Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Encrypted email is still a pain

incoherency.co.uk

Post reply on HN
Print view View original

401–410 of 450 posts

Re: Encrypted email is still a pain

#401

Post by 0x44 »

milesrout wrote: post #333
tptacek wrote: post #7

Encrypted email is pretty much over in 2017. The emerging consensus among experts is that it's not worth the trouble, or, worse, incapable of doing much more than generating a false sense of security. That's for a bunch of reasons: * An enormous installed base of clients that won't do encryption, meaning that at best you're attempting to tunnel encrypted messaging over an unencrypted transport. * A protocol that leak…

>* An enormous installed base of clients that won't do encryption, meaning that at best you're attempting to tunnel encrypted messaging over an unencrypted transport. All encrypted communication on the internet is 'attempting to tunnel encrypted messaging over an unencrypted transport.' That's literally the entire point. I don't care that my messages are broken down into unencrypted IP packets, because my messages ar…

    * A protocol that leaks metadata, including some message content, at the envelope layer.
  Could you elaborate more on this? I don't really understand what you mean.
He means:

  EHLO your.mx.example.tld
  MAIL FROM:
  MAIL TO:
  DATA
  From: Definitely Not Bob 
  To: Probably Not Alice 
  Date: Mon, 12 June 2017 16:02:43 -0500
  Subject: Super Secret EMAIL! Don't let Eve see!
  
  -----BEGIN PGP MESSAGE-----
  ...
  -----END PGP MESSAGE-----
  .
  QUIT
Thereby leaking at minimum the sender and recipient, as well as any intermediate hosts that relayed the email. Depending on how your MTA handles email, you can also leak subject and other metadata.

Re: Encrypted email is still a pain

#402

Post by andrewflnr »

milesrout wrote: post #335
losvedir wrote: post #227

Earlier quoted context omitted.

> "consensus"? a few blog posts about some bad user experience with GnuPG / the PGP ecosystem is, at best, just an (re)emerging topic on HN, not the end of email encryption. Well, tptacek is himself an expert. As he's the founder of a successful security consultancy who has friends among academic cryptographers, I took his comment to mean the belief among himself and his peers. It's ultimately an appeal to authority,…

>As he's the founder of a successful security consultancy who has friends among academic cryptographers, I took his comment to mean the belief among himself and his peers. Security consultants are who you should trust the least when dealing with security. They aren't interested in reliable, easy-to-use and widespread security. They are interested in difficult, interesting security that breaks and needs consultants.

Security consultants don't need to engage in sabotage to keep job security. User incompetence is adequate.

Re: Encrypted email is still a pain

#403

Post by joecool1029 »

ryanmarsh wrote: post #397
joecool1029 wrote: post #179

Earlier quoted context omitted.

> No, it's not. It's the only widely available, decentralized system, with which you can send to anyone, if you know the address. None of the big ones is this open. SS7 is internet connected and federated and it's arguably as big as email. > XMPP tried to address this and failed; now Matrix is trying again. Oh, agreed on XMPP. Encryption was a very much after the fact addition to it though. I haven't heard about Matr…

What is SS7?

https://en.wikipedia.org/wiki/Signalling_System_No._7

Re: Encrypted email is still a pain

#404

Post by [deleted] »

tptacek wrote: post #341
milesrout wrote: post #333

Earlier quoted context omitted.

>* An enormous installed base of clients that won't do encryption, meaning that at best you're attempting to tunnel encrypted messaging over an unencrypted transport. All encrypted communication on the internet is 'attempting to tunnel encrypted messaging over an unencrypted transport.' That's literally the entire point. I don't care that my messages are broken down into unencrypted IP packets, because my messages ar…

Why would I take the time to answer any of your questions? You just wrote upthread that, because I have a background in security consulting, everything I write must be designed to cause security problems so I can line my pockets. No thanks.

[deleted]

Re: Encrypted email is still a pain

#405

Post by detaro »

m3rc wrote: post #212
Freak_NL wrote: post #198

Earlier quoted context omitted.

For personal use email is rarely self-hosted, but corporations, governments, and organisations often run their own email infrastructure. That effectively makes email a decentralized federated system. You might argue how a lot of email is either send to or send from Google, Apple, or Microsoft services, and that is thus somewhat centralized, but isn't that stretching the definition?

Is talking about government organizations hosting their own email servers really a point in email's favor in 2017?

Why would it be a point against it? I generally think my government being in control of its communication infrastructure is a good thing.

Re: Encrypted email is still a pain

#406

Post by cpach »

milesrout wrote: post #335
losvedir wrote: post #227

Earlier quoted context omitted.

