Re:You have a moral obligation to use crypto
by jedbrown on Tuesday February 11, 2014 @09:38PM
(#7222181)
So convergence.io is only available over HTTP, yet it offers the plugin for download. It seems an ironically bad practice to install security software over an untrusted connection. Meanwhile, https://convergence.io yields a certificate for whispersystems.org and is in fact the https://whispersystems.org/ main page (nothing to do with convergence.io). There appears to be no secure way to obtain Moxie's plugin (it is not available from mozilla.org, though a fork is available, based on this repo: https://github.com/mk-fg/convergence). My understanding is that more recently, Moxie has been focusing on http://tack.io which offers improved security without overturning the CA model.
[ Parent
| on HN ]
Re:You have a moral obligation to use crypto
by sparkie on Tuesday February 11, 2014 @10:15PM
(#7222307)
I'm not sure what would be more ironic, this, or it delivering a "secure" download over the protocol it intends to replace for not providing sufficient security guarantees. The other irony is that a self-signed cert is basically as good as any CA issued cert with Convergence on, if only there were a secure way to bootstrap it. Perhaps a secure way to obtain it would be to email Moxie using GPG and ask him to send you a copy, but as you suggest, it appears to be unmaintained aside from the fork anyway, so it isn't much more than research material for now. I hadn't heard of Tack yet, but that also appears to have a lack of activity.