25 ms·

I'm giving up on PGP

745 points by FiloSottile 10y ago

mixedCase 10y ago
Dark Mail seems to be dead. Are there any efforts to make e-mail secure by default and e2e encrypted?.
- psiconaut 10y ago
  A few projects that I'm aware of (disclaimer: I'm involved with LEAP): - https://pixelated-project.org/ https://pixelated-project.org/ - https://www.mailpile.is/ https://www.mailpile.is/ - https://modernpgp.org/memoryhole/ https://modernpgp.org/memoryhole/ - https://inbome.readthedocs.io/en/latest/ https://inbome.readthedocs.io/en/latest/ - https://leap.se/ https://leap.se/ Edit: btw, if you're in Berlin from 14-18 Dec, drop by the AME2016 unconf+hackaton https://github.com/mailencrypt/ame2016 https://github.com/mailencrypt/ame2016
  - rakoo 10y ago
    That's a very nice list of links and overlaps with some idea I had, thanks a lot ! INBOME in particular looks to me to be (part of) the way forward, is there any way to follow progress ?
    - psiconaut 10y ago
      some discussiong going on in the ame2016 ML: https://lists.mayfirst.org/mailman/listinfo/ame2016 https://lists.mayfirst.org/mailman/listinfo/ame2016 you can also track the repo: https://github.com/mailencrypt/inbome/ https://github.com/mailencrypt/inbome/
  - 102030485868 10y ago
    Hah: http://i.imgur.com/YphQVru.png http://i.imgur.com/YphQVru.png
    - raimue 10y ago
      It does not have a valid certificate just like any other custom domain hosted on GitHub Pages.
      - mixedCase 10y ago
        Then you shouldn't consider either GH pages for hosting a security-oriented project or a custom domain redirect.
- deleted 10y ago
  [deleted]
- CalRobert 10y ago
  Doesn't cover "default", but mailvelope is a project working on making email for real people (i.e. webmail) easy to secure. I use it often. https://www.mailvelope.com/ https://www.mailvelope.com/
  - 45h34jh53k4j 10y ago
    Requires private keys to loaded into the browser extension. No thanks! Google's E2E is the same, which is to, say garbage.
    - mixedCase 10y ago
      There's no way of doing E2E without a key in the client, per its very definition.
- kkl 10y ago
  Most interesting e2e projects have abandoned email, specifically SMTP, as a secure messaging platform. I would look outside SMTP-based solutions if I were to start using a different project (assuming doing so is an option... I hope it is!). My recommendation here is Signal: https://whispersystems.org/ https://whispersystems.org/
  - CmdrSprinkles 10y ago
    A big problem is that a lot of this is driven less by people who have a genuine need for encrypted communication and more by people who want one on principle. And the latter tend to include the people who are more likely to try The Next New Thing. And it also makes sense. A lot of these services are from companies that need to make money. And there isn't much money in the journalists and dissidents who don't have a bespoke solution.
  - Freak_NL 10y ago
    The author of the article mentions Signal as well, but how do you handle communication from a laptop or desktop computer and/or with people who don't own an Android or IOS smartphone?
    - kkl 10y ago
      Signal does have a desktop application. I believe you can also register a Signal account using a phone number from a service like Twilio. I'm not 100% sure that will work with Signal desktop though. https://whispersystems.org/blog/signal-desktop/ https://whispersystems.org/blog/signal-desktop/
      - sliken 10y ago
        Signal in a chrome app can pair to signal on android/IOS. But I don't believe you can use chrome only. The chrome app just waits for you to pair with a phone and can't send/receive messages until you do so.
  - NoGravitas 10y ago
    Signal is nice, and I use it. But it's an instant messaging system. Email has different use cases. I think what we're going to need is a new, non-SMTP protocol, which preserves all of the good things about email, while providing e2e encryption and (pseudonymous) identity assurance. I don't know enough to be involved in designing that protocol, though, other than saying what I want to see as an end-user.
