Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

What's the matter with PGP?

blog.cryptographyengineering.com

Post reply on HN
Print view View original

31–40 of 166 posts

Re: What's the matter with PGP?

#31

Post by zokier »

> Adding forward secrecy to asynchronous offline email is a much bigger challenge, but fundamentally it's at least possible to some degree.

Is it really fundamentally possible? The author asserts this without really backing it with anything. I can understand how OTR-like systems can work between a static pair of clients, but it is not entirely clear if it is possible at all to extend such scheme to work in scenarios where message delivery is async and I might be using a set of clients/devices for messaging.

Re: What's the matter with PGP?

#32

Post by bdamm »

DanBC wrote: post #26
nikrdc wrote: post #9

Earlier quoted context omitted.

Can you (or anyone else) point me and others to a good text on properly handling keys? Thanks!

I would freaking love it if some good designer with technical knowledge, or help from technical colleagues, would create simple flowcharts of "How to use Encryption". Each chart would be one page. It would walk a user through one step of using a PGP / GPG. It would include links to in-depth reading. The final sheet would be walking through common mistakes that users make. This is one of the things I'd pay for if I ha…

It's not doable, because there are major unsolved problems. Protection of a private key, for example.

The only outcome of such a chart would be reams of people utterly vulnerable and thinking that they are not.

If you constrain the environment, e.g. "How to use SSL certificates in Chrome on Mac OS X Lion" then there might be a chance that could fit on one page in an easy to understand format.

Re: What's the matter with PGP?

#33

Post by matthewdgreen »

Spooky23 wrote: post #11
tptacek wrote: post #3

At one point in this essay, Matt suggests that every successful end-to-end encryption scheme has employed transparent (or "translucent") key management. What he's referring to is the idea behind, say, OTR: two people can use it without the key handshake required by PGP. Matt is wrong about this. He's being victimized by a pernicious fallacy. It certainly appears that the most "successful" cryptosystems have transpare…

You nailed it. I stopped reading and started laughing when iMessage was hailed as a successful platform addressing these issues. The only thing securing iMessage is the procedure for processing law enforcement requests. PGP is a tool that requires expertise to operate effectively. That isn't good or bad, it just is.

I think if you read it that way you probably didn't click the link to the extensive criticism I've written about iMessage's key distribution. Saying something is better than plaintext is not the same as saying it's good enough to send secret documents.

http://blog.cryptographyengineering.com/2013/06/can-apple-re...

Re: What's the matter with PGP?

#34

Post by matthewdgreen »

tptacek wrote: post #6
bdamm wrote: post #5

Earlier quoted context omitted.

PGP is only trustworthy if both parties treat key management with the utmost severity, and if everyone in the conversation maintains the integrity of a given thread (in the email case). There are a precious few individuals for whom I have that level of trust in their management of their private key. I could not even trust my wife to manage a hardware key that I gave her, it would fall apart immediately; "I cannot use…

Both of these statements can't possibly be true: * PGP is only trustworthy if both parties treat key management with the utmost severity. * Transparent key management systems that rely entirely on heuristics and click-through warnings are trustworthy.

Really they can both be true. They're just true for different constituencies. The vast majority of users are not targeted by active attacks, nor should they have reason to be. They may be hacked or subpoenaed after the fact.

Re: What's the matter with PGP?

#35

Post by mentat »

tptacek wrote: post #15
nodata wrote: post #14

Earlier quoted context omitted.

When I ask people for their e-mail address, they give it to me. When I ask them to verify their pgp key, it's less easy. How could the verification of the key be built into the address they give me? Something DNSSEC based I guess.

Yes. DNSSEC. Because what we need is a trusted arbiter, and who better to fulfill that role than the governments of the US, or whatever country happens to own the TLD I use?

Governments, always trustworthy, especially for their own citizens.

Re: What's the matter with PGP?

#36

Post by exelius »

tptacek wrote: post #10
exelius wrote: post #8

Earlier quoted context omitted.

