Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I'm giving up on PGP

blog.filippo.io

Post reply on HN
Print view View original

341–350 of 350 posts

Re: I'm giving up on PGP

#341

Post by KingMob »

DigitalJack wrote: post #219
XorNot wrote: post #206

Earlier quoted context omitted.

99% of crypto would work just fine if you appended an OTR-like protocol over the top of email. First email is "hey we're interested in blah..." and is sent in the clear. Then have the message window change color as subsequent emails get the protocol more secured.

I hate color coding. I'm in the 8-12% of men that have red-green deficient vision. You can use 10% as a rule of thumb. If I'm not mistaken in my probability math, that means in a group of 5 men, there is a 50% chance one of them is "color blind." Yet the world insists on using red/green as bad/good indicators. Drives me nuts.

I also have red/green colorblindness, but it's not as if color coding would have an 8-12% failure rate. Typical red/green color-indistinguishability mostly applies to dark reds and green, though, whereas the reds/greens used in UI tend to be quite bright and vivid.

People who can't distinguish vivid reds/greens are much rarer. (If 10% of men couldn't separate red from green at the stoplight, we'd have noticed a long time ago.)

I agree we should include everyone, of course, which is why there should also be patterns, shapes, and sound to assist, I'm just saying color coding is not some collossal mistake.

(Also, your math is off if you're assuming a 10% base rate. To have at least a 50% chance of 1 person in a group of men being color blind, you need 7 men. 1-(.9^7)= 52%.)

Re: I'm giving up on PGP

#342

Post by lmm »

pdkl95 wrote: post #335
lmm wrote: post #305

Earlier quoted context omitted.

I suggest implementing version 0.1 as either a frontend to GPG with key on an existing smartcard (Yubikey or similar), or at least something that uses the existing OpenPGP standard for encryption. That way you don't have to worry about doing the cryptography from scratch and can focus on the UI side (which is hard enough on its own) and the fingerprint exchange (which is what your "extra port" needs to be). You don't…

> frontend That's exactly the kind of complexity I'm trying to avoid. I would get zero benefit from existing public key infrastructure, because this is a device that enables 1-to-1 communication only. It may be possible in the future to exploit such a device to authenticate GPG keys, but not in the initial version. > cryptography from scratch I'm not doing much crypto other than generating random bits (hardware RNG w…

> That's exactly the kind of complexity I'm trying to avoid.

It's only complexity for the implementation, not for the user.

> I would get zero benefit from existing public key infrastructure, because this is a device that enables 1-to-1 communication only.

You'd get to reduce the storage requirements massively and make the devices much more reusable, because you wouldn't have to do exchanges and store the results.

> There is no exchange or fingerprints. The entire goal is to have a type of secure communication that is easy to understand, so it can't have complexity like handshakes to exchange stuff or key management. Even if its hidden behind a UI, those features add complexity that affects how you use it.

The UX is "plug these two devices into each other via some special custom port" either way, no?

> The computer-accessible attack surface would be extremely small; it's mainly just a USB (or whatever) character device you write plaintext to and read back the OTP'd cyphertext.

If the UI is a unix character device then your target audience is a subset of the people who already understand GPG.

> Trying to solve the entire problem at once has always made tools that were too complicated to understand if you have never of crypto. You might consider the device I've described as a kind of "training wheels" for the idea of using crypto.

Right, but part of the point of training wheels is you attach them to a regular bike, you don't use a completely different device. A specialized frontend that only uses a very small simple subset of GPG would be very helpful.

Re: I'm giving up on PGP

#343

Post by kingnothing »

devilsavocado wrote: post #107

People who use PGP keys, can you give examples of your use? I'm genuinely curious. Who are you contacting, or who is contacting you? The author says he only receives 2 encrypted emails a year. Not only do I not have a PGP key, I don't think I've ever found myself in a situation where it was even an option to use one.

I've used them at work, internally, to send production credentials to and from coworkers. It would obviously be bad if our email or chat service was compromised, but at least it wouldn't be a direct path to our prod servers.

Re: I'm giving up on PGP

#344

Post by twr »

nickik wrote: post #337
twr wrote: post #276

Earlier quoted context omitted.

