Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Encrypted email is still a pain

incoherency.co.uk

Post reply on HN
Print view View original

121–130 of 450 posts

Re: Encrypted email is still a pain

#121

Post by parent5446 »

lukeschlather wrote: post #110
parent5446 wrote: post #6

This article: what a shitfest. But seriously, I was expecting some actual discussion about how GPG still isn't easy (or possible for that matter) in modern webmail clients, or even something relating to the usability of common GPG GUIs, but instead just got a guy complaining about how he was pressing enter too fast and missed a dialog box, among other nonsense complaints. Personally, the GPG CLI acts exactly as I exp…

A messaging standard that only advanced users can use is basically useless. That's the point of the article.

I agree with your first sentence, but I don't think that's what the article was saying. (Or at the very least, it was poorly written enough such that that did not come across.)

Re: Encrypted email is still a pain

#122

Post by snowpanda »

tptacek wrote: post #91
Tepix wrote: post #74

Earlier quoted context omitted.

Yes with no control over what happens to your key and you don't know if your message has been encrypted after it is sent and by default you aren't even told if the key of your recipient changes.

By making the discredited argument that WhatsApp's key-change behavior is a fatal flaw, you're disagreeing with: * The EFF * Moxie Marlinspike * Matthew Green * Bruce Schneier * Isis Lovecruft from Tor * the grugq * Matt Blaze * Avi Rubin * Steve Bellovin * Joseph Lorenzo Hall * Bart Preneel * Peter Honeyman * Jon Callas (who cofounded PGP Corp) * Paulo Barreto ... and about 50 more experts equally respected in the f…

Do you have sources for that? Because just looking at the first two you named the EFF (who marked WhatsApp down for being closed source).

And the owner of the Signal protocol (which is what WhatsApp uses). Obviously he's not going to argue against it.

Re: Encrypted email is still a pain

#123

Post by bluGill »

wtbob wrote: post #92
tptacek wrote: post #7

Encrypted email is pretty much over in 2017. The emerging consensus among experts is that it's not worth the trouble, or, worse, incapable of doing much more than generating a false sense of security. That's for a bunch of reasons: * An enormous installed base of clients that won't do encryption, meaning that at best you're attempting to tunnel encrypted messaging over an unencrypted transport. * A protocol that leak…

> at best you're attempting to tunnel encrypted messaging over an unencrypted transport. That covers pretty much all communication encryption: ultimately, encrypted data goes out over an unencrypted link. > A protocol that leaks metadata, including some message content, at the envelope layer. That is indeed the major problem I have with it. > Hundreds of millions of users that primarily access messages through browse…

>I think that one's home computers can probably handle the load of searching all of one's own data.

You seem to be implying that I have one computer at home. I mostly use the computer in my pocket, but sometimes I use "my" computer in "My office" at home. Sometimes I use "my wife's computer". Many people I know have a computer attached to their tv. I'm looking into putting a computer in my garage. Someday I'm likely to get a laptop or tablet computer for travel (I've had these in the past).

We need to get off the mindset of one computer per person - it was never really true, but for the average person today it is less true.

Re: Encrypted email is still a pain

#124

Post by hueving »

tptacek wrote: post #75
problems wrote: post #62

Earlier quoted context omitted.

> No, I fully understand the problem. If Google Mail vanished tomorrow, a pretty large number of people would probably stop emailing altogether. The number of people for whom that's true increases every year. I highly doubt that's true. Email is pretty essential to the functionality of the internet, from signing up accounts to getting notifications, to just plain discussions with professionals. It's pretty much the o…

Three responses: * Email remains important for middle-class Americans because it's used for business. But that is a small subset of the whole population, including very large numbers of Americans. * For almost all those users, email might as well be a Google, Yahoo, or Microsoft product. * Every year, the number of people and businesses that rely on email gets smaller --- in the last 5 years or so, by something like…

>I just think we should figure the nuts and bolts out before we decentralize

Bolting on decentralization works about as well as bolting on security.

