What's the matter with PGP? • Hacker News Board

Re: What's the matter with PGP?

#11

Post by Spooky23 » Wed, Aug 13, 2014, 7:09 PM UTC

tptacek wrote: post #3

At one point in this essay, Matt suggests that every successful end-to-end encryption scheme has employed transparent (or "translucent") key management. What he's referring to is the idea behind, say, OTR: two people can use it without the key handshake required by PGP. Matt is wrong about this. He's being victimized by a pernicious fallacy. It certainly appears that the most "successful" cryptosystems have transpare…

You nailed it. I stopped reading and started laughing when iMessage was hailed as a successful platform addressing these issues. The only thing securing iMessage is the procedure for processing law enforcement requests.

PGP is a tool that requires expertise to operate effectively. That isn't good or bad, it just is.

Re: What's the matter with PGP?

#12

Post by unimpressive » Wed, Aug 13, 2014, 7:09 PM UTC

tptacek wrote: post #3

At one point in this essay, Matt suggests that every successful end-to-end encryption scheme has employed transparent (or "translucent") key management. What he's referring to is the idea behind, say, OTR: two people can use it without the key handshake required by PGP. Matt is wrong about this. He's being victimized by a pernicious fallacy. It certainly appears that the most "successful" cryptosystems have transpare…

>They do indeed have an advantage in deployability!

Deployability is worth more than might be immediately obvious. The question of deployment is directly related to the business of availability. If 99% of people used a crypto system that provided no real security beyond thwarting a global adversary, which also had the option for further measures to confirm identity when necessary, we would be in a much better position than we are now because it would mean that when I do have contacts I would prefer to use encryption with the software will already be on their system and I only need to instruct them in how to use it.

There's a fallacy in saying that no measures are better than imperfect measures 'because then you don't have a false sense of security'. Regardless of security measures or not the false sense of security is baked into how people use computers.

I challenge you to go explain to anyone you know who does not identify as a 'computer person' how email routing works and why it's quite possible for a 3rd party to read their mail. If they even understand what you're talking about, the response is an almost universally cool 'Oh but so many other people do it, and what am I supposed to do stop using email?'

The vast majority of people will not stop talking just because in the abstract they might be overheard.

EDIT: As a note, I think any centralized system of key distribution is fundamentally insecure.

Re: What's the matter with PGP?

#13

Post by lelf » Wed, Aug 13, 2014, 7:09 PM UTC

Not mainstream ≠ suck.

Also, about “terrible mail client implementations”, — the problem is, to not be terrible for many is to be built-in to GMail (and work transparently there). The consequences of that are obvious I hope. So no, thanks.

Re: What's the matter with PGP?

#14

Post by nodata » Wed, Aug 13, 2014, 7:10 PM UTC

exelius wrote: post #8

tptacek wrote: post #3

At one point in this essay, Matt suggests that every successful end-to-end encryption scheme has employed transparent (or "translucent") key management. What he's referring to is the idea behind, say, OTR: two people can use it without the key handshake required by PGP. Matt is wrong about this. He's being victimized by a pernicious fallacy. It certainly appears that the most "successful" cryptosystems have transpare…

I think the argument is that PGP is so difficult to use that by and large people just won't bother. Yes, transparent key systems would likely be less secure than PGP. If the usability were significantly better and people used them, that is better than the alternative of using nothing. For many of these solutions, there is a window of vulnerability surrounding the key exchange that closes if you aren't snooping traffi…

When I ask people for their e-mail address, they give it to me.

When I ask them to verify their pgp key, it's less easy.

How could the verification of the key be built into the address they give me? Something DNSSEC based I guess.

Re: What's the matter with PGP?

#15

Post by tptacek » Wed, Aug 13, 2014, 7:11 PM UTC

nodata wrote: post #14

exelius wrote: post #8

Earlier quoted context omitted.

I think the argument is that PGP is so difficult to use that by and large people just won't bother. Yes, transparent key systems would likely be less secure than PGP. If the usability were significantly better and people used them, that is better than the alternative of using nothing. For many of these solutions, there is a window of vulnerability surrounding the key exchange that closes if you aren't snooping traffi…

When I ask people for their e-mail address, they give it to me. When I ask them to verify their pgp key, it's less easy. How could the verification of the key be built into the address they give me? Something DNSSEC based I guess.

Yes. DNSSEC. Because what we need is a trusted arbiter, and who better to fulfill that role than the governments of the US, or whatever country happens to own the TLD I use?

Re: What's the matter with PGP?

#16

Post by michaelt » Wed, Aug 13, 2014, 7:12 PM UTC

tptacek wrote: post #6

bdamm wrote: post #5

Earlier quoted context omitted.

PGP is only trustworthy if both parties treat key management with the utmost severity, and if everyone in the conversation maintains the integrity of a given thread (in the email case). There are a precious few individuals for whom I have that level of trust in their management of their private key. I could not even trust my wife to manage a hardware key that I gave her, it would fall apart immediately; "I cannot use…

Both of these statements can't possibly be true: * PGP is only trustworthy if both parties treat key management with the utmost severity. * Transparent key management systems that rely entirely on heuristics and click-through warnings are trustworthy.

