Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Opmsg – A GPG Alternative

github.com

Post reply on HN
Print view View original

51–60 of 100 posts

Re: Opmsg – A GPG Alternative

#51

Post by tptacek »

DarkWiiPlayer wrote: post #4
masklinn wrote: post #3

Earlier quoted context omitted.

Indeed, from Latacora's recent "The PGP Problem": > Encrypting Email > Don’t. > Email is insecure. Even with PGP, it’s default-plaintext, which means that even if you do everything right, some totally reasonable person you mail, doing totally reasonable things, will invariably CC the quoted plaintext of your encrypted message to someone else (we don’t know a PGP email user who hasn’t seen this happen). PGP email is f…

If you know what you're doing, PGP can improve security. The real problem is that, the moment you're sending information to someone, you're giving that information away, out of your control. If I understand it correctly, all the above points seem to address mostly the technical aspect, that someone who means well may too easily leak previously encrypted information out of ignorance. A possible counter argument could…

No. Secure Messengers are designed to be hard to use unsafely. Nobody accidentally sends plaintext to a counterpart with Signal, because there's no feature in Signal that does that.

Re: Opmsg – A GPG Alternative

#52

Post by tptacek »

phicoh wrote: post #35
burgerdev wrote: post #32

Earlier quoted context omitted.

Which aspect of elliptic curves would you like to understand better? The original paper for Curve25519 contains a dedicated subsection for attack models, for example, and leaves only marginal room for hidden backdoors with its detailed reasoning about curve parameter choice. The implementation of EdDH or EdDSA is specified in RFCs that are explicitly written to be "fool-proof", as others already commented.

Compare the NIST curves to RSA. For RSA we know there cannot be any backdoors. If you generate good quality primes you are in business (assuming you don't make mistakes elsewhere). For NIST we cannot say anything about backdoors. We don't use those curves because we don't trust NIST. Not because we have any prove they are bad. So to avoid that, there is a parameter selection process that supposedly leaves no room for…

Even Bernstein doesn't really believe the NIST p-curves are backdoored, and the Koblitz/Menezes paper makes a pretty decent case that they couldn't be, but if you want to tinfoil hat it, just do what every modern system does and use Curve25519.

If any of this is new to you, though, you shouldn't be designing cryptosystems. Most people shouldn't! I sure shouldn't! It's an extremely specialized skill, and the world doesn't need that many new ones. Just use Nacl.

Re: Opmsg – A GPG Alternative

#53

Post by tptacek »

lifeisstillgood wrote: post #9
mikorym wrote: post #6

I think a perhaps unclear part of the recent post "The PGP Problem" is that PGP is bad for email . If you don't use it for email, I don't see it as really a problem. Unless, maybe, you are a reporter or otherwise not clear on the principles behind using something like GPG. I think personally that the point about all the discussion is that for laypeople PGP and email is just too complicated (even for myself as a progr…

My understanding is quite different. Email is inherently insecure and there is nothing you can do about it. PGP is insecure for everything else as well The Latacora article was eye-opening for me on the email problem - quite simply if I send an encrypted mail to a friend / collegue - which I intend them to read, and they read it and quote it to someone else in plain text then that's it - my plaintext and my cipher ar…

Wait, what? No. Leaking plaintext doesn't reveal your long term key. I definitely didn't write that.

Re: Opmsg – A GPG Alternative

#54

Post by tptacek »

bscphil wrote: post #36
masklinn wrote: post #8

Earlier quoted context omitted.

> I think a perhaps unclear part of the recent post "The PGP Problem" is that PGP is bad for email. If you don't use it for email, I don't see it as really a problem. You're apparently asserting that Latacora's "The PGP Problem" states PGP is only bad for email. I can only assume you didn't even bother the article? Because it states that PGP is bad: * period and in its entirety, in fact most of the article (section 1…

So what's the alternative, for asymmetrically encrypting arbitrary binary data? For sending such data to others, the Latacora article suggest a tool that I've never heard of or heard recommended by other experts called "Magic Wormhole". It's a new tool that (from what I call tell) has a whole crapload of limitations and assumptions that PGP does not have: https://magic-wormhole.readthedocs.io/en/latest/welcome.html..…

Wormhole isn't new, and if you haven't heard another "expert" recommend it, you don't hang out with a lot of cryptography engineers.

The point about "simply encrypting files" is that nobody is implementing something with PGP's "encrypt-a-file" interface because it's not that useful; rather, people purposefully design modern systems with cryptography tailored to tasks, like messaging or file transfer or backup.

Your last point about PGP vs. Signal is pretty funny, as it implies that PGP has "solid group chat capabilities".

Re: Opmsg – A GPG Alternative

#55

Post by bscphil »

tptacek wrote: post #54
bscphil wrote: post #36

Earlier quoted context omitted.

So what's the alternative, for asymmetrically encrypting arbitrary binary data? For sending such data to others, the Latacora article suggest a tool that I've never heard of or heard recommended by other experts called "Magic Wormhole". It's a new tool that (from what I call tell) has a whole crapload of limitations and assumptions that PGP does not have: https://magic-wormhole.readthedocs.io/en/latest/welcome.html..…

Wormhole isn't new, and if you haven't heard another "expert" recommend it, you don't hang out with a lot of cryptography engineers. The point about "simply encrypting files" is that nobody is implementing something with PGP's "encrypt-a-file" interface because it's not that useful ; rather, people purposefully design modern systems with cryptography tailored to tasks, like messaging or file transfer or backup. Your…

> Wormhole isn't new, and if you haven't heard another "expert" recommend it, you don't hang out with a lot of cryptography engineers.

