Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Facebook Is Ending Support for PGP Encrypted Emails

joltmailer.com

Post reply on HN
Print view View original

41–50 of 69 posts

Re: Facebook Is Ending Support for PGP Encrypted Emails

#41

Post by anon-sre-srm »

dale_glass wrote: post #39
anon-sre-srm wrote: post #33

Earlier quoted context omitted.

The technology of gpg isn't the problem, it's the CLI and non-CLI UX that's the problem. Mailvelope makes it sort-of easier, but it also fails at UX because it doesn't support clear signatures. Gmail and such should address this. Proton is an improvement but it doesn't allow using an external GPG key. keybase sort-of solved the scalability of effort problem / barrier that is web of trust, countersigning keys, and the…

Everything about GPG is a problem. The tech is old and out of sync with modern cryptographic principles. It supports a bunch of obsolete algorithms for backwards compatibility, some of which are badly broken. It has a complicated packet format that's hard to parse and itself has security issues. It encourages bad practices like keeping ancient keys around because they have signatures on them. It's also highly hostile…

You're being dramatic and uncharitable.

GPG works.

If you don't like it, invent something better.

Re: Facebook Is Ending Support for PGP Encrypted Emails

#42

Post by ploum »

twiss wrote: post #31

It's possible to solve both the friction to start and stop using PGP by looking up keys automatically on the target domain, for example using WKD [1]. We (Proton) host a key for every user, which can be used to automatically end-to-end encrypt emails to all Proton Mail users, without any setup needed, nor risk of DoS (since the user can always remove their key from WKD). Various other providers also offer this [2]. […

Proton user here: I’ve an anecdote because it happened this week and support was unable to help me.

I’ve received a PGP encrypted email by a non-proton user. It worked fine. But I was unable to encrypt my reply to him.

Proton support told me that he needs to attach his public key to his message so I can use it.

It seems that the Proton interface doesn’t offer any way to automatically try to find the public key of an user (from which you have an email address and probably a signature).

Re: Facebook Is Ending Support for PGP Encrypted Emails

#43

Post by Kwpolska »

crtasm wrote: post #36
sebstefan wrote: post #18

Earlier quoted context omitted.

Github asks you to log in again to add SSH keys in, this could've been similar They're just looking for excuses

A lot of account compromise is due to reused passwords so I'm not sure that's a complete solution.

Sending a PGP-encrypted email with a verification link to activate the feature should solve that.

Re: Facebook Is Ending Support for PGP Encrypted Emails

#45

Post by kylebenzle »

twiss wrote: post #31

It's possible to solve both the friction to start and stop using PGP by looking up keys automatically on the target domain, for example using WKD [1]. We (Proton) host a key for every user, which can be used to automatically end-to-end encrypt emails to all Proton Mail users, without any setup needed, nor risk of DoS (since the user can always remove their key from WKD). Various other providers also offer this [2]. […

Interesting!

Can you give a quick explanation for someone too dumb to understand your first citation?

I use pgp for years but struggle to understand how proton can say email is encrypted when I never have to decrypt it myself.

If proton has the key how is that different from Google just encrypting everything until right before it displays?

I used proton for a couple years but moved back to Gmail cause I figured all the encryption talk was just promotional and using pgp your self is the only way.

Re: Facebook Is Ending Support for PGP Encrypted Emails

#46

Post by dale_glass »

anon-sre-srm wrote: post #41
dale_glass wrote: post #39

Earlier quoted context omitted.

Everything about GPG is a problem. The tech is old and out of sync with modern cryptographic principles. It supports a bunch of obsolete algorithms for backwards compatibility, some of which are badly broken. It has a complicated packet format that's hard to parse and itself has security issues. It encourages bad practices like keeping ancient keys around because they have signatures on them. It's also highly hostile…

You're being dramatic and uncharitable. GPG works. If you don't like it, invent something better.

> You're being dramatic and uncharitable.

Being uncharitable with security critical software is the right attitude to have.