Presumably the hope for transparent key management would be something like the CA system used in TLS, with certain reforms (certificate transparency? Namecoin?) which make it visible when a CA has been hacked or has collaborated with a global adversary.

So there's just a dozen or so central authorities who need to handle keys with the utmost severity.

Re: What's the matter with PGP?

#17

Post by _delirium » Wed, Aug 13, 2014, 7:12 PM UTC

tptacek wrote: post #10

exelius wrote: post #8

Earlier quoted context omitted.

I think the argument is that PGP is so difficult to use that by and large people just won't bother. Yes, transparent key systems would likely be less secure than PGP. If the usability were significantly better and people used them, that is better than the alternative of using nothing. For many of these solutions, there is a window of vulnerability surrounding the key exchange that closes if you aren't snooping traffi…

An irreconcilable difference between you and I on this point: you think it's a good thing if people use bad crypto instead of no crypto, and I don't. I don't think bad crypto makes the global adversary go "aw, shit, we better target someone else". I think it makes them go "excellent, something else we can get a secret appropriation to go break".

My impression (I could be wrong) is that a lot of OTR users in particular are worried mainly about the local adversary: someone on the coffee-shop wifi, or the corporate IT administrator, sniffing their IM traffic. In that case you just have to have an encryption setup that's good enough to circumvent whatever analysis that class of adversary is likely to use.

Re: What's the matter with PGP?

#18

Post by tptacek » Wed, Aug 13, 2014, 7:14 PM UTC

michaelt wrote: post #16

tptacek wrote: post #6

Earlier quoted context omitted.

Both of these statements can't possibly be true: * PGP is only trustworthy if both parties treat key management with the utmost severity. * Transparent key management systems that rely entirely on heuristics and click-through warnings are trustworthy.

Presumably the hope for transparent key management would be something like the CA system used in TLS, with certain reforms (certificate transparency? Namecoin?) which make it visible when a CA has been hacked or has collaborated with a global adversary. So there's just a dozen or so central authorities who need to handle keys with the utmost severity.

I'm baffled by that attitude (and CT, as well). So, you found out after the fact that the global adversary injected themselves in the middle of your conversation with a source. What do you do now? Move to an apartment in Russia?

Also the things that break transparently-keyed systems do so repeatedly. That's what transparent keying means: it's mediated by machines, and factored the slow, clumsy, human interactions out. CT? Audit logs? It's like Lucy and Charlie Brown with the football, except Lucy is hooked up to a for() loop.

Re: What's the matter with PGP?

#19

Post by rmoriz » Wed, Aug 13, 2014, 7:15 PM UTC

In my opinion, mail crypto needs to become mainstream usable. E.g. even trivial contents should be encrypted by default and this should be usable by default. Currently, S/MIME does a better job than PGP.

While the CA-model seems to be broken in most X.509 use cases, like TLS/SSL, where a duplicate certifcate can be used to do a man-in-the-middle-attack, this does not really affect S/MIME, especially after both parties started a "conversion". People that need to communicate "really" secure, should therefore be able to ignore all "CA-Trust" and white-list certificates on a per user basis (e.g. like PGP).

Ordinary communication still can by default fall-back to the existing CA-model to keep it usable (but not secure).

Some steps:

1. We need more love by the MUA-vendors, who mostly support S/MIME but it's still a PITA to use. Google e.g. still does not support S/MIME on android, see https://code.google.com/p/android/issues/detail?id=34374

2. We need CAs that are usable. StartSSL is nice and free, but it's not easy to use. Lower the entry barrier for getting and renewing/recreation of certificates

3. (most important) Make it easy to manage local CA-trust. On each new system, the user should be able to select a "trust no CA/whitelist only" approach and then be responsible for trusting other parties. No vendor (Microsoft, Apple, Google, Mozilla) should silently distribute and trust new CAs without users consent.

Re: What's the matter with PGP?

#20

Post by Spooky23 » Wed, Aug 13, 2014, 7:20 PM UTC

bdamm wrote: post #5

tptacek wrote: post #3

At one point in this essay, Matt suggests that every successful end-to-end encryption scheme has employed transparent (or "translucent") key management. What he's referring to is the idea behind, say, OTR: two people can use it without the key handshake required by PGP. Matt is wrong about this. He's being victimized by a pernicious fallacy. It certainly appears that the most "successful" cryptosystems have transpare…

PGP is only trustworthy if both parties treat key management with the utmost severity, and if everyone in the conversation maintains the integrity of a given thread (in the email case). There are a precious few individuals for whom I have that level of trust in their management of their private key. I could not even trust my wife to manage a hardware key that I gave her, it would fall apart immediately; "I cannot use…

That's probably because like most people, you don't really need to have a completely secure communications channel with your wife.

All security decisions boil down to some calculus of risk, impact and cost. The most sensitive conversations that my wife and I typically have remotely aren't ones that justify the cost (both in terms of hassle and $) of carrying a secure device around.

Personally, if I were in a situation where I was remote and my physical safety or livelihood could be compromised from an email, my wife and I would probably suck it up and run around with secured netbooks or something. In my case, I don't see that risk/impact calculation adding up to requiring PGP.