Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

SKS Keyserver Network Under Attack

gist.github.com

Post reply on HN
Print view View original

91–100 of 197 posts

Re: SKS Keyserver Network Under Attack

#91

Post by acqq »

baby wrote: post #77
hinkley wrote: post #43

Earlier quoted context omitted.

I’m an old school strong, static typing proponent (strong typing shall rise again!) but I laugh at the notion that it protects you from crypto attacks. Are you a maintainer or an armchair critic? I hope the latter, because if you think type safety is anything more than necessary but insufficient, then that’s number three.

Did he say it defends you against crypto attacks? It does defend you against a lot of attacks that would still endanger the system. Think denial of service attacks for exemple. Extremely easy in Python because bugs don't get caught at compile time.

> It does defend you against a lot of attacks that would still endanger the system. Think denial of service attacks for exemple.

If you believe that, then read: https://news.ycombinator.com/item?id=20313787

Re: SKS Keyserver Network Under Attack

#92

Post by michaelt »

tptacek wrote: post #76

I'd like to gingerly suggest that this is not the way a project that has deliberately set as its adversaries hostile world governments should respond to a trivial, predictable† vandalism attack. Rather, if they're serious about what they're doing – Hansen, in a related document, talks about the "good advice" he gave to dissidents in Venezuela about using GnuPG – they should thank whoever did this. This attack apparen…

My impression from the article was less that they'd personally made the decision hostile world governments were their adversary, and more that they'd ended up looking after some poorly-understood software none of them really knew how to change that made that decision 20 years ago.

Re: SKS Keyserver Network Under Attack

#93

Post by tptacek »

michaelt wrote: post #92
tptacek wrote: post #76

I'd like to gingerly suggest that this is not the way a project that has deliberately set as its adversaries hostile world governments should respond to a trivial, predictable† vandalism attack. Rather, if they're serious about what they're doing – Hansen, in a related document, talks about the "good advice" he gave to dissidents in Venezuela about using GnuPG – they should thank whoever did this. This attack apparen…

My impression from the article was less that they'd personally made the decision hostile world governments were their adversary, and more that they'd ended up looking after some poorly-understood software none of them really knew how to change that made that decision 20 years ago.

See the document linked alongside your comment.

Re: SKS Keyserver Network Under Attack

#94

Post by acqq »

diafygi wrote: post #47
Shoop wrote: post #5

> It's written in an unusual programming language called OCaml, and in a fairly idiosyncratic dialect of it at that. This is of course no problem for a proof of concept meant to support a Ph.D thesis, but for software that's deployed in the field it makes maintenance quite difficult. Not only do we need to be bright enough to understand an algorithm that's literally someone's Ph.D thesis, but we need expertise in obs…

> Any particular reason it's difficult to maintain (other than the lack of popularity of FP in general)? A much bigger issue than the language itself is the overall architecture of the server. It uses Berkeley DB as the main database and only handles one connection at a time. So, if your gossip process starts syncing a huge spam key, you block all front-end web requests (see my issue #61[1]). Also, the keyserver is c…

Here in the comment however a new keyserver is presented:

https://keys.openpgp.org/about/news#2019-06-12-launch

by dpc_pw and Valodim

Re: SKS Keyserver Network Under Attack

#95

Post by acqq »

tptacek wrote: post #76

I'd like to gingerly suggest that this is not the way a project that has deliberately set as its adversaries hostile world governments should respond to a trivial, predictable† vandalism attack. Rather, if they're serious about what they're doing – Hansen, in a related document, talks about the "good advice" he gave to dissidents in Venezuela about using GnuPG – they should thank whoever did this. This attack apparen…

Luckily there is:

https://news.ycombinator.com/item?id=20313577

Presenting:

https://gitlab.com/hagrid-keyserver/hagrid

and

https://keys.openpgp.org/about

Re: SKS Keyserver Network Under Attack

#96

Post by stingraycharles »

tptacek wrote: post #76

I'd like to gingerly suggest that this is not the way a project that has deliberately set as its adversaries hostile world governments should respond to a trivial, predictable† vandalism attack. Rather, if they're serious about what they're doing – Hansen, in a related document, talks about the "good advice" he gave to dissidents in Venezuela about using GnuPG – they should thank whoever did this. This attack apparen…

I use GPG quite a bit. I sign my git commits with it, occasionally use it to securely transfer files with people, and appreciate to have everything coupled with my Yubikey.

What are reasonable alternatives to this right now? If I’m not using the keyservers, it’s not that bad, right?

Re: SKS Keyserver Network Under Attack

#97

Post by pgeorgi »

cyphar wrote: post #58
tptacek wrote: post #52

Earlier quoted context omitted.