I think the argument is that PGP is so difficult to use that by and large people just won't bother. Yes, transparent key systems would likely be less secure than PGP. If the usability were significantly better and people used them, that is better than the alternative of using nothing. For many of these solutions, there is a window of vulnerability surrounding the key exchange that closes if you aren't snooping traffi…

An irreconcilable difference between you and I on this point: you think it's a good thing if people use bad crypto instead of no crypto, and I don't. I don't think bad crypto makes the global adversary go "aw, shit, we better target someone else". I think it makes them go "excellent, something else we can get a secret appropriation to go break".

There's a difference between bad crypto and easier to use crypto. Just because it isn't 100% secure all the time doesn't mean it's not useful. If they have to go through the trouble of breaking each individual message rather than just gathering everything in a dragnet; that's good enough in my mind. You have to make mass surveillance expensive enough that it's no longer worth it.

You as an individual cannot fight a state actor. It doesn't matter how secure your crypto is; they can hold a gun to your head and force you to give up the key (or in more civilized countries, throw you in prison forever). If you become an individual target to a state actor, there is literally nothing you can do to stop them unless another state actor is willing to protect you: they have the resources of an entire economy behind them and there's no security solution you can cobble together that will be able to keep them out.

Even Snowden, who practices a paranoid level of OpSec, just assumes his electronic communications are being read. The only reason the CIA hasn't done an extrajuducial rendition on him is that he is living under the protection of another state actor (Russia).

Re: What's the matter with PGP?

#37

Post by micro-ram »

rmoriz wrote: post #19

In my opinion, mail crypto needs to become mainstream usable. E.g. even trivial contents should be encrypted by default and this should be usable by default. Currently, S/MIME does a better job than PGP. While the CA-model seems to be broken in most X.509 use cases, like TLS/SSL, where a duplicate certifcate can be used to do a man-in-the-middle-attack, this does not really affect S/MIME, especially after both partie…

We already have a start there. Make all NON-EV certs free.

Re: What's the matter with PGP?

#38

Post by click170 »

_delirium wrote: post #17
tptacek wrote: post #10

Earlier quoted context omitted.

An irreconcilable difference between you and I on this point: you think it's a good thing if people use bad crypto instead of no crypto, and I don't. I don't think bad crypto makes the global adversary go "aw, shit, we better target someone else". I think it makes them go "excellent, something else we can get a secret appropriation to go break".

My impression (I could be wrong) is that a lot of OTR users in particular are worried mainly about the local adversary: someone on the coffee-shop wifi, or the corporate IT administrator, sniffing their IM traffic. In that case you just have to have an encryption setup that's good enough to circumvent whatever analysis that class of adversary is likely to use.

This is a fair point and one I hear often, but can you be sure that for as long as you live, you will never have a reason to fear the global adversary?

I trust my government (within reason) at the moment but I'm not comfortable betting that they will never ever turn anti-gay and start coming after me.

Re: What's the matter with PGP?

#40

Post by bad_user »

_delirium wrote: post #17
tptacek wrote: post #10

Earlier quoted context omitted.

An irreconcilable difference between you and I on this point: you think it's a good thing if people use bad crypto instead of no crypto, and I don't. I don't think bad crypto makes the global adversary go "aw, shit, we better target someone else". I think it makes them go "excellent, something else we can get a secret appropriation to go break".

My impression (I could be wrong) is that a lot of OTR users in particular are worried mainly about the local adversary: someone on the coffee-shop wifi, or the corporate IT administrator, sniffing their IM traffic. In that case you just have to have an encryption setup that's good enough to circumvent whatever analysis that class of adversary is likely to use.

If a global adversary can do it, then it is only a matter of time before a local crime syndicate can do it as well, after all stealing credit cards and other sensitive info is a booming business.

And what really bothers me is that this will give people a false sense of security. At least right now I'm seeing regular folks refraining from exposing sensitive info online out of fear of evil hackers that are often the subject of news. So yes, I think unencrypted email is better than a solution that isn't secure.

Post reply on HN