You're right, I don't. But the earliest thing I found about Wormhole after a quick look was from 2015, which I think is pretty recent in the crypto world. Maybe I missed something.

> Your last point about PGP vs. Signal is pretty funny, as it implies that PGP has "solid group chat capabilities".

I tried to be clear about the fact that I wasn't saying that. Its benefits over Signal and Wire (but not Matrix) are that it doesn't require a central server and doesn't require any PII to sign up. I consider those crucial for anyone who has extreme security / privacy needs. PGP completely sucks for group messaging, I agree. But the alternatives suggested are simply non-starters for many use cases.

Re: Opmsg – A GPG Alternative

#56

Post by tptacek »

bscphil wrote: post #55
tptacek wrote: post #54

Earlier quoted context omitted.

Wormhole isn't new, and if you haven't heard another "expert" recommend it, you don't hang out with a lot of cryptography engineers. The point about "simply encrypting files" is that nobody is implementing something with PGP's "encrypt-a-file" interface because it's not that useful ; rather, people purposefully design modern systems with cryptography tailored to tasks, like messaging or file transfer or backup. Your…

> Wormhole isn't new, and if you haven't heard another "expert" recommend it, you don't hang out with a lot of cryptography engineers. You're right, I don't. But the earliest thing I found about Wormhole after a quick look was from 2015, which I think is pretty recent in the crypto world. Maybe I missed something. > Your last point about PGP vs. Signal is pretty funny, as it implies that PGP has "solid group chat cap…

Tell me more about what your book says about the crypto world? Is Noise ok now?

Re: Opmsg – A GPG Alternative

#57

Post by maxerickson »

brokenkebab wrote: post #44
maxerickson wrote: post #43

Earlier quoted context omitted.

Most people really don't care. They use Whatsapp because that's where their friends are and they will move to whatever their friends start using next.

'People' is a poorly defined notion here, and cannot be really used for any sane conclusions. Users have different practical, and security needs, therefore different priorities which define their behavior. PGP (and its alternatives) is to Whatsapp (and its alternatives) as apples to oranges.

Okay, the vast majority of the general population, the billions of people using apps like Whatsapp.

Note that the comment I replied to started from the rather categorical "nobody".

Re: Opmsg – A GPG Alternative

#58

Post by bscphil »

tptacek wrote: post #56
bscphil wrote: post #55

Earlier quoted context omitted.

> Wormhole isn't new, and if you haven't heard another "expert" recommend it, you don't hang out with a lot of cryptography engineers. You're right, I don't. But the earliest thing I found about Wormhole after a quick look was from 2015, which I think is pretty recent in the crypto world. Maybe I missed something. > Your last point about PGP vs. Signal is pretty funny, as it implies that PGP has "solid group chat cap…

Tell me more about what your book says about the crypto world? Is Noise ok now?

Maybe? It depends on your requirements. Don't most experts recommend extreme caution with cryptography approaches and software that's less than a decade old? Has that changed? Do we move fast and break things now too?

Would also like to hear your thoughts on why / whether Signal and Wire are actually good recommendations.

Re: Opmsg – A GPG Alternative

#59

Post by tptacek »

bscphil wrote: post #58
tptacek wrote: post #56

Earlier quoted context omitted.

Tell me more about what your book says about the crypto world? Is Noise ok now?

Maybe? It depends on your requirements. Don't most experts recommend extreme caution with cryptography approaches and software that's less than a decade old? Has that changed? Do we move fast and break things now too? Would also like to hear your thoughts on why / whether Signal and Wire are actually good recommendations.

I'll tell you what I don't understand. I don't expect random engineers on HN to be especially crypto-literate, nor should they be: it's a super-specialized field that demands a lot of spare storage capacity in your brain, and a lot of us had enough algebra after Algebra II in 10th grade. Engineers who specialize have a whole huge variety of things to pick: machine learning, distributed systems, optimization, network algorithmics, graphics, systems security, you name it. There's no reason a significant number of people here should have to know what Noise or SPAKE2 is.

What's weird is: if you don't know what any of this stuff is, why would you feel the need to express strong opinions about it? Is it really your belief that intuition and a drive-by reading of some slides on Github page can bring you up to speed with the field? I read every "Call Me Maybe" post and I absolutely do not think I'd have a chance in hell at getting a distributed commit protocol right. Hell: I "specialize" in cryptography and feel the same way about crypto protocols!

My thoughts about Signal and Wire are that I did a good job of relating in the post you're talking about what I think about Signal and Wire.

Re: Opmsg – A GPG Alternative

#60

Post by NikkiA »

jively wrote: post #10

The reality of the situation is that you can't remove the human factor from security. So someone copying your email to someone else is a human problem that can't be fixed - someone could just as easily photograph the screen. The reality is email will continue to be used, and there is a use case for being able to send an email securely to another person. EFail was pretty bad, but only affected HTML email. Having a mod…

Replacing email with a seperate 'secure email' system would probably work, at least until idiots write awful implementations of the secure-email protocols.
Post reply on HN