Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Facebook Is Ending Support for PGP Encrypted Emails

joltmailer.com

Post reply on HN
Print view View original

31–40 of 69 posts

Re: Facebook Is Ending Support for PGP Encrypted Emails

#31

Post by twiss »

It's possible to solve both the friction to start and stop using PGP by looking up keys automatically on the target domain, for example using WKD [1]. We (Proton) host a key for every user, which can be used to automatically end-to-end encrypt emails to all Proton Mail users, without any setup needed, nor risk of DoS (since the user can always remove their key from WKD). Various other providers also offer this [2].

[1]: https://datatracker.ietf.org/doc/html/draft-koch-openpgp-web...

[2]: https://wiki.gnupg.org/WKD#Mail_Service_Providers_offering_W...

Re: Facebook Is Ending Support for PGP Encrypted Emails

#32

Post by rany_ »

dale_glass wrote: post #24
liopleurodon wrote: post #16

I doubt that this was widely adopted Hell, even amongst my peers, I'm continually shocked at how many people have never used gpg, ever. And, anecdotally, the number gets lower as age gets lower. Young people aren't using it. It's dying.

GPG sadly never grew up. It's a program firmly stuck in the 90s. The original PGP manual talked about secretly communicating with your lover. That was the usage model, transmitting secret messages to people you could sometimes meet in person, and where the model was you talking to people you directly know. Try to verify the GPG signature on say, the Tor Browser. It's signed by "Tor Browser Developers (signing key)".…

> and we developed plenty new needs like verifying software signed by random people on the other side of the globe, while GPG did nothing to accommodate that use

That's actually a really common use-case for GPG. I've seen it used for this more than for email...

Re: Facebook Is Ending Support for PGP Encrypted Emails

#33

Post by anon-sre-srm »

dale_glass wrote: post #24
liopleurodon wrote: post #16

I doubt that this was widely adopted Hell, even amongst my peers, I'm continually shocked at how many people have never used gpg, ever. And, anecdotally, the number gets lower as age gets lower. Young people aren't using it. It's dying.

GPG sadly never grew up. It's a program firmly stuck in the 90s. The original PGP manual talked about secretly communicating with your lover. That was the usage model, transmitting secret messages to people you could sometimes meet in person, and where the model was you talking to people you directly know. Try to verify the GPG signature on say, the Tor Browser. It's signed by "Tor Browser Developers (signing key)".…

The technology of gpg isn't the problem, it's the CLI and non-CLI UX that's the problem.

Mailvelope makes it sort-of easier, but it also fails at UX because it doesn't support clear signatures. Gmail and such should address this. Proton is an improvement but it doesn't allow using an external GPG key. keybase sort-of solved the scalability of effort problem / barrier that is web of trust, countersigning keys, and the bad UX of keyservers.

There is no readily suitable admixture of keybase, Mailvelope, and Proton that doesn't suck while supporting maximum flexibility.

Re: Facebook Is Ending Support for PGP Encrypted Emails

#34

Post by dale_glass »

rany_ wrote: post #32
dale_glass wrote: post #24

Earlier quoted context omitted.

GPG sadly never grew up. It's a program firmly stuck in the 90s. The original PGP manual talked about secretly communicating with your lover. That was the usage model, transmitting secret messages to people you could sometimes meet in person, and where the model was you talking to people you directly know. Try to verify the GPG signature on say, the Tor Browser. It's signed by "Tor Browser Developers (signing key)".…

> and we developed plenty new needs like verifying software signed by random people on the other side of the globe, while GPG did nothing to accommodate that use That's actually a really common use-case for GPG. I've seen it used for this more than for email...

I mean sure, there's a bunch of developers out there signing their code with GPG. But have you actually tried verifying it properly?

To verify the tor browser correctly, you need a trust path.

Option A: You've met at least one of them directly, and for some reason decided to sign a key with the label "Tor Browser Developers" on it. How did that person prove to you that they're a legitimate Tor developer? That's a pretty tricky thing to demonstrate.

Option B: You've signed the key of somebody who did the above. Same problem, but even more dubious.

Technically, GPG allows longer trust paths, you can do Alice -> Bob -> Carol -> Tor, or I think even Alice -> Bob -> Carol -> Dave -> Tor. But the software won't help you with this.

To do the first, you download the Tor key, look at who signed it, download all those keys, and hope that one of those might have a signature by somebody you know on it.

To do the second... you're on your own. You can do a brute force key download, where you download thousands of keys in the hopes of some connection being found, and blowing up the size of your keyring. This will add lots of random people into whatever UI you use and slow down every GPG invocation. And you'll need to write some sort of shell script for that, it's a pain.

