marijuana should be legal, if nobody had ever used it? How could states decide that same sex marriage should be permitted, if nobody had ever seen or participated in a same sex relationship?" https://moxie.org/blog/we-should-all-have-something-to-hide/

> great way to explain privacy limitations to a non-tech-savvy person is to walk them through using GPG. Have you ever actually successfully done this? More than once? And they continue to use it? It's a usability nightmare. https://moxie.org/blog/gpg-and-me/

Somewhat related, does anyone use Moxie's knocknock [0] or a similar procedure to secure ports? Since I learned about it I thought it was a very interesting idea. Even tried it out a couple of times but not sure if anyone else is using it. It doesn't seem maintained and I'm not aware of more recent implementations of this. Does anyone else use it for their setups? is it worth/not worth it? [0]https://moxie.org/software/knockknock/

Hmm, this definitely brings up an interesting discussion I don't think HN has had before, especially something in a similar vein since Apple+San Bernardino fiasco. Obviously privacy is something that HN holds very close to its heart. But I'm interested in what do people here have to say about the privacy features are used by terrible people to do terrible things. And I want to share something that I think is one of the best arguments for privacy, complete privacy. I do agree with this completely: https://moxie.org/blog/we-should-all-have-something-to-hide/

Some of my favorites... * Tantek Çelik -> http://tantek.com and https://indieweb.org * Aaron Parecki -> https://aaronparecki.com and https://indieweb.org * Patrick (patio11) McKenzie -> http://www.kalzumeus.com * Moxie Marlinspike -> https://moxie.org * Scott Hanselman -> http://www.hanselman.com * Joel Spolsky -> https://www.joelonsoftware.com * Jeff Atwood -> https://blog.codinghorror.com * Gina Trapani -> http://ginatrapani.org * Matthew Hodgson -> http://matrix.org and https://riot.im * Armin Ronacher -> http://lucumr.pocoo.org * Jeffrey Zeldman -> http://www.zeldman.com * Eric Meyer -> http://meyerweb.com

If it helps, the attack you're describing is called sslstrip and was presented by Moxie Marlinspike at Black Hat in 2009: https://www.youtube.com/watch?v=MFol6IMbZ7Y (code here: https://moxie.org/software/sslstrip/) As others have mentioned, the current best defence against this is HSTS (and, in particular, HSTS preloading). I think the best explanation of it is here: https://www.chromium.org/hsts/

Also, Verisign the CA works for Verisign, while Verisign the TLD operator (.com, .net, .gov) works for the US govt. And this conversation we're having about distrusting WoSign? We couldn't even have it about abandoning .com. People should look into Moxie's thoughts on "trust agility" where he specifically addresses DNSSEC/DANE and recommends against it. It's a great read. https://moxie.org/blog/ssl-and-the-future-of-authenticity/

I stopped reading after this: "PGP is an insecure [1] and outdated [2] ecosystem that hasn't reflected cryptographic best practices in decades [3]." The first link [1] suggests avoiding encrypted email due to potential plaintext CC issues and instead recommends Signal or (check this) WhatsApp. However, with encrypted email, I have (or can have) full control over the keys and infrastructure, a level of security that Signal or WhatsApp can't match. The second link [2] is Moxie's rant, which I don't entirely agree with. Yes, GPG has a learning curve. But instead of teaching people how to use it, we're handed dumbed-down products like Signal (I've been using it since its early days as a simple sms encryption app, and I can tell you, it's gone downhill), which has a brilliant solution: it forces you to remember (better to say to write down) a huge random hex monstrosity just to decrypt a database backup later. And no, you can't change it. Despite the ongoing criticisms of GPG, no suitable alternative has been put forward and the likes of Signal, Tarsnap, and others [1] simply don't cut it. Many other projects running for years (with relatively good security track records, like kernel, debian, or cpan) have no problem with GPG. This is 5c. [1] https://latacora.micro.blog/2019/07/16/the-pgp-problem.html [2] https://moxie.org/2015/02/24/gpg-and-me.html [3] https://blog.cryptographyengineering.com/2014/08/13/whats-matter-with-…

I don't think the article accurately represents anarchism / Marlinspike's philosophy. The article seems to be trying to say that anarchist values are the root of Signal, but this is a barrier to pragmatism or general adoption. It describes anarchism, or, the principles of it that Marlinspike adopted (which aren't inherently anarchist. Though Marlinspike is of course an anarchist), as "far out on the political fringe." It says explicitly "sticking to anarchism would imply an almost certain defeat." It implies Marlinspike agrees by dropping his quote on anarchist failure. However, in the quoted article from Marlinspike, he absolutely doesn't imply something being anarchist relegates it to failure. From his article https://moxie.org/stories/promise-defeat/ > Anarchists are best known for their failures... And yet, far from trying to suppress these histories, these are the stories that anarchists recount. ... This is unusual. American Patriots do not speak, with a gleam in their eyes, of the incredible number of battles that George Washington lost (and he lost almost as much as anarchists do). ... The difference between the ways Nationalists and Anarchists talk about their histories seems critical. > Will there ever be a night — one glorious evening — when the world is won? Where suddenly civilization, the spectacle, class, racism, and patriarchy all simultaneously topple and remain in ruins? ... It seems unlikely to happen in one moment. ... The George Washingtons of the…

One of my friends lived in a squat in Melbourne for a few years. They sort of ran it, meaning they would put the place on couchsurfing.com to attract more people. They had anywhere between about 4-20 people living in the house at any time, each staying anywhere from a few days to a few months. The place was a little bit run down, and had no electricity or running water, although they did have gas and were able to cook food. They used candles to light the place at night, and would retrieve water from a nearby public tap and shower at a nearby university. They'd also dumpster dive all their food. The place was actually pretty awesome and had a really great community feel, albeit run-down and mouse-infested. There was lots of artwork and poetry printed directly on the walls. They'd often have lots of people over and spontaneous parties were common, though they had to keep the noise down since the owner could theoretically come at any point and kick them all out, and in the end that's exactly what happened. The owner was actually pretty nice about it, and was impressed at what they'd done with the place, but kindly asked them to leave, which they obliged. The house is actually still there and my friend hasn't lived there for years so I'm not sure why the owner kicked them all out. On another note, Moxie (of Signal/Open Whisper Systems fame) has some pretty cool stories about his adventures in squatting - https://moxie.org/stories/together-two/

I'm bored, so I'll respond. But where to begin? First, the most basic role of money is to be a medium of exchange. With reasonable overhead and in acceptable time, people need to be able to exchange money for goods and services. Crypto fails this in every practical way. If I want to buy pizza with bitcoin, my overhead exceeds the value of the pizza, the average time to make the purchase is longer than the average time to order, have it made, delivered, and get eaten by my family. (Have you ever SEEN hungry teenagers tear into pizza.) Also if people started trying to buy pizza with bitcoin, you'd quickly run into the problem that the maximum number of transactions per second on the bitcoin network is a fraction of the number of pizzas sold per second. Yes, yes. This is all improvable. I've heard that for years. But these issues are not new, and haven't gone away. OK, what next? You are making a big deal out of the fact that there are poor people in horrible third world countries who want to use crypto to escape authoritarian oversight. At best this is a red herring, I lean towards calling it disingenuous. A far more important use case for crypto is crooks trying to get paid for their ransomware attacks without themselves being caught by law enforcement. And the third world has benefitted far more from payment networks like M-PESA than all of crypto. Besides, the single best way to help the poor people in horrible third world countries is to continue the…