Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Cryptography Dispatches: Hello World, and OpenPGP Is Broken

buttondown.email

Post reply on HN
Print view View original

31–40 of 72 posts

Re: Cryptography Dispatches: Hello World, and OpenPGP Is Broken

#31

Post by bigiain »

tptacek wrote: post #16
mikekchar wrote: post #14

Earlier quoted context omitted.

I think we need to rely on this at some point, though. If my friend Alice introduces her friend Bob to me, that's my only way of determining that when Alice is talking about Bob, it's this Bob and not a different Bob. I actually don't think there is a problem with the concept of a web of trust per se. It's a fact of life. I think that the software doesn't help you use it appropriately. Even if Alice says that a perso…

The kernel of the conceptual problem with this web-of-trust feature is in another Filippo post[1]: when I sign someone's else's key, it is difficult (in practice: impossible) to really know the provenance of that key. The signer could have gotten the key from a keyserver (in which case you now transitively trust the keyserver). Or they could have gotten it from a random email saying "this is my new key". You don't kn…

I still think this is a problem of public key servers being a broken idea, rather than PGP itself.

It's 20 years since I've been to a key signing party, but there are still several small circles of trusts where I have very good ideas about the trustworthiness of each member and of the overall circle.

I still trust the crypto that PGP (and OpenPGP) uses. (With the caveat of no forward secrecy unless you try to handle that yourself).

I'm not entirely sure I've _ever_ trusted a key server provided public key, beyond the use case of trying it to open a conversation in which I can verify (to whatever level is needed) whether the person on the other end is the person I am trying to communicate with.e

Re: Cryptography Dispatches: Hello World, and OpenPGP Is Broken

#32

Post by fiter »

mikekchar wrote: post #21
tptacek wrote: post #16

Earlier quoted context omitted.

The kernel of the conceptual problem with this web-of-trust feature is in another Filippo post[1]: when I sign someone's else's key, it is difficult (in practice: impossible) to really know the provenance of that key. The signer could have gotten the key from a keyserver (in which case you now transitively trust the keyserver). Or they could have gotten it from a random email saying "this is my new key". You don't kn…

I'm definitely not arguing against that. I think keyservers are one of the worst things to ever happen. PGP's implementation of the web of trust is hugely flawed. I'm saying the concept is still incredibly useful. I get frustrated when I see suggestions that we should abandon the notion signing other people's keys because users can't be trusted to do it properly. I think the author of the article you link to is mostl…

This is a very useful way to think about a/the web of trust. Thank you; I am sure I will use it later.

Re: Cryptography Dispatches: Hello World, and OpenPGP Is Broken

#33

Post by bigiain »

inflatableDodo wrote: post #27
tptacek wrote: post #6

To be clear: this is a subhed from Filippo's email newsletter (which you should subscribe to), relating a news item about the ridiculous SKS/GnuPG-key-handling fiasco from last week; it is not a comprehensive summary of all the ways in which OpenPGP is broken, despite the title.

>it is not a comprehensive summary of all the ways in which OpenPGP is broken Is there a comprehensive summary anywhere?

Or at least a list of topics/keywords to search for to start learning some of the other ways?

Re: Cryptography Dispatches: Hello World, and OpenPGP Is Broken

#34

Post by mbrumlow »

tptacek wrote: post #30
mbrumlow wrote: post #26

Earlier quoted context omitted.

And yet all of those bypass the hard part of validating the sender. These again trust the service. PGP is more than simply encryption. It provides a means of trusted identity. End to End encryption is pointless if you have no way to validate that a message came sender. Relying on automated systems for key exchange will always suffer from this problem.

That "means of trusted identity" doesn't work, to a first approximation nobody even attempts to use it, of those that do, a vanishing fraction "succeed", and their reward for doing so is the adoption of rickety 1990s encryption. Among practicing cryptography engineers, "web of trust" is a punch line, not a goal. The lucky PGP users stick to the command line, which is so clunky that they'll use it rarely. The less for…

I am not trying to win a popularity contest. If you care about secure messaging, and want to be sure you about who you are talking to -- then you have to use something like pgp.

I don't think the number of people using something invalidates a technology's technical merits. All we now have is a bunch of people thinking they are secure to one day have a very rude awakening not if, but when their communications are compromised at for the sake of popularity and ease of use.

Most of the arguments against PGP are about clunky clients, and such, this again is not a argument refuting the technology. Meanwhile the new systems solve the ui problems by dropping the most important part of encryption -- the ability to validate.

So for me, I will stick with gpgp and the like.

Re: Cryptography Dispatches: Hello World, and OpenPGP Is Broken

#35

Post by tptacek »

mbrumlow wrote: post #34
tptacek wrote: post #30

Earlier quoted context omitted.

