No perfect forward secrecy. If someone gets your PGP key, they get all of your messages (past / present / future) and you might not even know your key was compromised.
What's the matter with PGP?
131–140 of 166 posts
Re: What's the matter with PGP?
#132Earlier quoted context omitted.
Hi Thomas. I used to think this way too. I think this is certainly a fine way to think about things if your goal is to keep encrypted email deployment limited to the 3-4% of email users who are either technical experts with nothing to say and/or people who are sending obviously sensitive documents. It doesn't scale much beyond that. Moreover, I would argue that a 'translucent' key management infrastructure /can/ be b…
You must worry by yourself if the key from the other person is trustworthy. If you let the software do it, you need to trust the software developers, the software providers (how did you install the software?), etc. Therefore taking key management out of the hands of the users might increase usability, but it automatically decreases security.
In many cases, this is an acceptable trade-off. Security is not one size fits all; your average user cannot afford to be NSA-level paranoid. Otherwise we would spend all of our time verifying keys and not actually doing anything.
Re: What's the matter with PGP?
#133At one point in this essay, Matt suggests that every successful end-to-end encryption scheme has employed transparent (or "translucent") key management. What he's referring to is the idea behind, say, OTR: two people can use it without the key handshake required by PGP. Matt is wrong about this. He's being victimized by a pernicious fallacy. It certainly appears that the most "successful" cryptosystems have transpare…
I gotta back Matt here. While none of the three of us would endorse the iMessage key exchange model, the truth is that the team that implemented iMessage crypto have kept more communications safe from dragnet surveillance than everybody commenting on this HN article combined.
I personally think there is a good middle ground where identity management is invisible to most users and customizable by users with more challenging threat models. That is what we are aiming for.
Re: What's the matter with PGP?
#134At one point in this essay, Matt suggests that every successful end-to-end encryption scheme has employed transparent (or "translucent") key management. What he's referring to is the idea behind, say, OTR: two people can use it without the key handshake required by PGP. Matt is wrong about this. He's being victimized by a pernicious fallacy. It certainly appears that the most "successful" cryptosystems have transpare…
I gotta back Matt here. While none of the three of us would endorse the iMessage key exchange model, the truth is that the team that implemented iMessage crypto have kept more communications safe from dragnet surveillance than everybody commenting on this HN article combined. I personally think there is a good middle ground where identity management is invisible to most users and customizable by users with more chall…
Hold on. The iMessage key exchange model works in part because it has trust anchors; it's not a pure peer-peer system. You can see the tradeoff it makes by looking at any discussion of iMessage ever and noting how people discount its security because of those trust anchors.
Re: What's the matter with PGP?
#135Earlier quoted context omitted.
I think the argument is that PGP is so difficult to use that by and large people just won't bother. Yes, transparent key systems would likely be less secure than PGP. If the usability were significantly better and people used them, that is better than the alternative of using nothing. For many of these solutions, there is a window of vulnerability surrounding the key exchange that closes if you aren't snooping traffi…
An irreconcilable difference between you and I on this point: you think it's a good thing if people use bad crypto instead of no crypto, and I don't. I don't think bad crypto makes the global adversary go "aw, shit, we better target someone else". I think it makes them go "excellent, something else we can get a secret appropriation to go break".
This elitist attitude is why I have no faith in typical "security experts" improving the overall situation with communication security for normal people.
Widely adapted open-source "bad crypto" can: - Raise user's level of awareness about security. - Create a market that can later be serviced by better crypto. - Encourage creation of infrastructure that can be later used in better crypto. - Encourage investigation of better UI.
Also, other poster are right about increasing the difficulty of executing an attack.
Re: What's the matter with PGP?
#136This could perhaps be made easier to use if you had a UI like this:
You phone pops up a message saying: "Hey, I notice you seem to be in the same room with Bob! We can increase security of Bob's messages to you my exchanging a fingerprint. Do this now? (Yes/No/Woah, Bob isn't here!)
