Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

21 years after the request OpenPGP support gets added to Thunderbird

bugzilla.mozilla.org

Post reply on HN
Print view View original

71–80 of 281 posts

Re: 21 years after the request OpenPGP support gets added to Thunderbird

#71

Post by sudosysgen »

skyfaller wrote: post #68
mapgrep wrote: post #57

Earlier quoted context omitted.

I’m saying people will use email in any decent sized group over any significant length of time and it is very good to encrypt that email by default. If you’re saying Signal is strictly more secure I agee 100%. It’s just not suitable for using for large amounts of comms within a group. I wish they’d improve it and have even detailed features I think they should add (I made an HN thread when they got that donation from…

What about Matrix/Element for heavier communications? It's at least encrypted by default now, although I haven't carefully studied their security otherwise.

Matrix is probably the only real alternative to email, I agree. Hopefully it becomes dominant.

Re: 21 years after the request OpenPGP support gets added to Thunderbird

#73

Post by kd5bjo »

skyfaller wrote: post #67
rendx wrote: post #56

Earlier quoted context omitted.

That is the single most common misconception around PGP, and it comes up every time: (Open)PGP is first and foremost a flexible packet format (and other specs), and GnuPG is more of a CLI "library" to interface with it -- all of it. You can build something that hides metadata, you can have forward secrecy, and encryption always-on by default with PGP (and GnuPG). You can use it for whatever trust model you want, neit…

I understand that PGP doesn't have to be used with email. That is why I haven't commented on PGP, I'm saying that I think encrypted email is a bad idea, regardless of whether you use PGP or something else. We're posting in a thread about Thunderbird, an e-mail client :) I agree that one great weakness of Signal is its centralization, and that decentralization is a great strength of email. For a decentralized encrypte…

For future reference, statements like this:

> I used to love [A], but I now think [B] is a bad idea.

will lead many people to think that you consider A and B to be essentially the same thing. In the specific case of PGP and encrypted email, this is a category error: you are implying (perhaps unintentionally) that PGP’s only use is for encrypted email.

Re: 21 years after the request OpenPGP support gets added to Thunderbird

#74

Post by Longlius »

capableweb wrote: post #41

> For reasons associated with U.S. export restrictions, no cryptographic security of any kind is likely to be included in the original sources https://bugzilla.mozilla.org/show_bug.cgi?id=22687#c1 Creepiest thing with seeing this ticket (again?) is noticing that the first comment is about that is used to be illegal to write anything with cryptographic security in the US and sell/give it to the outside world. https://…

Any signatory to the Wassenaar Arrangement, which includes the entirety of North America, Europe (including Russia), Australia, India, and Pacific Asia (minus China) must consider cryptographic technologies to be munitions for the purposes of export. Now, these restrictions have been considerably loosened to the point that the export isn't really controlled, but international law still considers it a munition. The US is hardly unique in this regard.

It works the other way too. A surprising number of countries still restrict the import of cryptographic technology, including several EU states.

Re: 21 years after the request OpenPGP support gets added to Thunderbird

#75

Post by toast0 »

jolux wrote: post #66
toast0 wrote: post #64

Earlier quoted context omitted.

> No, I'm asking how a new open protocol can be built on top of email in a way that maintains strong backwards compatibility while offering strong security guarantees, like end-to-end encryption. I don't think it's possible. You can't have strong security guarantees with backwards compatability, because backwards compatability requires plain text sending. Unless you're OK with limited guarantees like the UI will tell…

>You can't have strong security guarantees with backwards compatability, because backwards compatability requires plain text sending. That's right. >Unless you're OK with limited guarantees like the UI will tell you when the mail could be sent in plain text. Or if the UI tells you the message will be end to end encrypted, it won't fallback to plain text, etc. This would require changing all the clients.

> This would require changing all the clients.

Not really, the old clients would never send (or receive) end to end encrypted messages, so they don't need new UI to tell you that. That's the cost of unbounded backwards comptability.

