Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I'm giving up on PGP

blog.filippo.io

Post reply on HN
Print view View original

161–170 of 350 posts

Re: I'm giving up on PGP

#161

Post by lmm »

sqeaky wrote: post #123
lmm wrote: post #113

> Yeah, about that. I never ever ever successfully used the WoT to validate a public key. If you ever installed a Debian package then you did. A long-term identity as "Bob Jones" might not be terribly useful - but that's not the kind of long-term identity we care about a lot in real life either. A long-term identity as "Debian release manager" or "Signatory on bank account xyz" or even "Wikileaks committee member" is…

You understand the difference between a lone hacker as an APT vs a state level threat as an APT. That distinction is huge and chooing not to defend yourself against one or the other may allow for huge convenience gains at the cost what is to many a purely hypothetical notion of security. Can we improve the tools and techniques we have enough so they are convenient enough to not have to make such a choice?

I think the big line in terms of what's practical is whether you're willing to trust the CA system or not. If you are - and I think if your threat model is a lone hacker then you can, compromising a single CA or maintaining an MitM requires a very high level of capability - then while doing SSL right and in a way that will let you detect MitM attempts is by no means trivial, there's such a wealth of messaging options available that I'm just not worried about this case. Use whatever, you'll probably be fine.

Once you step beyond that, there are no convenient options (or to put it differently, all convenient options come with risks that are more-or-less as big as the CA system). E.g. compromising Signal's central servers is probably not substantially harder than compromising a CA, and I simply don't trust that a system that does automated key exchange on first use (trusting the servers) will be able to avoid downgrade attacks by a compromised server. I think to a certain extent usability issues are inherent - if you are unwilling to trust any centralized identity services then you have to show key fingerprints and rely on the user to verify them themselves, there's no third option. At the same time I think we can and should do a lot better than current GPG.

Re: I'm giving up on PGP

#162

Post by nickik »

Arathorn wrote: post #77

The conclusions here (avoiding long-lived per-identity keys and having the option to easily rotate and re-validate per-device keys) are very much what we've aimed for in the end-to-end crypto for Matrix.org ( https://matrix.org/blog/2016/11/21/matrixs-olm-end-to-end-en... ). Rather than using a silo like Signal or WhatsApp, it is possible to get the flexibility of an open federated network built on an open standard,…

Matrix really is the hope in this respect. I would absolutely love Matrix in combination with Keybase. This would essentially connect the summation of my online identity with my chat system.

It really does seem like a match made in heaven, but I understand how practically difficult this is.

Re: I'm giving up on PGP

#163

Post by PuffinBlue »

ihnorton wrote: post #158
jerf wrote: post #13

Earlier quoted context omitted.

"I wonder if pgp is fundamentally flawed, or we have a deep conceptual usability issue here." I think it's the key model that's fundamentally flawed rather than pgp itself, which I believe the author of the article is also asserting. In cryptography, it is often explained that despite the fact a one-time pad is guaranteed-secure (given various conditions I'm eliding), it is not practical in the vast majority of cases…

> How do you distribute the one time pad in the first place? I'm fairly naive to this area, but wouldn't video chat initiated with public keys suffice? Then confirm identities and exchange secrets. To me this seems substantially equivalent to in-person key exchange for non-Three Letter Agency threat models. 20 years ago this wouldn't really have been feasible, but today it (mostly) is -- from a quick glance at the FA…

If a video chat with public keys is secure enough to exchange a one time pad, why would you need to bother with the one time pad at all?

By transmitting your OTP it is no stronger than the method used to protect it in transport, so if that transport method is secure enough to guarantee the security of the OTP, why not simply use that method for everything and forget about the OTP?

Re: I'm giving up on PGP

#164

Post by nickik »

deno wrote: post #139
nothrabannosir wrote: post #118

Earlier quoted context omitted.

> If you're using iOS you've already given up against state-level attackers. Wasn't the recent apple vs FBI debacle evidence to the contrary?

It ended because FBI just cracked the device anyway. How is it contrary?

Insofar as that the FBI has to actually crack the device and don't have universal key of some sort. Newer version will (and already are) more secure. Its not perfect because this was 'just' the FBI and 'just' the legal way, but at least its something.

Re: I'm giving up on PGP

#165

Post by repler »

lmm wrote: post #130
VLM wrote: post #91

Earlier quoted context omitted.

Stuff to secure has moved away from email while gpg stays primarily an email project. The concept of a git repo means I don't need to sign anything, I'll just roll back if I pull the wrong thing. Socialization at work hasn't atomized enough that my only human contact with a coworker would be a gpg signed commit anyway. The concept of software distribution being a tar.gz.gpg or verifiable md5 file is obsolete. Behind…

> The concept of software distribution being a tar.gz.gpg or verifiable md5 file is obsolete. Behind the scenes something like apt-get does sign things but how to integrate its list of keys with the end user is a mystery, its essentially magic. Besides it provides no security due to lack of MITM attacks in practice. The very first bootstrap is impossible to do securely in the general case short of building a computer…

Great - how do I get a non-compromised smartphone? :/

I'm kidding but I'm also serious.

