Re: Privacy/Security Friends of GNOME campaign?

[Bastien Nocera <hadess hadess net>]

On Tue, 2012-12-18 at 09:35 -0600, Federico Mena Quintero wrote:
> On Wed, 2012-12-12 at 23:19 -0500, Karen Sandler wrote:
> 
> > The marketing team agreed that this time a privacy/security campaign would
> > be great for a friends of GNOME drive. After Jacob Applebaum's talk at
> > GUADEC, we heard a lot of people discussing how important these issues are
> > and how we'd like to do more at GNOME.
> > 
> > Are there areas of GNOME that you think could be improved from this
> > perspective?
> 
> Jacob mentioned that Pidgin/libpurple badly needs a security audit (and
> since Empathy's machinery is in libpurple, this would have a direct
> benefit for Gnome).  Maybe we could fundraise with that in mind.

Most of it isn't actually. I'm pretty certain that most of the popular
protocols are implemented directly in telepathy.

> Some random ideas:
> 
> * What would it take to have a Tor-ified session right from GDM?

See https://bugzilla.gnome.org/show_bug.cgi?id=689339 and blockers.
Tor, right now, seems like something pretty fragile implementation-wise.

> * Should we have a desktop-wide "incognito mode"?

We have some of it implemented in the Privacy panel, which needs
implementing in separate applications.

> * Remember the old document, "Why Johnny can't encrypt"?  How can we
> make it really easy to have encrypted mail?
> 
> * Should the Gnome Foundation be able to issue certificates?

What would be the purpose?

> * Should we have a keyserver?

I'm not sure what we would gain by that. MIT has a public one that's
been around for ages:
http://pgp.mit.edu/
Or did you mean something else?

> * Do we have something like HTTPS everywhere?