Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

What's the matter with PGP?

blog.cryptographyengineering.com

Post reply on HN
Print view View original

51–60 of 166 posts

Re: What's the matter with PGP?

#51

Post by [deleted] »

matthewdgreen wrote: post #30
tptacek wrote: post #3

At one point in this essay, Matt suggests that every successful end-to-end encryption scheme has employed transparent (or "translucent") key management. What he's referring to is the idea behind, say, OTR: two people can use it without the key handshake required by PGP. Matt is wrong about this. He's being victimized by a pernicious fallacy. It certainly appears that the most "successful" cryptosystems have transpare…

Hi Thomas. I used to think this way too. I think this is certainly a fine way to think about things if your goal is to keep encrypted email deployment limited to the 3-4% of email users who are either technical experts with nothing to say and/or people who are sending obviously sensitive documents. It doesn't scale much beyond that. Moreover, I would argue that a 'translucent' key management infrastructure /can/ be b…

[deleted]

Re: What's the matter with PGP?

#52

Post by bostik »

bradleyjg wrote: post #28
nodata wrote: post #14

Earlier quoted context omitted.

When I ask people for their e-mail address, they give it to me. When I ask them to verify their pgp key, it's less easy. How could the verification of the key be built into the address they give me? Something DNSSEC based I guess.

Either you need a trusted third party or you need to pass something that looks like (at best): 4UpbRAXYMgrESrAwiLPYymNNni1hwyL2JEK7zz2SN52t You could do that by printing it on a business card or reading it over the phone, and then the other guy is going to have to type it in somewhere. The reason trusted third party keeps on coming up, despite all the myriad fundamental problems, is exactly because slinging that arou…

I've seen business cards with PGP fingerprints encoded as QR codes. That's a pretty neat idea.

Re: What's the matter with PGP?

#53

Post by blueking »

I don't agree. I use GPGtools on OSX with the openpgp smartcard and it works flawlessly and is truly convenient. Furthermore I can use 4096 bit RSA keys.

One thing I have learned watching the crypto forums over the years is that there are well calculated misinformation campaigns trying to dissuade people from using secure methods. I see it again and again and the people on this forum need to think carefully before swallowing this as sincere.

I would never never never trust a solution from Google or any large American corporation. They have just been caught lying about prism (Google) and taking bribes (RSA). These companies are now and always will be totally untrustworthy.

Re: What's the matter with PGP?

#54

Post by blueking »

blueking wrote: post #53

I don't agree. I use GPGtools on OSX with the openpgp smartcard and it works flawlessly and is truly convenient. Furthermore I can use 4096 bit RSA keys. One thing I have learned watching the crypto forums over the years is that there are well calculated misinformation campaigns trying to dissuade people from using secure methods. I see it again and again and the people on this forum need to think carefully before sw…

http://upload.wikimedia.org/wikipedia/commons/c/c7/Prism_sli...

Re: What's the matter with PGP?

#55

Post by Torgo »

bdamm wrote: post #32
DanBC wrote: post #26

Earlier quoted context omitted.

I would freaking love it if some good designer with technical knowledge, or help from technical colleagues, would create simple flowcharts of "How to use Encryption". Each chart would be one page. It would walk a user through one step of using a PGP / GPG. It would include links to in-depth reading. The final sheet would be walking through common mistakes that users make. This is one of the things I'd pay for if I ha…

It's not doable, because there are major unsolved problems. Protection of a private key, for example. The only outcome of such a chart would be reams of people utterly vulnerable and thinking that they are not. If you constrain the environment, e.g. "How to use SSL certificates in Chrome on Mac OS X Lion" then there might be a chance that could fit on one page in an easy to understand format.

> Protection of a private key, for example.

I have a master key that was created offline, and use a subkey on a usb smart token. It works good but it was a bitch to set up. Apparently Qubes OS has a hardware-virtualized PGP container for protecting private keys, but that's not a viable solution right now.

Re: What's the matter with PGP?

#56

Post by pauldino »

Someone1234 wrote: post #50
micro-ram wrote: post #37

Earlier quoted context omitted.

We already have a start there. Make all NON-EV certs free.

I'm all for that, but realistically how will you verify identity? If there is no identity verification what is stopping me from going out and registering for "google.com" and then using it in my MITM attack?

I think most non-EV SSL certificates these days are "verified" by sending a message to whatever e-mail address you have on file in your whois record.

Also on Chrome at least certificate pinning should prevent that particular scenario.

Re: What's the matter with PGP?

#57

Post by nktr1 »

tptacek wrote: post #3

At one point in this essay, Matt suggests that every successful end-to-end encryption scheme has employed transparent (or "translucent") key management. What he's referring to is the idea behind, say, OTR: two people can use it without the key handshake required by PGP. Matt is wrong about this. He's being victimized by a pernicious fallacy. It certainly appears that the most "successful" cryptosystems have transpare…

Just an idea that might not be very practical but what if there was X number of "master" public keys managed by trusted groups that could be used to verify other public keys and they were posted in plain text on billboards across towns (maybe could replace CAs?)... just like you can use the Debian keys to verify the Tails OS key..

Re: What's the matter with PGP?

#58

Post by Torgo »

exabrial wrote: post #2

PGP needs to onboard themselves with Elliptic Curve Crypto... significantly smaller makes them more distributable which solves a few of the problems mentioned.

It's in GNUPG 2.1, but it's been in beta forever. Also, at least my smart token can only do RSA. It's disappointing that it's taking this long, but it's not people are throwing money at the GNUPG team.

Re: What's the matter with PGP?

#60

Post by moreati »

tptacek wrote: post #18
michaelt wrote: post #16

Earlier quoted context omitted.

Presumably the hope for transparent key management would be something like the CA system used in TLS, with certain reforms (certificate transparency? Namecoin?) which make it visible when a CA has been hacked or has collaborated with a global adversary. So there's just a dozen or so central authorities who need to handle keys with the utmost severity.

I'm baffled by that attitude (and CT, as well). So, you found out after the fact that the global adversary injected themselves in the middle of your conversation with a source. What do you do now? Move to an apartment in Russia? Also the things that break transparently-keyed systems do so repeatedly . That's what transparent keying means: it's mediated by machines, and factored the slow, clumsy, human interactions ou…

What is CT in this context?
Post reply on HN