Re: I'm giving up on PGP

#166

Post by politician »

pdkl95 wrote: post #140
jerf wrote: post #13

Earlier quoted context omitted.

"I wonder if pgp is fundamentally flawed, or we have a deep conceptual usability issue here." I think it's the key model that's fundamentally flawed rather than pgp itself, which I believe the author of the article is also asserting. In cryptography, it is often explained that despite the fact a one-time pad is guaranteed-secure (given various conditions I'm eliding), it is not practical in the vast majority of cases…

> How do you distribute the one time pad in the first place? Something I've wanted to make for a while now, that should be possible to make with almost any cheap embedded microcontroller, is a hardware dongle that stores OTP pads. This would be a generic character device that could be integrated into existing chat programs. * Each device has a hardware RNG, e.g. [1] or similar * A port that allows two devices to conn…

If you only use the OTP data for a protocol that exchanges symmetric keys, then you could effectively extend the capacity of such a device. I'd buy one - it's an enhanced business card.

Re: I'm giving up on PGP

#167

Post by X86BSD »

raesene6 wrote: post #47
parennoob wrote: post #9

To me, Keybase ( https://keybase.io ) seems to solve the "PGP has a bad user experience" problem correctly for like 90% of the population. You post proofs of your public key to known media (Twitter, Github, your website, etc.) which you control. These can be checked by anyone. Even if the remote person doesn't know they are talking to you (as a human entity), they know they are talking to the combined online persona…

For me keybase solves a lot of the WoT problem but not the day-to-day usuability problem. The killer is lack of good x-platform e-mail integration + difficulties in key management. I was hoping keybase might take that on as well, but AFAIK that's not on their roadmap.

I tried keybase. I find it a novelty. It's just as awful to use as pgp. So regardless of anything else it offers it's a dead end like pgp. It's designed by developers and security nerds I get it. But that's who it will stay with too.

It's not an attack on them just the reality.

People don't mind SSL because they don't have to do anything to get its benefits. It's transparent to the end user.

Is it perfect? Hell no. Managing veers is as bad as managing keys. It's a pita. But only has to be done on one end.

Even Phil Z. Learned this when he made zphone. It has to be transparent to the end user and have a simple way to authenticate the other end.

Re: I'm giving up on PGP

#168

Post by lmm »

repler wrote: post #165
lmm wrote: post #130

Earlier quoted context omitted.

> The concept of software distribution being a tar.gz.gpg or verifiable md5 file is obsolete. Behind the scenes something like apt-get does sign things but how to integrate its list of keys with the end user is a mystery, its essentially magic. Besides it provides no security due to lack of MITM attacks in practice. The very first bootstrap is impossible to do securely in the general case short of building a computer…

Great - how do I get a non-compromised smartphone? :/ I'm kidding but I'm also serious.

Yeah. I fear the open-source side only ever catches up once something becomes commoditized, so the actual answer is probably that if you care enough you use a weird and slow phone built for this stuff (that Mozilla phone project?), you use whatever the current replacement ROM project is (I would hope one of Cyanogen et al would offer a carefully signed open-source build - I haven't actually looked), or you wait a few years.

Re: I'm giving up on PGP

#169

Post by ihnorton »

PuffinBlue wrote: post #163
ihnorton wrote: post #158

Earlier quoted context omitted.

> How do you distribute the one time pad in the first place? I'm fairly naive to this area, but wouldn't video chat initiated with public keys suffice? Then confirm identities and exchange secrets. To me this seems substantially equivalent to in-person key exchange for non-Three Letter Agency threat models. 20 years ago this wouldn't really have been feasible, but today it (mostly) is -- from a quick glance at the FA…

If a video chat with public keys is secure enough to exchange a one time pad, why would you need to bother with the one time pad at all? By transmitting your OTP it is no stronger than the method used to protect it in transport, so if that transport method is secure enough to guarantee the security of the OTP, why not simply use that method for everything and forget about the OTP?

I did say "exchange secrets" for a reason -- that secret may be a key for later use (e.g. for data dumps), or actual information.

What I'm trying to understand is whether the (relatively new) feasibility of interactive video channels allows for building roughly the same level of trust as would be provided by in-person key exchange. I'm basing this on the understanding, possibly incorrect, that encryption with a public key allows for creating a secure communication channel, but not necessarily a trusted one. The hypothesis is that the capability to conduct interactive video provides a way to verify identity and establish trust at roughly the same level as would be provided by in-person exchange (again, assuming 1-1 trust, and excluding TLA threat models).

Re: I'm giving up on PGP

#170

Post by raimue »

102030485868 wrote: post #83
psiconaut wrote: post #4

Earlier quoted context omitted.

A few projects that I'm aware of (disclaimer: I'm involved with LEAP): - https://pixelated-project.org/ - https://www.mailpile.is/ - https://modernpgp.org/memoryhole/ - https://inbome.readthedocs.io/en/latest/ - https://leap.se/ Edit: btw, if you're in Berlin from 14-18 Dec, drop by the AME2016 unconf+hackaton https://github.com/mailencrypt/ame2016

Hah: http://i.imgur.com/YphQVru.png

It does not have a valid certificate just like any other custom domain hosted on GitHub Pages.
Post reply on HN