That "means of trusted identity" doesn't work, to a first approximation nobody even attempts to use it, of those that do, a vanishing fraction "succeed", and their reward for doing so is the adoption of rickety 1990s encryption. Among practicing cryptography engineers, "web of trust" is a punch line, not a goal. The lucky PGP users stick to the command line, which is so clunky that they'll use it rarely. The less for…

I am not trying to win a popularity contest. If you care about secure messaging, and want to be sure you about who you are talking to -- then you have to use something like pgp. I don't think the number of people using something invalidates a technology's technical merits. All we now have is a bunch of people thinking they are secure to one day have a very rude awakening not if, but when their communications are comp…

The only people who agree with you about the need for PGP in serious secure messaging are members of the PGP cheering section. They're an old and venerable social organization dating back to the pre-HMAC CFB-mode cryptography in PGP itself. I have nothing bad to say about their justified and ancient society other than that they are wrong about everything involving cryptography and that they recommend tools that get people hurt.

People who care very deeply about these problems and who have studied them more carefully than almost any message board commenter have evaluated PGP and Signal. Among secure messaging and cryptography engineers, PGP is alternately either amusing or an unfunny hindrance to progress. Signal, on the other hand, won the Levchin Prize at Real World Crypto.

Don't use PGP.

Re: Cryptography Dispatches: Hello World, and OpenPGP Is Broken

#37

Post by blattimwind »

mikeash wrote: post #18
xucheng wrote: post #11

> At least at some points we need proper transactional behaviour and Sqlite implements that by talking a temporary copy of the database - not an option for large keyrings. I don’t understand how GPG maintainers think they can implement something better (function and performance-wise) than a proper database engine. Also I don’t think GPG will ever need to handle keyring lager than 140TB [1]. [1]: https://www.sqlite.or…

I’m pretty sure SQLite doesn’t implement transactions that way anyway. That’s a pretty bad misunderstanding of how it works. I suppose it’s easy to think you can do better than SQLite if you think SQLite is really bad.

SQLite never implemented transactions that way, neither in undo nor WAL mode.

Someone might have misunderstood how undo logging / rollback journals work. Only pages to be changed are recorded in the rollback journal, not the entire database.

Re: Cryptography Dispatches: Hello World, and OpenPGP Is Broken

#38

Post by Perceptes »

inflatableDodo wrote: post #27
tptacek wrote: post #6

To be clear: this is a subhed from Filippo's email newsletter (which you should subscribe to), relating a news item about the ridiculous SKS/GnuPG-key-handling fiasco from last week; it is not a comprehensive summary of all the ways in which OpenPGP is broken, despite the title.

>it is not a comprehensive summary of all the ways in which OpenPGP is broken Is there a comprehensive summary anywhere?

This article by the same author is perhaps not comprehensive, but a good place to start: https://blog.filippo.io/giving-up-on-long-term-pgp/

Re: Cryptography Dispatches: Hello World, and OpenPGP Is Broken

#39

Post by mbrumlow »

tptacek wrote: post #35
mbrumlow wrote: post #34

Earlier quoted context omitted.

I am not trying to win a popularity contest. If you care about secure messaging, and want to be sure you about who you are talking to -- then you have to use something like pgp. I don't think the number of people using something invalidates a technology's technical merits. All we now have is a bunch of people thinking they are secure to one day have a very rude awakening not if, but when their communications are comp…

The only people who agree with you about the need for PGP in serious secure messaging are members of the PGP cheering section. They're an old and venerable social organization dating back to the pre-HMAC CFB-mode cryptography in PGP itself. I have nothing bad to say about their justified and ancient society other than that they are wrong about everything involving cryptography and that they recommend tools that get p…

PGP is a protocol, there is nothing wrong with it. If you want to complain about good PGP based apps that is a entirely different argument (and it think that is what you are arguing).

Signal is not a protocol, it is a application. It uses open whisper (or some mutation of it) as its underlying protocol. That being said, you are still relying on trust provided by the signal servers that they properly authenticated your phone number. A phone number is a super weak way to verify identity. Lucky signal does provide a way to verify you are actually talking to who you are via the safety code process (in person or out of band). So the end result is Trust us first, then verify later. While most PGP applications require zero trust until verification by means of key exchange.

After all that there is nothing stopping anybody from making a application that works just as signal does but based of PGP, and being just as secure as Signal using PGP. The problem is people who understand this know that using PGP chained with a week service phone number base validation invalidates using the entire point -- so they don't. I personally think that is a mistake. As PGP is way better in the long run because it can be used for more than text chats, and video calls.

> tools that get people hurt.

People hurt them selves using tools improperly.

Post reply on HN