Retroshare – Secure communication for everyone(retroshare.sourceforge.net)
retroshare.sourceforge.net
Retroshare – Secure communication for everyone
http://retroshare.sourceforge.net/
13 comments
Any good alternatives for easy to use software that enables secure emailing for the average joe?
Time for this good project to get off of sourceforge as well.
I tried this out with friends. Great idea but awful interface.
That's always the end feeling with RetroShare. I'd love to use it, but the interface is completely unpalatable.
There's supposed to be a web interface[0] that looked significantly better but I don't think that ever went anywhere (last commit is in 2013).
[0]: https://retroshareteam.files.wordpress.com/2013/04/djrs_2013...
There's supposed to be a web interface[0] that looked significantly better but I don't think that ever went anywhere (last commit is in 2013).
[0]: https://retroshareteam.files.wordpress.com/2013/04/djrs_2013...
That's the sad part - we sacrifice what people like Snowden tried to save (by giving up their perfect lives) for eye candy.
that's exactly the wrong way to think about this. If we want everybody else to use these kinds of tools, they have to look good, and be easy to use.
Easy to use, sure, but I've only known four GUI systems to be built to high assurance standard: simple components, small TCB, and clear interactions. Mainstream OS's don't use them. People adding beauty to their apps on such OS's also add attack surface in most cases. So, people wanting easy-to-use, secure communications must accept simpler interfaces or maybe text-interfaces depending on their threat profile.
I'll agree the interface needs to be easy to use regardless of how it's implemented. Most tools that aren't got that way due to lack of solid effort into UX. They can certainly do better. Yet, the result might look like a console IRC client or an old Win32 GUI app if it uses simplest stuff for security. Will users embrace that? Unlikely & didn't for many commercial products in this space. It's why the person you replied to is right: they won't make the smallest sacrifices to solve their greatest problems.
Has always been the case. Intel has lost over a billion dollars the few times they tried to market something more reliable and secure. It wasn't backwards compatible with crud X or support risk Y. So, market killed it off to buy stuff that causes problems. Trend repeats in all areas with few exceptions. It's why high security & reliability, even inexpensive offers, stay a niche market.
I'll agree the interface needs to be easy to use regardless of how it's implemented. Most tools that aren't got that way due to lack of solid effort into UX. They can certainly do better. Yet, the result might look like a console IRC client or an old Win32 GUI app if it uses simplest stuff for security. Will users embrace that? Unlikely & didn't for many commercial products in this space. It's why the person you replied to is right: they won't make the smallest sacrifices to solve their greatest problems.
Has always been the case. Intel has lost over a billion dollars the few times they tried to market something more reliable and secure. It wasn't backwards compatible with crud X or support risk Y. So, market killed it off to buy stuff that causes problems. Trend repeats in all areas with few exceptions. It's why high security & reliability, even inexpensive offers, stay a niche market.
Not every user, technically inclined or not, is willing to trudge through clunky software with confusing configurations and awkward interaction.
I tried using this a few years ago with some friends, and it was really frustrating for one of my friends to import and export user public keys just so we could get started.
Although the file syncing was nice, it was also cumbersome to work with.
I tried using this a few years ago with some friends, and it was really frustrating for one of my friends to import and export user public keys just so we could get started.
Although the file syncing was nice, it was also cumbersome to work with.
Even Snowden agrees that usability stands in the way of widespread crypto adoption.
Same here, very functional but too cluttered. It feels messy even though technically it looks good. I have tried several times to get a group of people on it but failed because the UX was not met with love.
This project could really take off with a clean UX. Unite and place the chat and mail feature in the foreground, other features in the background.
I would love to see Retroshare go places ...
This project could really take off with a clean UX. Unite and place the chat and mail feature in the foreground, other features in the background.
I would love to see Retroshare go places ...
I agree. Please get security software off of sourceforge.
"And it's written in a risky language using shoddy libraries on platforms NSA etc. have 0-days and automated attack systems for. I'm sure that this combination will be "really hard" for NSA to penetrate. ;)"
Goes for any strong attackers. Yet, with better interface and more security review, an app like it might protect from the lesser attackers or snoops that are still worth stopping (see "who uses Tor?"). Moreover, might be a better baseline than existing apps providing similar functionality. The main thing that will continually kill this app's security, also similar ones, is it's so complex that describing functionality and errors states is already quite a chore. Making a security argument... more so or impossible.
The best bet is probably a system like Freenet: asynchronous, low response time requirements, and F2F. So much easier to protect such systems. Already has a lot of services built on it. The approach would be a thorough, no-hold-barred review of the protocol by pro's as we've seen with Tor. Whatever survives the review is implemented in a native language with strong assurance activities for implementation and interfaces, including covert channel analysis. Mutually-distrusting, geographically-diverse, and ideologically-loving-privacy types to be the early nodes in public network for bootstrapping. Might even implement it on top of Tor or I2P.
Anyway, there's not much hope for strong anonymity or security if the app is complex and uses high-risk components/platforms. Just isn't happening. Sacrifices must be made. Both software market and FOSS communities have almost all shown they're not willing to make them. So, it will remain a niche with few solutions that are any good.