Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

21 years after the request OpenPGP support gets added to Thunderbird

bugzilla.mozilla.org

Post reply on HN
Print view View original

101–110 of 281 posts

Re: 21 years after the request OpenPGP support gets added to Thunderbird

#101

Post by XMPPwocky »

rendx wrote: post #83
Quekid5 wrote: post #76

Earlier quoted context omitted.

> GnuPG is more of a CLI "library" to interface with it It abjectly fails at that. It's just awful to interface with.

Agreed. It has been long overdue that alternative OpenPGP implementations exist that try to address some of the peculiarities of GnuPG -- most of which are [still] there because its founder wants to preserve compatibility at all costs to support some of its long-term institutional users. And, yes, dealing with these peculiarities should not the responsibility of end users, but of further abstraction layers built on t…

What is a good non-email use case for the PGP format?

Re: 21 years after the request OpenPGP support gets added to Thunderbird

#102

Post by thaumasiotes »

oconnore wrote: post #8

I do think there ought to be a way to do good cryptography in email. Email is not going away anytime soon, so giving up on it as a legitimate place where cryptography is needed seems too ivory tower for me. The “dead simple solution” is to just run the Signal protocol over SMTP, although I’m sure it’s possible there is a better design if you were to think about the specifics.

Isn't the "dead simple solution":

1. Write the message.

2. Encrypt the message.

3. Paste the encrypted message into the email client.

Your odds of accidentally sending a message in the clear are zero.

Re: 21 years after the request OpenPGP support gets added to Thunderbird

#103

Post by oconnore »

thaumasiotes wrote: post #102
oconnore wrote: post #8

I do think there ought to be a way to do good cryptography in email. Email is not going away anytime soon, so giving up on it as a legitimate place where cryptography is needed seems too ivory tower for me. The “dead simple solution” is to just run the Signal protocol over SMTP, although I’m sure it’s possible there is a better design if you were to think about the specifics.

Isn't the "dead simple solution": 1. Write the message. 2. Encrypt the message. 3. Paste the encrypted message into the email client. Your odds of accidentally sending a message in the clear are zero.

Have you ever attempted to get an organization of people to do this reliably?

Re: 21 years after the request OpenPGP support gets added to Thunderbird

#104

Post by owenmarshall »

rendx wrote: post #86
pvg wrote: post #85

Earlier quoted context omitted.

(Open)PGP is first and foremost a flexible packet format That makes an even better case that PGP is not much of a modern secure system generally, rather than it just being bad for secure email.

Because packet formats are bad? I don't understand what you're trying to say here.

Flexibility in cryptography is often very bad and opens doors to downgrade attacks or things like JWT’s alg:none issues.

https://www.imperialviolet.org/2016/05/16/agility.html

“Have one joint, and keep it well oiled.”

Re: 21 years after the request OpenPGP support gets added to Thunderbird

#105

Post by acdha »

toast0 wrote: post #61
acdha wrote: post #39

Earlier quoted context omitted.

Enterprises, at least in the form of the U.S. federal government, have but there are two key drawbacks: 1. At least until recent, Microsoft implemented it as blocking code in the UI thread – open a message and Outlook won't paint until it can verify the cert, access your local key store (hope your token is in a USB port which is 100% reliable), etc. If you thought “Does that mean that revocation checks block the UI u…

> 2. Adoption hasn't been enough to be able to ban untrusted senders. This could still be quite useful for, say, a hard requirement that *@example.com must have signatures but it doesn't help with really common phishing tactics like pretending to be a vendor, business partner, etc. Preventing forgery of @example.com is nice, but sadly doesn't matter that much, because a message fro "Your Boss" is just going to show u…

Or even “hey, I’m away from the office and lost my company phone. Can you help me …” attempts using an obvious third-party service. All of these have fooled people in the past and you really need high adoption rates to seriously reduce the odds.

Re: 21 years after the request OpenPGP support gets added to Thunderbird

#106

Post by tedunangst »

throrthaway wrote: post #62
JdeBP wrote: post #58

Earlier quoted context omitted.

It has been 21 years since people asked to have SRV DNS resource record support in Mozilla. * http://jdebp.uk./FGA/dns-srv-record-use-by-clients.html

Now my opinion may seem controversial but I personally believe having feature requests that are old enough to legally drink is not a sign of healthy project management

The bug is closed. What more do you expect project management to do?