- CoryG89 10y ago
  There is a reason they mostly don't exist, at least in the US. After Lavabit was so publicly shut down, it's going to be a losing proposition for anyone to put so much time and effort into it, just to then be given a choice between providing a backdoor or shutting down as soon as the government realizes they can't break your service. If your going to start such a service, it needs to be in a country that will respect free speech. And there aren't many.
  - mixedCase 10y ago
    Lavabit didn't do E2E or at least stored the user's keys; since the owner did in fact have the keys needed to unencrypt the Snowden e-mails (and sent them to the FBI in paper using infinitely small character size, apparently).
    - CoryG89 10y ago
      IIRC, they did not store user's keys. What they wanted was for Lavabit to turn over their SSL key, which would have compromised security for the entire service, rather than just targeting Snowden specifically. Presumably they did not have the ability to turn over the emails themselves, so they wanted Lavabit to provide a vector to do a man in the middle attack.
- drzaiusapelord 10y ago
  Why not S/MIME? Most clients support it, its stupid easy, and has had a lot of eyes on it considering its age. Constantly re-inventing email encryption seems to be the problem here. None of them really make this stuff any better. Key distribution is still going to be PITA, but sticking with a supported standard makes the most sense.
  - drdaeman 10y ago
    No one seem to want to touch anything that already exists. Never heard of anyone thinking of redesigning UI/UX for a typical MUA or browser's keystore (throwing in BTBV option or whatever), although I still believe that must be possible. Everyone's off with their own proprietary non-interoperable (occasionally, "open") standards. Also, _almost_ no client supports _any_ form of authentication and encryption on mobile, be it OpenPGP, S/MIME, PEP, SaltPack or whatever else. There are few, but that's not even remotely close to "most". Neither there is much choice of good desktop client software as well.
    - drzaiusapelord 10y ago
      iPhone supports S/MIME out of the box. Android has 3rd party mail clients that do. Several desktop clients do, including Outlook. Its not as dire as you make it to be. People just dont want the hassle and don't value their email privacy. Once they do value this, which they should considering all the breaches of late, then it'll catch on. I work with companies that have S/MIME internally for just this reason. Its completely feasible.
    - noinsight 10y ago
      > authentication and encryption on mobile The iOS built-in Mail application supports S/MIME. However, it doesn't support anything above TLS 1.0 for IMAP, curiously. K-9 and the Android mail client don't support S/MIME, however. On the desktop, Thunderbird and Outlook support S/MIME. So does mutt.
- mtgx 10y ago
  Google's End-To-End also seems dead. https://github.com/google/end-to-end https://github.com/google/end-to-end I would say ProtonMail or the miniLock-based Peerio.com are now the most interesting projects for encrypted email. EDIT: https://minilock.io/ https://minilock.io/ https://github.com/PeerioTechnologies/peerio-client https://github.com/PeerioTechnologies/peerio-client
  - 45h34jh53k4j 10y ago
    Private keys accessible to the browser is the worst model. I don't think this was ever taken seriously at Google either...
    - mtgx 10y ago
      It's not the worst model. It's still significantly better than what Google/Microsoft/Yahoo are offering. And at least it's a model that can scale. When we'll get 10% of the email users to use (real) PGP, then we can talk about about switching everything else to it, too. But I assume that's never going to happen. The only way PGP would reach those numbers is if Google actually finishes the End-to-End tool, and not only that, but then it actually makes it part of the Chrome browser and automatically asks all Gmail users at sign-in if they want to set-up End-to-End, too. That's the only way I can see PGP reach 10% of the email market. But even then I assume you'd argue it's still "browser-based" encryption. So I guess it's pointless.
    - nickik 10y ago
      Private key required in the browser is bad. However if we had a system where those people that want or care can key their keys offline (or on a Smartcard) while those that don't want. Protonmail with SRP and 2FA where a attack has to pretty tricky stuff but you still get a e2e system is far better then what we have now. Its a far more involved attack to just look at your old emails, and its easier to detect. We will never have a useable experience for all user if we do not accept compromises. I would prefer if everybody of my family was on some system like that, compared to gmx or yahoo. There is a lot more you can do to protect the client from the server as well. Keybase is doing some interesting stuff in that direction. We just have the change our assumption of what it means if a email arrives encrypted with GPG. GPG is already not perfect and we should move away from it anyway, again, Keybase is offering some interesting steps in the right direction. Steps on a long road.