> Protonmail with SRP and 2FA where a attack has to pretty tricky stuff but you still get a e2e system is far better then what we have now. Its a far more involved attack to just look at your old emails, and its easier to detect. Can you explain how this is better than Google End-to-End? (Which isn't completed, I know.) Or even how it's worth implementing over regular webmail in the first place? Extensions are obviou…

I have not look at google end to end. The main benefit seems to be that to read your messages code has to be send to your browser. That is much easier to detect compared to compromise of the server now. Plus it would have network effects that would benefit normal users. In theory you could have clients with good guis and all that, these however barly exist and people simply want to use the web for this sort of stuff.…

Sending code to a desktop is easy to detect. Sending code to a non-web-based mobile app is easy to detect. Sending code to a browser isn't even detectable. In practice, no one audits JavaScript. If browsers offered the means to detect changes to cached content, security experts[1][2][3] would be less grim about webpage security.

Encryption done in untrusted JavaScript is security theater. If these websites offered privacy policies claiming to never read your data, like Riseup does, the end-result would be the same. Safer, actually, because deploying unnecessary crypto increases the vulnerability risks.

Recommending these websites is actively dangerous. Journalists and whistleblowers who take these claims of fraudulent security seriously, are going to be killed. Getting them to understand that email cannot be secured in-browser, is the entire point. That if you have important information to protect, you should be moving onto different approaches.

WhatsApp is literally safer than this, and it's more accessible.

[1] https://www.schneier.com/blog/archives/2012/08/cryptocat.htm...

[2] https://www.nccgroup.trust/us/about-us/newsroom-and-events/b...

[3] https://rdist.root.org/2010/11/29/final-post-on-javascript-c...

Re: I'm giving up on PGP

#345

Post by pdkl95 »

lmm wrote: post #342
pdkl95 wrote: post #335

Earlier quoted context omitted.

> frontend That's exactly the kind of complexity I'm trying to avoid. I would get zero benefit from existing public key infrastructure, because this is a device that enables 1-to-1 communication only. It may be possible in the future to exploit such a device to authenticate GPG keys, but not in the initial version. > cryptography from scratch I'm not doing much crypto other than generating random bits (hardware RNG w…

> That's exactly the kind of complexity I'm trying to avoid. It's only complexity for the implementation, not for the user. > I would get zero benefit from existing public key infrastructure, because this is a device that enables 1-to-1 communication only. You'd get to reduce the storage requirements massively and make the devices much more reusable, because you wouldn't have to do exchanges and store the results. >…

> complexity for the implementation

Minimizing complexity is also important when writing a security feature. The entire firmware shouldn't be very large (bugs/kLOC is constant(-ish)), and dependencies increase attack surface.

> reduce the storage requirements

I don't see that as being a huge problem, because flash memory is cheap and I should be able to generate pads very quickly. Remember that the only problem I'm trying to solve is secure chat (text). 1MB of pad is a lot of typing.

I do like the idea mentioned in another comment about using the shared random secret as a stream of symmetric keys, which would nicely reduce the rate of pad usage without adding any more complex semantics.

> If the UI is a unix character device

I'm describing it to you as a character device, because I assume you know approximately what that implies (serialized data stream, etc). The UI for the user, for now, would probably be a plugin for libpurple or something, if I ever get time to write it.

> a very small simple subset of GPG

I've been trying variations of that idea for over 20 years. Many people need a far more rudimentary education about the idea of using crypto. I want to teach the idea of applying security at each end of the conversation. I want to teach the habit of putting an envelop on communication, even when it's just to a friend. I want to teach taking some of the responsibility for your own security instead of relying on 3rd parties ("the cloud").

I've tried to teach very small subsets of GPG already. That didn't work, so I'm simplifying the scope into something that will hopefully be easier to understand.

The "minimal GPG wrapped up in a very simple UI" device that you're talking about would make a great device to graduate into.

Re: I'm giving up on PGP

#346

Post by [deleted] »

user5994461 wrote: post #231
user5994461 wrote: post #209

Earlier quoted context omitted.

I have to partially disagree with that. Calling PGP an utter failure is an understatement. Just like calling a cat a small tiger. PGP is possibly the WORST experience in usability for any well known software that ever lived. This thing should be taught in courses for decades to come as how to fail a product by 1) having no UI 2) no integrations with anything 3) zero usability 4) not even trying to give a fuck about n…

Guys. It doesn't have to be state controlled okay? It can be a SV startup if you prefer :D The government is just an example because they already handle ID for everyone, and they need it to provide their services. It makes sense for them to go digital at some point and to guarantee the ID. I didn't know that Americans were so anti-American ^^

[deleted]

Re: I'm giving up on PGP

#347

Post by lmm »

pdkl95 wrote: post #345
lmm wrote: post #342

Earlier quoted context omitted.