If you want to have 100% coverage of email users, changing all clients is part of the deal. But, uhhh, good luck with that. Server based standards are an easier lift --- you could build a standard to require hop to hop encryption on mail and expect that to plausibly gain enough adoption to use over a managable time frame. Of course it would be trivial for a hop in the delivery path to subvert that and remove the request, and all hops in delivery would still have message content access; but if people like it, a large majority of servers might support it in 5-10 years.

Re: 21 years after the request OpenPGP support gets added to Thunderbird

#76

Post by Quekid5 »

rendx wrote: post #56
skyfaller wrote: post #50

I used to love PGP, but I now think encrypted email is a bad idea. https://latacora.micro.blog/2020/02/19/stop-using-encrypted.... Better to use a protocol designed with encryption in mind, like Signal, to get forward secrecy, avoid leaking metadata, and have encryption always on by default. UPDATE: I have been reminded that PGP does not have to be used with email. I meant to say that I used to love using PGP with em…

That is the single most common misconception around PGP, and it comes up every time: (Open)PGP is first and foremost a flexible packet format (and other specs), and GnuPG is more of a CLI "library" to interface with it -- all of it. You can build something that hides metadata, you can have forward secrecy, and encryption always-on by default with PGP (and GnuPG). You can use it for whatever trust model you want, neit…

> GnuPG is more of a CLI "library" to interface with it

It abjectly fails at that. It's just awful to interface with.

Re: 21 years after the request OpenPGP support gets added to Thunderbird

#77

Post by rlpb »

Quekid5 wrote: post #76
rendx wrote: post #56

Earlier quoted context omitted.

That is the single most common misconception around PGP, and it comes up every time: (Open)PGP is first and foremost a flexible packet format (and other specs), and GnuPG is more of a CLI "library" to interface with it -- all of it. You can build something that hides metadata, you can have forward secrecy, and encryption always-on by default with PGP (and GnuPG). You can use it for whatever trust model you want, neit…

> GnuPG is more of a CLI "library" to interface with it It abjectly fails at that. It's just awful to interface with.

Who said that it's for a user to interface with directly? mutt interfaces with it perfectly fine, and mutt's PGP UX is also fine.

Re: 21 years after the request OpenPGP support gets added to Thunderbird

#78

Post by skyfaller »

kd5bjo wrote: post #73
skyfaller wrote: post #67

Earlier quoted context omitted.

I understand that PGP doesn't have to be used with email. That is why I haven't commented on PGP, I'm saying that I think encrypted email is a bad idea, regardless of whether you use PGP or something else. We're posting in a thread about Thunderbird, an e-mail client :) I agree that one great weakness of Signal is its centralization, and that decentralization is a great strength of email. For a decentralized encrypte…

For future reference, statements like this: > I used to love [A], but I now think [B] is a bad idea. will lead many people to think that you consider A and B to be essentially the same thing. In the specific case of PGP and encrypted email, this is a category error: you are implying (perhaps unintentionally) that PGP’s only use is for encrypted email.

Fair enough, I've updated my top comment with an attempt to clarify.

Re: 21 years after the request OpenPGP support gets added to Thunderbird

#79

Post by 67868018 »

capableweb wrote: post #41

> For reasons associated with U.S. export restrictions, no cryptographic security of any kind is likely to be included in the original sources https://bugzilla.mozilla.org/show_bug.cgi?id=22687#c1 Creepiest thing with seeing this ticket (again?) is noticing that the first comment is about that is used to be illegal to write anything with cryptographic security in the US and sell/give it to the outside world. https://…

Export from the US is not uncontrolled

https://www.schneier.com/blog/archives/2014/11/the_return_of...

Re: 21 years after the request OpenPGP support gets added to Thunderbird

#80

Post by godelski »

thereticent wrote: post #65
libraryatnight wrote: post #47

Earlier quoted context omitted.

at least you had a friend to email! I couldn't get any of my friends to do it. "Man we can encrypt our emails." "But why..." "It'd be cool" "This seems hard." "Come on, exchange keys with me." "I don't want to make one."

My high school friends and I settled for using Gain and Pidgin to enable the "secure" icon. :)

For awhile you could use Pidgin and OTR to even have secure messages through facebook's messenger. I'm not sure if they decrypted it or not, but it sure was fun.
Post reply on HN