Re: 21 years after the request OpenPGP support gets added to Thunderbird

#107

Post by res0nat0r »

hn_throwaway_99 wrote: post #81
capableweb wrote: post #41

> For reasons associated with U.S. export restrictions, no cryptographic security of any kind is likely to be included in the original sources https://bugzilla.mozilla.org/show_bug.cgi?id=22687#c1 Creepiest thing with seeing this ticket (again?) is noticing that the first comment is about that is used to be illegal to write anything with cryptographic security in the US and sell/give it to the outside world. https://…

Wow, now I feel dated, I remember tons of discussion around this at the time and I remember that T-shirt from the Wikipedia article very well.

This page is still up and running and I always thought this hack was pretty awesome: http://www.cypherspace.org/adam/rsa/

Re: 21 years after the request OpenPGP support gets added to Thunderbird

#108

Post by tptacek »

rendx wrote: post #56
skyfaller wrote: post #50

I used to love PGP, but I now think encrypted email is a bad idea. https://latacora.micro.blog/2020/02/19/stop-using-encrypted.... Better to use a protocol designed with encryption in mind, like Signal, to get forward secrecy, avoid leaking metadata, and have encryption always on by default. UPDATE: I have been reminded that PGP does not have to be used with email. I meant to say that I used to love using PGP with em…

That is the single most common misconception around PGP, and it comes up every time: (Open)PGP is first and foremost a flexible packet format (and other specs), and GnuPG is more of a CLI "library" to interface with it -- all of it. You can build something that hides metadata, you can have forward secrecy, and encryption always-on by default with PGP (and GnuPG). You can use it for whatever trust model you want, neit…

This is a weird argument. By your logic, there's practically no cryptosystem PGP can't be; after all, it's an omnibus standard to which people routinely add extensions for new algorithms. Want a double ratchet? An elliptic curve triple handshake? The "building blocks" are all there, all you have to do is use PGP's "flexible packet format" to carry them.

Re: 21 years after the request OpenPGP support gets added to Thunderbird

#109

Post by hansvm »

Longlius wrote: post #74
capableweb wrote: post #41

> For reasons associated with U.S. export restrictions, no cryptographic security of any kind is likely to be included in the original sources https://bugzilla.mozilla.org/show_bug.cgi?id=22687#c1 Creepiest thing with seeing this ticket (again?) is noticing that the first comment is about that is used to be illegal to write anything with cryptographic security in the US and sell/give it to the outside world. https://…

Any signatory to the Wassenaar Arrangement, which includes the entirety of North America, Europe (including Russia), Australia, India, and Pacific Asia (minus China) must consider cryptographic technologies to be munitions for the purposes of export. Now, these restrictions have been considerably loosened to the point that the export isn't really controlled, but international law still considers it a munition. The US…

Relevant xkcd: https://xkcd.com/504/

Re: 21 years after the request OpenPGP support gets added to Thunderbird

#110

Post by ifmpx »

btilly wrote: post #99
rendx wrote: post #83

Earlier quoted context omitted.

Agreed. It has been long overdue that alternative OpenPGP implementations exist that try to address some of the peculiarities of GnuPG -- most of which are [still] there because its founder wants to preserve compatibility at all costs to support some of its long-term institutional users. And, yes, dealing with these peculiarities should not the responsibility of end users, but of further abstraction layers built on t…

The OpenPGP community would do more for security if they listened to serious cryptographers and began recommending better solutions. See https://latacora.micro.blog/2019/07/16/the-pgp-problem.html for more on that. And it isn't hard to find lots and lots of cryptographers agreeing with the thesis.

People in this industry use OpenPGP because it's flexible and amendable to almost any usecase you can think of. "Better solutions" are usually indeed better but are also so specialized for their purpose to the point that they can't be easily used for any other purpose.

OpenPGP is used to secure everything from simple messages and email to authenticating OS updates for most servers today.

Should they use something more specialized now that it exists? Sure, but that an argument for PGP not against it; PGP is useful in situations where no specialized solutions exist or are inadequate.

Until something comes along that can cover every situation where OpenPGP is useful, I can't see people stop using it (much to the dismay of the 5 vocal crptologists that keep arguing against it).

Post reply on HN