> GPG works.

Yeah, not quite. I've used it extensively. I've got an excellently well connected key. I've tried writing software that uses gpg. I've reached the conclusion that it's a lost cause.

> If you don't like it, invent something better.

People have. Things like the Signal protocol for instance.

Re: Facebook Is Ending Support for PGP Encrypted Emails

#47

Post by brabel »

> Some Facebook users have also reported instances of hackers taking advantage of the PGP encryption feature to compromise accounts. Once a hacker gains access to a Facebook account, they can proceed to activate email encryption.

It's quite disingenuous to make it sound like PGP was the problem here.

Read that sentence again: "Once a hacker gains access to a Facebook account" regardless of PGP or not... then, of course, they own the account and can do what they want!! But that's the problem, not that they can enable PGP encryption. If you had PGP encryption to start with, ironically you wouldn't be "susceptible" at all as it's the hacker who wouldn't be able to read your emails even after compromising your account (though they may do worse thing at that point).

Re: Facebook Is Ending Support for PGP Encrypted Emails

#48

Post by brabel »

twiss wrote: post #31

It's possible to solve both the friction to start and stop using PGP by looking up keys automatically on the target domain, for example using WKD [1]. We (Proton) host a key for every user, which can be used to automatically end-to-end encrypt emails to all Proton Mail users, without any setup needed, nor risk of DoS (since the user can always remove their key from WKD). Various other providers also offer this [2]. […

This would be so useful to verify Maven PGP keys. Is there any sort of integration with that? If not, I am thinking of writing that.

Re: Facebook Is Ending Support for PGP Encrypted Emails

#49

Post by kylebenzle »

dale_glass wrote: post #24
liopleurodon wrote: post #16

I doubt that this was widely adopted Hell, even amongst my peers, I'm continually shocked at how many people have never used gpg, ever. And, anecdotally, the number gets lower as age gets lower. Young people aren't using it. It's dying.

GPG sadly never grew up. It's a program firmly stuck in the 90s. The original PGP manual talked about secretly communicating with your lover. That was the usage model, transmitting secret messages to people you could sometimes meet in person, and where the model was you talking to people you directly know. Try to verify the GPG signature on say, the Tor Browser. It's signed by "Tor Browser Developers (signing key)".…

Pgp is alive and well on the dark web and the kids with a brain are going to be just fine. You are right though, for the idiot masses "the powers that be" were successful in killing it off.

They HATE encryption, it's why control of the Bitcoin GitHub repo is so critical, an encrypted peer to peer payment option is even more dangerous than encrypted peer to peer communication.

Re: Facebook Is Ending Support for PGP Encrypted Emails

#50

Post by twiss »

kylebenzle wrote: post #45
twiss wrote: post #31

It's possible to solve both the friction to start and stop using PGP by looking up keys automatically on the target domain, for example using WKD [1]. We (Proton) host a key for every user, which can be used to automatically end-to-end encrypt emails to all Proton Mail users, without any setup needed, nor risk of DoS (since the user can always remove their key from WKD). Various other providers also offer this [2]. […

Interesting! Can you give a quick explanation for someone too dumb to understand your first citation? I use pgp for years but struggle to understand how proton can say email is encrypted when I never have to decrypt it myself. If proton has the key how is that different from Google just encrypting everything until right before it displays? I used proton for a couple years but moved back to Gmail cause I figured all t…

Proton does not have the private key material. When you sign up to Proton Mail, the client generates a key pair for you, encrypts the private key with your password, and sends it to the server, along with the public key (which we publish).

Then, when you log in, the client fetches the encrypted private key, decrypts it with your password, and decrypts your emails with the private key. All of this is done automatically but it's still end-to-end encrypted.

The first citation (WKD draft specification) simply describes how to publish (and look up) public keys for a given email address on its domain. So for twiss@proton.me (hypothetical example), the key is published at https://openpgpkey.proton.me/.well-known/openpgpkey/proton.m....

Post reply on HN