> "consensus"? a few blog posts about some bad user experience with GnuPG / the PGP ecosystem is, at best, just an (re)emerging topic on HN, not the end of email encryption. Well, tptacek is himself an expert. As he's the founder of a successful security consultancy who has friends among academic cryptographers, I took his comment to mean the belief among himself and his peers. It's ultimately an appeal to authority,…

>As he's the founder of a successful security consultancy who has friends among academic cryptographers, I took his comment to mean the belief among himself and his peers. Security consultants are who you should trust the least when dealing with security. They aren't interested in reliable, easy-to-use and widespread security. They are interested in difficult, interesting security that breaks and needs consultants.

Let’s say that what you wrote holds true. Who should we trust then, when it comes to security advice?

Re: Encrypted email is still a pain

#407

Post by Certhas »

e12e wrote: post #346
Certhas wrote: post #182

Earlier quoted context omitted.

Also, is it really true that a state actor could not effectively block email? Or for that matter all encrypted email? They are, after all, blocking web pages. It seems to me (as a lay man observer) that at the state actor level the Internet is relying on centralized resources already, maybe that's why decentralization seems intuitively less important to me. This is not to disagree with your points.

It's more that a private actor can exclude you from any network. Maybe WhatsApp blacklist you for "abuse". Maybe they're right. But even if you kill someone you're allowed to use the telephone network, and send or receive letters. As long as the message silos aren't regulated as utilities, decentralised systems give us more of the freedoms. It's pretty easy to run a separate dns system - you can even blend your own p…

That's a fair point actually. Does the fact that signal is open source and based on phone numbers change that though? Seems that as long as you have access to the phone network you have access to the signal network...

Re: Encrypted email is still a pain

#408

Post by dtornabene »

nickpsecurity wrote: post #385
dtornabene wrote: post #369

Earlier quoted context omitted.

1) I don't take the snowden leaks as gospel, sorry. 2) Even if i did, "most peoples adversary" is a meaningless phrase at this point, and also used quite often as a rhetorical feint to take down someones arg. And given the profound unification of the security state across seemingly all lines, its also dead wrong. Technically everyones adversary is the NSA, as long as data is shared surreptiously and , more and more,…

"1) I don't take the snowden leaks as gospel, sorry. " Don't take them as gospel. That's faith. Review the evidence they're true from U.S. governments' reaction to them to what similar malware was found by third parties. Once evidence is in, then you have reason to believe them and then in stuff such as GPG by extension. And the leaks didn't say anything about faraday cages. Just that they had to rely on the extremel…

the idea that "evidence" comes from the govts reaction is just weak, its just a terrible argument. Extrapolating from that is also largely a mistake. Any number of possible interpretations of the docs themselves and the responses by the state could and have been made, each of which could point to mutually exclusive conclusions for toosl mentioned in the docs. This isn't a particularly novel argument (my arg, I mean) either. I wasn't pulling the faraday cages from the docs themselves, as well, I was positing that as an extreme example of data security.

Re: Encrypted email is still a pain

#409

Post by newscracker »

confounded wrote: post #364
NoGravitas wrote: post #279

Earlier quoted context omitted.

Also, no way to have multiple separate conversations with the same person, or threaded conversations. These may just be app problems -- there may be protocol support for future applications to provide these (this is where Matrix stands today). But the lack of interest in these things doesn't look good.

I got a group of about 30 non-technies using Signal, not because they knew what what perfect forward secrecy is, but because they grew vaguely suspicious of the motivations of governments and Facebook, and people/Google-results they trusted were positive. The details don't matter to ordinary people, but our approval matters much more than you think. I have very high hopes for Matrix.org.

I think your group of people would be highly disappointed whenever each person moves to a new device and finds that they have essentially "lost" all old messages and have to re-join groups afresh.

> The details don't matter to ordinary people, but our approval matters much more than you think. I have very high hopes for Matrix.org.

I agree on this part completely, and I try to introduce better tools to others too. But not having messages restored on a new device (even when a user backs up and restores all data) and not providing a way for that when changing devices is unacceptable for me. At this point I'm back to Telegram, which is a compromise, but provides a much better experience as far as usability and meeting the expectations of non-tech users go.

Re: Encrypted email is still a pain

#410

Post by Tepix »

mjevans wrote: post #275
Tepix wrote: post #73

gpg2 broke when I updated from Ubuntu 14.04 to Ubuntu 16.04. I had to export the keys using gpg and import them using gpg2. Before the upgrade gpg2 was able to read the keys just fine. Now, that's not the only problem after the upgrade, Enigmail is having some other issues... It's a mess.

The problem was likely that gpg2 made a /copy/ of your gpg(1) keyring when it first ran. After that they were out of sync. gpg2 really just needs a gpg1 comparability shim that's good enough that it /replaces/ the gpg1 tools on a system and seamlessly gets them to use the gpg2 keyring.

Not sure. I was already using gpg2 with Ubuntu 14.04 so I see no reason why it would stop to work.
Post reply on HN