If you click yes, you then exchange fingerprints using eg QR codes, and the authenticity of messages from Bob are retrospecively checked
Problem is, it's not obvious this can be done without compromising privacy of location.
Re: What's the matter with PGP?
#137Earlier quoted context omitted.
An irreconcilable difference between you and I on this point: you think it's a good thing if people use bad crypto instead of no crypto, and I don't. I don't think bad crypto makes the global adversary go "aw, shit, we better target someone else". I think it makes them go "excellent, something else we can get a secret appropriation to go break".
This elitist attitude is why I have no faith in typical "security experts" improving the overall situation with communication security for normal people. Widely adapted open-source "bad crypto" can: - Raise user's level of awareness about security. - Create a market that can later be serviced by better crypto. - Encourage creation of infrastructure that can be later used in better crypto. - Encourage investigation of…
> Widely adapted open-source "bad crypto" can ... raise user's level of awareness about security.
You know that study that showed that people wearing seatbelts drive more recklessly, effectively exactly compensating for the increase in safety provided by the seatbelts?
I have a feeling people who think they're using a secure cryptosystem will speak much more freely than those who don't--meaning that the net effect of convincing users to use "bad crypto" is giving the global passive adversary† more interesting morning reading.
† Do we have a name for this guy in cryptography placeholder terms yet? Nathan (the NSA agent), maybe?
Re: What's the matter with PGP?
#138No perfect forward secrecy. If someone gets your PGP key, they get all of your messages (past / present / future) and you might not even know your key was compromised.
Of course you can use forward secrecy (PFS) and ephemeral keys with PGP/GPG/GnuPG. I've been doing that for ages. Any public / private key system is able to do that. Simply generate new key pairs and send the new signed public key when ever that's necessary. I've blogged about that several years ago, when someone claimed that it can't be done. You can freely select if you want to rotate keys on every message, daily or so.
Re: What's the matter with PGP?
#139Earlier quoted context omitted.
PGP is only trustworthy if both parties treat key management with the utmost severity, and if everyone in the conversation maintains the integrity of a given thread (in the email case). There are a precious few individuals for whom I have that level of trust in their management of their private key. I could not even trust my wife to manage a hardware key that I gave her, it would fall apart immediately; "I cannot use…
That's probably because like most people, you don't really need to have a completely secure communications channel with your wife. All security decisions boil down to some calculus of risk, impact and cost. The most sensitive conversations that my wife and I typically have remotely aren't ones that justify the cost (both in terms of hassle and $) of carrying a secure device around. Personally, if I were in a situatio…
Someone else might need to have a secure communication channel with his wife. I never read the comment as "I can't communicate securely with my wife", more "My wife is not in the set of people with which anyone can communicate securely" (because secure key management is hard).
Re: What's the matter with PGP?
#140Why isn't RFC 1751 http://www.ietf.org/rfc/rfc1751.txt used to provide the fingerprints that are readable? Verifying would be much more convenient than now. "For example, the 128-bit key of: CCAC 2AED 5910 56BE 4F90 FD44 1C53 4766 would become RASH BUSH MILK LOOK BAD BRIM AVID GAFF BAIT ROT POD LOVE Likewise, a user should be able to type in TROD MUTE TAIL WARM CHAR KONG HAAG CITY BORE O TEAL AWL as a key, and the ma…
I haven't used the "original" PGP program for a very long time, but IIRC it had the option to use RFC 1751 or a similar scheme. A quick web search finds to options to use this scheme in GnuPG. Strange!
You're probably thinking of: https://en.wikipedia.org/wiki/PGP_word_list
[edit: See also this thread: http://lists.gnupg.org/pipermail/gnupg-devel/2001-March/0170...
I think they're missing (what I think was) the point of the list -- I seem to recall this was meant for use over the phone, and the words were selected by machine learning to all sound different. I've always thought this was a massive case of over-engineering -- and also somewhat narrow-sighted. I mean the list starts out with "Aardvark" of all things! ]