61–69 of 69 posts
> Once a hacker gains access to a Facebook account, they can proceed to activate email encryption. > This renders recovery emails sent to the user’s email address unreadable, as only the hacker has the encryption keys. So: PGP encrypted emails were rarely used, except to lock out the legit user after account was compromised.
Github asks you to log in again to add SSH keys in, this could've been similar They're just looking for excuses
Earlier quoted context omitted.
I don't agree, it's dead simple: For your example, 1. Download the software form the official website. 2. Verify the signature. 3. Done. If you are very concerned, you can double check the signature from a previous version from the Way back Machine. What are the chances the official site AND the archive were both compromised?
Then you're using it wrong. GPG isn't adding anything to this that SHA256 wouldn't, and you're just relying on the SSL certificate. Look at your list of CAs sometime. There's multiple national organizations there. Controlled by a government. And any of those will be deemed as valid, so if you go to https://www.torproject.org/download/ and it's signed by a Chinese CA for some reason, to your browser that's perfectly f…
In a way, having JavaScript client-side verification of files as an option would be as secure (if not more secure) in most circumstances because it'd be more noob friendly. At the very least to ensure mirrors aren't doing anything nefarious.
Earlier quoted context omitted.
A lot of account compromise is due to reused passwords so I'm not sure that's a complete solution.
Sending a PGP-encrypted email with a verification link to activate the feature should solve that.
Earlier quoted context omitted.
I don't agree, it's dead simple: For your example, 1. Download the software form the official website. 2. Verify the signature. 3. Done. If you are very concerned, you can double check the signature from a previous version from the Way back Machine. What are the chances the official site AND the archive were both compromised?
Then you're using it wrong. GPG isn't adding anything to this that SHA256 wouldn't, and you're just relying on the SSL certificate. Look at your list of CAs sometime. There's multiple national organizations there. Controlled by a government. And any of those will be deemed as valid, so if you go to https://www.torproject.org/download/ and it's signed by a Chinese CA for some reason, to your browser that's perfectly f…
Once you verify the fingerprint, you import the key into your keyring and sign the key. It’s TOFU, so it’s done only once.
Earlier quoted context omitted.
Then you're using it wrong. GPG isn't adding anything to this that SHA256 wouldn't, and you're just relying on the SSL certificate. Look at your list of CAs sometime. There's multiple national organizations there. Controlled by a government. And any of those will be deemed as valid, so if you go to https://www.torproject.org/download/ and it's signed by a Chinese CA for some reason, to your browser that's perfectly f…
You download the Tor Browser key from a key server such as openpgp, and verify that the fingerprint is the same as that published in the Tor Browser as well as other websites. You can check who has signed that key also. Once you verify the fingerprint, you import the key into your keyring and sign the key. It’s TOFU, so it’s done only once.
GPG was made to be a self-contained system. It works based on chains of signatures (web of trust). The GPG program enforces this model, you must sign keys for a signature to be identified as valid. Approximations like "I can find the same key on this other website" aren't part of the intended model.
Key servers don't provide trust, they provide convenience. You may obtain keys from keyservers, but to actually trust a key you're supposed to do the work of verifying it. Eg, if you get my key from a keyserver the only legitimate reasons to trust it is that either you met me personally and compared fingerprints, or you trust somebody else who did that.
I dont use FB much. I did not know I could send mail from Facebook.
> Some Facebook users have also reported instances of hackers taking advantage of the PGP encryption feature to compromise accounts. Once a hacker gains access to a Facebook account, they can proceed to activate email encryption. It's quite disingenuous to make it sound like PGP was the problem here. Read that sentence again: "Once a hacker gains access to a Facebook account" regardless of PGP or not... then, of cour…
Of course they could've just fixed that instead of sunsetting encryption entirely, but note that Facebook didn't say this was the reason why they're killing the feature, that's just speculation from the news article. Facebook didn't give an official reason, so maybe it's really just because of low adoption.
> Some Facebook users have also reported instances of hackers taking advantage of the PGP encryption feature to compromise accounts. Once a hacker gains access to a Facebook account, they can proceed to activate email encryption. It's quite disingenuous to make it sound like PGP was the problem here. Read that sentence again: "Once a hacker gains access to a Facebook account" regardless of PGP or not... then, of cour…
You may have still been susceptible because it seems that you can just change the key to a new one in that settings screen. I just tried, and setting a new key only asked me to confirm the password. An encrypted confirmation mail is apparently only sent when you enable the feature itself. So an attacker could potentially just replace your key with their own. Of course they could've just fixed that instead of sunsetti…
You could make the same case against 2FA. Most sites don't require email verification when you enable it. Someone with your password could lock you out by adding a TOTP app. But I wouldn't consider that a vulnerability. It is, if anything, a consequence of not locking down the account in the first place.