Closed Mosrite closed 9 years ago
Mosrite
commented
9 years ago I'm very sorry, I just realized, that this feature already exists! Great work!
But I still have a question though: Would it be possible to implement this with a key memorable for humans? The backup keys seems to be rather long. Could this in the long term be done with a "normal" passphrase changeable by the user?
andris9
commented
9 years ago The long and random passphrase is to ensure security. You're supposed to write this down, not memorize it. You can read about the details and reasoning of the protocol here
Mosrite
commented
9 years ago Yes, I understood that I'm supposed to write it down and that a long random password is required for security. This approach probably works great for setting up Whiteout on several of one's own devices. But if you want to log in on a friend's computer just for one time, it seems a bit cumbersome to type in this long phrase. I either have to store it on my phone (and then I could just email from my phone anyway) or I have to carry around a piece of paper all the time. Plus, there are three passwords for Whiteout at the moment: The password for the email service provider, the password to encrypt the key locally and the code to sync the private key. Maybe in the long run this could be reduced down to two or even one?
Don't get me wrong on this: Whiteout is by far the best approach for PGP-encrypted email I've seen so far! It's absolutely great work and until I found it I didn't think such a service would be even possible! But logging in on another device still feels like registering from scratch for this service because of all the stuff I have to type in.
Hey, I know this a rather delicate feature request by I'll just submit it anyway: I think it would be cool if Whiteout would feature an option to encrypt the private key and then upload it. Right now, when I want to use Whiteout on another device I'll have to import my key manually, i.e. I have to carry around a USB stick with they key on it all the time. (Or am I missing something here?) If the encrypted key was on a server and could be downloaded to whatever device I'm using and decrypted locally, PGP-encrypted email would actually be exactly as simple as non-encrypted is. There are services that already work on a solution to do this (e.g. Lavaboom, Scramble.io or Pixelated). Of course, setting a passphrase for the key must be mandatory before uploading. And uploading has to be opt-in, because hardcore cryptography experts would probably get mad about their key being uploaded somewhere. But I think, such a feature (as long as it was optional!!!) would make Whiteout complete and would make it even nicer for us Average Joes out there. Thanks for considering my suggestion!