The best replacement to PGP would be a messaging network with opt-in, poorly supported encryption? https://www.reddit.com/r/privacy/comments/9avyen/sad_state_o... I don't know what it is with people and Matrix. It seems like a good project, hamstrung by its overzealous cheering section.

> opt-in Device cross-signing (from my understanding, the last must-have feature before e2ee is considered ready to be the default) is very close to being merged now that Matrix 1.0 is out. Yes, it took several years to get there, but I think its fair to say that the e2ee design now looks much better than anything else available (and had to solve many more technical problems than [for instance] Signal, due to the nee…

> Given that it seems to be the only project that provides modern e2ee in a way where your data is actually controlled by you without a central authority, ...

OMEMO on XMPP?

Re: SKS Keyserver Network Under Attack

#98

Post by geofft »

Waterluvian wrote: post #86
geofft wrote: post #66

It's fascinating that the conversation in the GitHub comments went to both personal attacks on the author of the post and defending child pornography in the span of like five responses. I feel like part of the problem is that anyone who's skilled enough to implement solutions has better things to do with their time than participate in a discussion of that quality.

Hmm. Has a site ever experimented with separate comment sections? Put simply: on vs. Off topic (or maybe "meta") . Our comments would be in the off topic section, for example. I regularly see people apologizing for being off topic. Clearly they have something they think is worth saying, but are afraid to pollute the discourse.

I think this falls into one of those social problems with no technical solution. The culture of PGP, as described in the post itself, is that anyone can participate, anyone can upload signatures, anyone can run keyservers, there's no way to remove uploaded keys or signatures ever, and there's no central authority for what is on the keyserver network. Given that culture, there's a social expectation that if you're not going to let the pedophile with the anime avatar have the rest of his arguments taken at face value, you're censoring people and might as well go use one of those corporate sell-out encryption systems like Signal.

(To your actual question: meta.stackoverflow.com, Wikipedia talk pages, meta.wikimedia.org, etc. Also various email/chat communities have defined off-topic lists/rooms. When the participants do actually want to keep off-topic discourse to the side, and the off-topic discussion isn't an attack on the competence of someone reporting a problem or a desire to propagate child pornography, then it's merely a technical problem of enabling them to do it.)

Re: SKS Keyserver Network Under Attack

#99

Post by diafygi »

tptacek wrote: post #76

I'd like to gingerly suggest that this is not the way a project that has deliberately set as its adversaries hostile world governments should respond to a trivial, predictable† vandalism attack. Rather, if they're serious about what they're doing – Hansen, in a related document, talks about the "good advice" he gave to dissidents in Venezuela about using GnuPG – they should thank whoever did this. This attack apparen…

> This isn't the first time the GnuPG ecosystem has responded this way to attacks.

Hmmmm, I think this is a bit of squeaky wheel situation going on. Remember that the sks keyserver pool is mostly a decentralized group of volunteers running a server as a hobby. So you can have all types of people operating keyservers in the pool.

For instance, I've been running a keyserver in the pool for several years. However, I don't blame the attackers like you describe. In fact, I'm openly asking around for a mentor to build a keyserver implementation that can better deal with these kinds of flooding situations.

Anyway, even though I can totally understand why operators get mad and lash out at people trying to take down the service they are running as a hobby to try to help activists communicate securely, I want to stress that that reaction isn't representative of the many of us in the pool.

Re: SKS Keyserver Network Under Attack

#100

Post by tptacek »

diafygi wrote: post #99
tptacek wrote: post #76

I'd like to gingerly suggest that this is not the way a project that has deliberately set as its adversaries hostile world governments should respond to a trivial, predictable† vandalism attack. Rather, if they're serious about what they're doing – Hansen, in a related document, talks about the "good advice" he gave to dissidents in Venezuela about using GnuPG – they should thank whoever did this. This attack apparen…

> This isn't the first time the GnuPG ecosystem has responded this way to attacks. Hmmmm, I think this is a bit of squeaky wheel situation going on. Remember that the sks keyserver pool is mostly a decentralized group of volunteers running a server as a hobby. So you can have all types of people operating keyservers in the pool. For instance, I've been running a keyserver in the pool for several years. However, I don…

The fact that it is simultaneously a "hobby" and an "attempt to help activists communicate securely" is emblematic of the whole problem here.

Either way, the time for Hansen to have warned people about the keyservers was when he first became aware of the vulnerability ("well over a decade" ago), not right after it got exploited on him personally. Everything about this response, from the personal offense he's taken to the lashing out he's done against vulnerability research to the apparent decade-long delay in notification, is unserious and unworthy of a project that purports to protect dissidents against governments.

Post reply on HN