> That's exactly the kind of complexity I'm trying to avoid. It's only complexity for the implementation, not for the user. > I would get zero benefit from existing public key infrastructure, because this is a device that enables 1-to-1 communication only. You'd get to reduce the storage requirements massively and make the devices much more reusable, because you wouldn't have to do exchanges and store the results. >…

> complexity for the implementation Minimizing complexity is also important when writing a security feature. The entire firmware shouldn't be very large (bugs/kLOC is constant(-ish)), and dependencies increase attack surface. > reduce the storage requirements I don't see that as being a huge problem, because flash memory is cheap and I should be able to generate pads very quickly. Remember that the only problem I'm t…

> dependencies increase attack surface.

In the general case yes, but GPG is probably or at least should be the most carefully audited codebase in the world.

> I do like the idea mentioned in another comment about using the shared random secret as a stream of symmetric keys, which would nicely reduce the rate of pad usage without adding any more complex semantics.

Right, at which point you already need a high-quality symmetric encryption implementation (and definitely need to worry about timing attacks and other side channels - quite possibly something you need already at the true-OTP stage). Such as the one in GPG.

> I've been trying variations of that idea for over 20 years. Many people need a far more rudimentary education about the idea of using crypto. I want to teach the idea of applying security at each end of the conversation. I want to teach the habit of putting an envelop on communication, even when it's just to a friend. I want to teach taking some of the responsibility for your own security instead of relying on 3rd parties ("the cloud").

All good things. I just struggle to believe that the amount of internal-only simplification you get out of making the device OTP-only is worth the cost of requiring storage, becoming text-only, having to have one device for each person you communicate with, having no way to send messages to people you haven't met, and avoiding compatibility with what is still the most widely deployed cryptosystem with any hope of being secure against government-level threats (and the only cryptosystem that we have the NSA on record as being unable to break). I can certainly believe that most of these things aren't worth exposing in the UI, but deliberately using a different standard for the implementation to ensure that you will never have the ability to add even one of those things should they actually prove desirable seems like a poor cost/benefit.

Re: I'm giving up on PGP

#348

Post by cowholio4 »

mbrock wrote: post #313
cowholio4 wrote: post #248

Earlier quoted context omitted.

- All internal company emails. - Mailing Lists Side note: using pgp with MacOs Mail is super easy https://gpgtools.org/ (the project is currently working on Sierra support)

Super easy until you upgrade your operating system and suddenly you can't use your mail client for months while the understaffed open source project is trying to reverse engineer whatever Apple changed...

Yeah... definitely not the best experience. But it's free software so I'm not going to complain.

I have been using enigma on thunderbird in the meantime, which makes me appreciate how well the native mail app functions.

Can't wait for that fix.

Re: I'm giving up on PGP

#349

Post by mbrock »

cowholio4 wrote: post #348
mbrock wrote: post #313

Earlier quoted context omitted.

Super easy until you upgrade your operating system and suddenly you can't use your mail client for months while the understaffed open source project is trying to reverse engineer whatever Apple changed...

Yeah... definitely not the best experience. But it's free software so I'm not going to complain. I have been using enigma on thunderbird in the meantime, which makes me appreciate how well the native mail app functions. Can't wait for that fix.

Sure, if anything I'd complain about Apple's mail client being closed source and incapable of PGP.

Re: I'm giving up on PGP

#350

Post by hobarrera »

Arathorn wrote: post #223
hobarrera wrote: post #215

Earlier quoted context omitted.

IMHO, the biggest issue with matrix, is that there's no free hosted solution for using my own domain/email. Sure, I can rent a server and set up my own, but that's a huge commitment to "try out" a protocol which non of my acquaintances uses yet.

hm, can you point me at an email provider who provides free SMTP/IMAP/webmail or XMPP hosting for custom domains? I may be missing something, but I can't think of one... The model is that you can try it out on the matrix.org server via riot.im or something, and then run your own if you like what you see :)

What does SMTP/IMAP have to do with this? We're talking about early adopters of an unused technology. In my 2016, getting into email is far form being an early adopter.
Post reply on HN