Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

What's the matter with PGP?

blog.cryptographyengineering.com

Post reply on HN
Print view View original

141–150 of 166 posts

Re: What's the matter with PGP?

#141

Post by e12e »

perlgeek wrote: post #108

Can forward secrecy even work for emails, where you don't have a bidirectional communication channel? (Maybe the answer is "You have to build that bidirectional communication channel", but that means such a system can't simply use mail, it has to use mail plus X).

If we assume Alice and Bob use the keyserver network, and each have their own "master" key-pair that is mutually trusted, they can rotate public sub-keys quite frequently (you just need to search for any new keys before sending an email -- this is of course another (not smtp) channel -- but who doesn't use keyservers?).

Re: What's the matter with PGP?

#142

Post by e12e »

mdavidn wrote: post #83
alaaibrahim wrote: post #80

> Now let's ignore the fact that you've just leaked your key request to an untrusted server via HTTP. This is a public Key, so secrecy it's not needed here, also he is providing the Fingerprint on another location, so if there was a MITM attack, it should happen on both twitter (HTTPS) and pgp.mit.edu

I think Matthew Green's point was more that requesting a public key leaks your intent to communicate with someone—the metadata, if you will—to an untrusted third-party. Of course, e-mail headers, including From and To, must necessarily transit as cleartext, even when e-mail bodies are protected by PGP. The keyserver should perhaps be the least of Matthew's concern.

So... gpg + mixmaster remailers + Tor for http?

Re: What's the matter with PGP?

#143

Post by pconf »

This article fails my smell test. The adolescent vocabulary doesn't correlate with the otherwise polished writing style and the technical merits fall far short of the proposed remediations. It is therefore likely to have been funded or otherwise inspired by the NSA in an attempt to smear PGP, still the most effective cryptography available to the average person.

Re: What's the matter with PGP?

#144

Post by exelius »

derefr wrote: post #137
romaniv wrote: post #135

Earlier quoted context omitted.

This elitist attitude is why I have no faith in typical "security experts" improving the overall situation with communication security for normal people. Widely adapted open-source "bad crypto" can: - Raise user's level of awareness about security. - Create a market that can later be serviced by better crypto. - Encourage creation of infrastructure that can be later used in better crypto. - Encourage investigation of…

> Widely adapted open-source "bad crypto" can ... raise user's level of awareness about security. You know that study that showed that people wearing seatbelts drive more recklessly, effectively exactly compensating for the increase in safety provided by the seatbelts? I have a feeling people who think they're using a secure cryptosystem will speak much more freely than those who don't--meaning that the net effect of…

> You know that study that showed that people wearing seatbelts drive more recklessly, effectively exactly compensating for the increase in safety provided by the seatbelts?

Err, the first part of that statement may be true, but I don't think anyone ever put forth a claim backed up by data that they cancelled eachother out. People may drive more recklessly with seatbelts, but the law undoubtedly saved a lot of lives. You may be thinking of motorcycle helmet laws; which seems more plausible given that high-speed motorcycle accidents are much more likely to be fatal regardless.

As for the "global passive adversary", I tend to side with the term "state actor" since the only entities with the power to collect data on that scale are governments as they can legally force every telecom company in their jurisdiction to install taps while keeping their existence classified.

You're probably right about the risk compensation here; with the caveat that anyone who rises above the level of a "common criminal" would simply not trust online communication at all. Islamist terror groups use a known-courier system for all planning and communication because they just assume all electronic communications are being monitored.

Re: What's the matter with PGP?

#145

Post by erikb »

exelius wrote: post #132
erikb wrote: post #103

Earlier quoted context omitted.

You must worry by yourself if the key from the other person is trustworthy. If you let the software do it, you need to trust the software developers, the software providers (how did you install the software?), etc. Therefore taking key management out of the hands of the users might increase usability, but it automatically decreases security.

In many cases, this is an acceptable trade-off. Security is not one size fits all; your average user cannot afford to be NSA-level paranoid. Otherwise we would spend all of our time verifying keys and not actually doing anything.

True. But he will think he is NSA safe, if he uses an App on his iPhone with the word Secure in the name. And this is actually what many of the Apps out there are promising without being able to say for sure themselves.

Re: What's the matter with PGP?

#146

Post by skrowl »

Sami_Lehtinen wrote: post #138
skrowl wrote: post #131

No perfect forward secrecy. If someone gets your PGP key, they get all of your messages (past / present / future) and you might not even know your key was compromised.

Of course you can use forward secrecy (PFS) and ephemeral keys with PGP/GPG/GnuPG. I've been doing that for ages. Any public / private key system is able to do that. Simply generate new key pairs and send the new signed public key when ever that's necessary. I've blogged about that several years ago, when someone claimed that it can't be done. You can freely select if you want to rotate keys on every message, daily o…

So you're just going to keep 1000 private keys around to decrypt your old stuff?

Re: What's the matter with PGP?

#147

Post by marcosdumay »

ajb wrote: post #136

This could perhaps be made easier to use if you had a UI like this: You phone pops up a message saying: "Hey, I notice you seem to be in the same room with Bob! We can increase security of Bob's messages to you my exchanging a fingerprint. Do this now? (Yes/No/Woah, Bob isn't here!) If you click yes, you then exchange fingerprints using eg QR codes, and the authenticity of messages from Bob are retrospecively checked…

> Problem is, it's not obvious this can be done without compromising privacy of location.

That's a problem for Free Software running on local machines!

Re: What's the matter with PGP?

#149

Post by beagle3 »

rakoo wrote: post #128
beagle3 wrote: post #126

Earlier quoted context omitted.

Well, if this is properly supported by software using namecoin for DNS resolution, then - yes, this may work. The proof of the pudding, however, will arrive once it's eaten. I am not familiar with namecoin to point where the potential problems are, but do note that the failure of CAs is not in the cryptography but rather in the trust model. In modern cryptography, the problems are almost always with the practice, not…

> software using namecoin for DNS resolution Actually, it should be the other way around: dnschain [0] bridges DNS resolution and namecoin, so there's no need to modify existing software. [0] https://github.com/okTurtles/dnschain

Cool! wasn't aware of it.

Re: What's the matter with PGP?

#150

Post by zimbatm »

croikle wrote: post #88
zimbatm wrote: post #67

> Except maybe not: if you happen to do this with GnuPG 2.0.18 -- one version off from the very latest GnuPG -- the client won't actually bother to check the fingerprint of the received key. Even in it's long form, it's relatively easy to generate different keys that have the same fingerprint.

I'm aware of simple brute-force attacks on short key IDs [0], which are just the last 32 bits of the fingerprint (e.g. 438CF0E2). With significant effort, one might be able to extend that to 64 bits. I'd be much more surprised by a full fingerprint match. Wouldn't that imply a SHA-1 collision? [0] http://www.asheesh.org/note/debian/short-key-ids-are-bad-new...

Yes I was referring to the 64bit long key ID. The full fingerprint is a SHA-1 and not vulnerable.

See https://www.debian-administration.org/users/dkg/weblog/105

Post reply on HN