Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The PGP Problem

latacora.micro.blog

Post reply on HN
Print view View original

101–110 of 369 posts

Re: The PGP Problem

#101

Post by floatingatoll »

nightfly wrote: post #95
floatingatoll wrote: post #84

Earlier quoted context omitted.

Forcing iMessage to open will immediately result in MITM iMessage proxies that users can use to store iMessages that are meant to auto-delete, so that they can violate the wishes of the other party. These do not exist today because Apple binds iMessage to your hardware and bans your entire device when anyone is found to be operating such a service, either for themselves or others. Do you want open source clients that…

You can violate the wishes of the other party by taking a screenshot or, in the extreme, a photo of the screen. You're only preventing the very lazy/unmotivated from retaining messages.

Correct, screenshots are a viable attack against both closed and open source platforms. Preventing casual retention is the best you can hope for, and is a worthy goal regardless that it does not result in the perfection of a Faraday cage’d clean room

Re: The PGP Problem

#102

Post by floatingatoll »

olliej wrote: post #91
floatingatoll wrote: post #84

Earlier quoted context omitted.

Forcing iMessage to open will immediately result in MITM iMessage proxies that users can use to store iMessages that are meant to auto-delete, so that they can violate the wishes of the other party. These do not exist today because Apple binds iMessage to your hardware and bans your entire device when anyone is found to be operating such a service, either for themselves or others. Do you want open source clients that…

iMessage doesn't have any kind of auto deleted messages - it's a feature that messages are persistent across all your devices.

Incorrect. Audio messages are deleted two minutes after playback by default.

Re: The PGP Problem

#103

Post by cmroanirgo »

umvi wrote: post #43
Sniffnoy wrote: post #38

So what do I use for encrypted messaging that can, like, replace email, then? Nobody seems to have provided any sort of satisfactory answer to this question. To be clear, an answer this has to not just be a secure way of sending messages, it also has to replicate the social affordances of email. E.g., things distinguishing how email is used from how text-messaging is used: 1. Email is potentially long-form. I sit dow…

I don't get what's insecure about normal unencrypted email. It's sent over https, isn't it? It's not like I can read your emails unless I break into Google's servers, no? And even if I do, they probably aren't even stored in plaintext. I just don't get the encrypted email obsession. It's impossible for an individual to withstand a targetted cyber attack so it seems pointless to go above and beyond to ultra encrypt ev…

Any sysadmin can read your email, in general. There's no holistic "this email can't be read by anyone other than the recipient" as a solution, which is what a lot of us are aiming for. Things like protonmail and tutanota get really close, but they're proprietary solutions and don't work for "the many" (such as yourself) who use a hosted solution such as Gmail, who seem to have no interest in providing an open solution.

Re: The PGP Problem

#104

Post by roel_v »

simonh wrote: post #78
Sniffnoy wrote: post #48

Earlier quoted context omitted.

Good question. Not sure. Although I don't see why I wouldn't, if they have a PGP key listed? (I guess there is some question over whether the listed key is actually them?) But my point is that, well, email is a good way to do that, and Signal isn't, so I'm going to use email rather than Signal. Honestly, I wouldn't focus on (3), because as I see it, if you can replicate the feel of email, things like (1)-(2), so that…

How does one list a public PGP key, is there a verified central listing service?

There used to be a bunch of those in the 90s and it was a mess.

Re: The PGP Problem

#105

Post by justincormack »

garmaine wrote: post #96
wodenokoto wrote: post #88

Earlier quoted context omitted.

> And then I would be _very_ surprised if google doesn't use the content of your emails for advertisement and tracking purposes. That would go against their own privacy policy. But they are one change away from doing it.

Really? When gmail came out they were explicitly up front about using the content of the email to deliver targeted ads. Has that changed?

If you pay Google for email they will not use the content for ads. Free accounts I think they still do.

Re: The PGP Problem

#106

Post by swores »

DuskStar wrote: post #57
tptacek wrote: post #2

Really, all I did here was combine posts from Matthew Green, Filippo Valsorda, and George Tankersley into one post, and then talk to my partner LVH about it. So blame them. (also 'pvg, who said i should write this, and it's been nagging at me ever since)

What are your thoughts on Keybase as a secure Slack replacement?

Personally, I love Keybase and it is my #1 choice for communicating with a few people, but bugs are far too frequent for me to consider it for a business.

It's getting better, but not close being business ready imo.

Re: The PGP Problem

#107

Post by upofadown »

So the suggested solution for more secure email is just to give up on the concept of email entirely? Anything that does not do perfect forward secrecy is just pointless so there is no point in trying to keep significant discussions to refer to later. We are expected to return to a sort of virtual pre-writing stage.

This is not really helpful. For all its shortcomings, PGP is pretty much all we have. If used in a straightforward way it actually can protect email from nation state level actors for a significant time. That's gotta count for something.

Re: The PGP Problem

#108

Post by pgeorgi »

tptacek wrote: post #2

Really, all I did here was combine posts from Matthew Green, Filippo Valsorda, and George Tankersley into one post, and then talk to my partner LVH about it. So blame them. (also 'pvg, who said i should write this, and it's been nagging at me ever since)

The elephant in the room is "what to do about email", and a significant part of the issues are related to the "encrypt email" use case: part of the metadata leakage, no forward secrecy, ...

The closest advice to this in the article would be "use Signal" which has various issues of its own, unrelated to crypto: it has Signal Foundation as a SPOF and its ID mechanism is outright wonky, as phone numbers are IDs that are location bound, hard to manage multiple for a person, hard to manage multiple persons per ID, hard to roll over.

To me that seems to be a much bigger issue than "encrypting files for purposes that aren't {all regular purposes}".

Re: The PGP Problem

#109

Post by Sniffnoy »

floatingatoll wrote: post #77
Sniffnoy wrote: post #72

Earlier quoted context omitted.

Why not? I mean, that's what publicly listing your public key is for, right?

Nope. I have at least three public never-expiring keys that I am unable revoke and that remain listed as valid because the keyservers don’t occasionally revalidate proof of ability to decrypt.

Oh, that's a good point. Heh, I have one of those, too, which even caused a problem once[0]. I wouldn't expect people to find it first, though, because I wouldn't expect people to go to a keyserver first; I'd expect them to find my key on one of the places I have it listed on the web. I've never tried blindly entering someone's email address into a keyserver and just hoping they have a key; I've only sent PGP-encrypted email to people who list their keys on the web.

[0]How it caused a problem: I added an email address to my public key (or maybe it expired or something, I forget), and asked people to refresh their copy of my key. One person instead downloaded it entirely anew from a keyserver and got the old one. Oops. (Admittedly I didn't explicitly use the word "refresh".) Anyway yeah -- though this problem had happened to me, it hadn't ocurred to me that it might be common; maybe this is more of a problem than I thought...

Re: The PGP Problem

#110

Post by riquito »

garmaine wrote: post #96
wodenokoto wrote: post #88

Earlier quoted context omitted.

> And then I would be _very_ surprised if google doesn't use the content of your emails for advertisement and tracking purposes. That would go against their own privacy policy. But they are one change away from doing it.

Really? When gmail came out they were explicitly up front about using the content of the email to deliver targeted ads. Has that changed?

There are a lot of misinformations around, and the Google haters crowd has plenty of pitchforks.

https://safety.google/privacy/ads-and-data/

> Google does not use keywords or messages in your inbox to show you ads. Nobody reads your email in order to show you ads.

Post reply on HN