Re: Facebook Is Ending Support for PGP Encrypted Emails

#35

Post by prmoustache »

repelsteeltje wrote: post #5
b112 wrote: post #4

After persons destroyed the usefulness and value of all the keyservers a few years back, via flooding and other actions, this is no shock. I suspect this was a state actor funded operation, for this has effectively, and significantly reduced the usefulness of PGP/GNUPG. Many people I know were starting to use it, now they do not. It doesn't matter that security should overcome conveniences, conveniences often win. An…

It's that, and the fact that a hacker would enable the feature after compromising the account (some other way, unrelated to PGP) to prevent the legit user from using the account recovery email. So feature was basically there only to shoot oneself in the foot.

For that to work, your email has to be compromised in the first place.

And if your email is compromised, well, it is game over already, for every single thing you have access to.

So it is just a poor excuse. I guess the main reason is that virtually nobody knew this feature existed and the intersection between the population privacy savy enough to use PGP and using Facebook is ridiculously small.

Re: Facebook Is Ending Support for PGP Encrypted Emails

#36

Post by crtasm »

sebstefan wrote: post #18
repelsteeltje wrote: post #3

> Once a hacker gains access to a Facebook account, they can proceed to activate email encryption. > This renders recovery emails sent to the user’s email address unreadable, as only the hacker has the encryption keys. So: PGP encrypted emails were rarely used, except to lock out the legit user after account was compromised.

Github asks you to log in again to add SSH keys in, this could've been similar They're just looking for excuses

A lot of account compromise is due to reused passwords so I'm not sure that's a complete solution.

Re: Facebook Is Ending Support for PGP Encrypted Emails

#37

Post by anon-sre-srm »

b112 wrote: post #4

After persons destroyed the usefulness and value of all the keyservers a few years back, via flooding and other actions, this is no shock. I suspect this was a state actor funded operation, for this has effectively, and significantly reduced the usefulness of PGP/GNUPG. Many people I know were starting to use it, now they do not. It doesn't matter that security should overcome conveniences, conveniences often win. An…

?

There are plenty of keyservers that are usable. There is a visualization diagram of the forest of replication partners.

https://www.rediris.es/keyserver/graph.html

https://spider.pgpkeys.eu/graphs/

Re: Facebook Is Ending Support for PGP Encrypted Emails

#38

Post by redleader55 »

ZiiS wrote: post #2

Presumably the is no overlap in the Venn diagram of people who want PGP encrypted emails and people who use Facebook,

Employees of Facebook are geeky enough to use GPG. I suspect it was a feature built for internal users, but problematic now as most people don't understand it or are able to use it.

Re: Facebook Is Ending Support for PGP Encrypted Emails

#39

Post by dale_glass »

anon-sre-srm wrote: post #33
dale_glass wrote: post #24

Earlier quoted context omitted.

GPG sadly never grew up. It's a program firmly stuck in the 90s. The original PGP manual talked about secretly communicating with your lover. That was the usage model, transmitting secret messages to people you could sometimes meet in person, and where the model was you talking to people you directly know. Try to verify the GPG signature on say, the Tor Browser. It's signed by "Tor Browser Developers (signing key)".…

The technology of gpg isn't the problem, it's the CLI and non-CLI UX that's the problem. Mailvelope makes it sort-of easier, but it also fails at UX because it doesn't support clear signatures. Gmail and such should address this. Proton is an improvement but it doesn't allow using an external GPG key. keybase sort-of solved the scalability of effort problem / barrier that is web of trust, countersigning keys, and the…

Everything about GPG is a problem.

The tech is old and out of sync with modern cryptographic principles. It supports a bunch of obsolete algorithms for backwards compatibility, some of which are badly broken. It has a complicated packet format that's hard to parse and itself has security issues. It encourages bad practices like keeping ancient keys around because they have signatures on them.

It's also highly hostile to using it in any way but how it was designed. For ages, there was no library to parse OpenPGP packets. You had to run gpg itself, maybe give it a fake home directory, feed it whatever you need, parse the output... it's an enormous amount of pain even for simple things, and it's all terribly slow.

And it badly damaged the ecosystem, because either you spend lots and lots of time on reimplementing lots of crypto (which tends to be a bad idea), or you try to trick GPG into doing what you need and end up with a system that's dreadfully slow and painful to use.

The problems you speak of are probably due to this. There wasn't an usable base to build services on until very recently, when GPG was already effectively dead.

Re: Facebook Is Ending Support for PGP Encrypted Emails

#40

Post by zikduruqe »

liopleurodon wrote: post #16

I doubt that this was widely adopted Hell, even amongst my peers, I'm continually shocked at how many people have never used gpg, ever. And, anecdotally, the number gets lower as age gets lower. Young people aren't using it. It's dying.

The "security officer" at one of my past roles, had never used PGP/GPG ever. But then again he would send credentials and SSL certs/keys (without passwords), in plain text over emails by replying to all, even when including third parties.

People just have too much trust, are too lazy, or were just giving a job for whatever reason.

Post reply on HN