Re: Encrypted email is still a pain

#126

Post by venomsnake »

tptacek wrote: post #7

Encrypted email is pretty much over in 2017. The emerging consensus among experts is that it's not worth the trouble, or, worse, incapable of doing much more than generating a false sense of security. That's for a bunch of reasons: * An enormous installed base of clients that won't do encryption, meaning that at best you're attempting to tunnel encrypted messaging over an unencrypted transport. * A protocol that leak…

All of those are controlled by a single company. A single point of failure. Untill there is good enough protocol anyone can run a server of and it is - pgp stays the least worst option.

All of those messingers are terrible - in email you cannhave multiple conversations with the same person by design. In thoae you can't. There is no messinger with decent history search.

Re: Encrypted email is still a pain

#127

Post by legulere »

I do not get why everyone thinks that encrypted email is GPG.

S/MIME is supported by almost all email clients.

S/MIME is far less of a pain (but still some pain and could be improved).

It has a model of how to verify that keys belong to the right person, that actually works in practice in contrast to GPG where you basically have to verify keys by hand (adversarial CAs are a problem, but probably only for a tiny amount of people).

Re: Encrypted email is still a pain

#128

Post by uiri »

tptacek wrote: post #93
mikecb wrote: post #87

Earlier quoted context omitted.

If you are an active target of a tier 1 state, your endpoint will be compromised, your decrypted communication will be read, and no cryptosystem will prevent this.

Furthermore, if you're using PGP to evade a state-level adversary, the odds are overwhelming that you've own-goaled yourself many times over: * You keep plaintext archives and drafts of your messages, because that's a fundamental feature of email clients going back 3 decades. * You use a server-mediated PGP provider like Protonmail that has your security one surreptitious Javascript injection on an XHR call away from…

You keep plaintext archives and drafts of your messages, because that's a fundamental feature of email clients going back 3 decades.

To my knowledge, mutt doesn't store decrypted archives. Drafts are stored in /tmp which can be a filesystem stored in RAM. I think using Mutt also takes care of your second point.

Your third point is the biggest problem with any system where security is bolted on (e.g. SMTP, POTS, etc.) - your end may be secure but your interlocutor is liable to compromise you one way or another. Though, as you say, this isn't a fundamental property of all encrypted messaging systems.

Re: Encrypted email is still a pain

#129

Post by bluGill »

jvdh wrote: post #47
tptacek wrote: post #27

Earlier quoted context omitted.

I use PGP pretty regularly, too. But what does that have to do with the comment I wrote?

Encrypted email for this user group is certainly not over, and there is still no realistic alternative for it. So PGP is not going to go away completely.

True, but let us acknowledge that those are edge cases. For the average person encrypted email has never been a thing.

I hope PGP remains around for people who do need it. There are people who have a real need for secure communication, and they are probably able to invent a cover story to explain your meta-data leaks. (everyone knows I buy widgets and from him: it is no surprise that we don't want details about our negotiations public)

Re: Encrypted email is still a pain

#130

Post by h4waii »

tptacek wrote: post #91
Tepix wrote: post #74

Earlier quoted context omitted.

Yes with no control over what happens to your key and you don't know if your message has been encrypted after it is sent and by default you aren't even told if the key of your recipient changes.

By making the discredited argument that WhatsApp's key-change behavior is a fatal flaw, you're disagreeing with: * The EFF * Moxie Marlinspike * Matthew Green * Bruce Schneier * Isis Lovecruft from Tor * the grugq * Matt Blaze * Avi Rubin * Steve Bellovin * Joseph Lorenzo Hall * Bart Preneel * Peter Honeyman * Jon Callas (who cofounded PGP Corp) * Paulo Barreto ... and about 50 more experts equally respected in the f…

No, no he's not.

GP was questioning the implementation and OP is merely identifying a clear weakness (regardless of who you says, it is a trade-off). Not quite an appeal to authority, but it's pretty damn close.

What exactly about the post is a discredited argument? I'm genuinely curious. WhatsApp can be doing anything behind the scenes without clients knowing about it, how is questioning this a bad thing?

Post reply on HN