- teddyh 10y ago
  https://pep.foundation/ https://pep.foundation/ Commercial offerings for companies at https://www.prettyeasyprivacy.com/ https://www.prettyeasyprivacy.com/ (No, they are not, as far as I know “open core” – they are 100% free software.)
psiconaut 10y ago
I find very interesting the point about the split between what WoT was supposed to be, in theory, and what little it represents, in practice, in terms of practices about key verification. It has been said many times that the lack of adoption of pgp in mail was due to the average user not being able to grasp the concepts behind the proper operation for key management, but the article points to common practices among "power users" that will drop the theoretical best practices and switch to fallback, unsecure modes, given the effort needed to properly verify a key binding. If the community that cares about encryption and privacy is not able to routinely verify keys, the whole system definitely has a weak link. I wonder if pgp is fundamentally flawed, or we have a deep conceptual usability issue here. And to me, assuming that the most usable thing we can use instead is something that relies on mobile phone identifiers, more often than not tied to a phisical world identity, is really something to worry about.
- jerf 10y ago
  "I wonder if pgp is fundamentally flawed, or we have a deep conceptual usability issue here." I think it's the key model that's fundamentally flawed rather than pgp itself, which I believe the author of the article is also asserting. In cryptography, it is often explained that despite the fact a one-time pad is guaranteed-secure (given various conditions I'm eliding), it is not practical in the vast majority of cases because of a chicken-and-egg problem: How do you distribute the one time pad in the first place? If you do it insecurely, it's a waste of time. If you can do it "securely", why not just use that secure channel to send the message in the first place? OTPs can still be useful because you can establish a secure channel once for a limited duration of time and then use it to temporally shift your security into the future, but that's a relatively rare use case. (That is, the vast bulk of encryption is being used between people who may never have had a "secure" channel between them; think HTTPS here.) Similarly, PGP's got this significant problem where given that you have the correct keys and that you know you can trust them, it secures your communication quite effectively. But the question is, how do we get to the point where you know that you have the correct keys and you can trust them? Well... that's a hard problem itself. Especially considered over time. So alternate models must be pursued. Like the author, I think the Keybase approach is a good idea. In fact I'd even suggest that the idea should be generalized away from "social media accounts" to just "potentially unreliable mechanism" in general. If I have 6 mechanisms for asserting identity on my key, each of which are 95% reliable over the course of a year, then from an absolutist security point of view, that key is still insecure... but assuming even modest independence between the unreliable mechanisms (assuming naive total independence is definitely incorrect, once one is hacked the others are certainly more likely, but neither is it the case that one hack guarantees all others can be hacked), it's still much more secure than nothing at all.
keeganjw 10y ago
After all that, he was only getting two encrypted emails a year! Damn. That's crazy.
- jgrahamc 10y ago
  This has been my experience. The only "good" experience I've had with encrypted messages through email was a back and forth exchange I had with a fellow Keybase user where I manually copy and pasted blocks of encrypted text into/out of their web interface.
  - Nadya 10y ago
    From my experience - the only PGP users I've spoken to were all on Keybase or interested in a Keybase invite. It was about 6 people for the entirety of last year - and 3 people this year...it certainly has a problem of "almost nobody uses it" but Keybase seems to have eased things slightly - or at least made it easier to discover people who also use PGP. I see the two problems being "People don't bother with the clunkiness of using PGP when sending an email about what to pick up from the store" and "most users have no reason to talk to most other users". I'm considering making it a point to message people with interesting Keybase avatars or social profiles tied to their Keybase if only to have an excuse to use PGP more, as silly as that might sound.
    - nickik 10y ago
      Keybase has clearly moved away from PGP. They want to use Saltpack whenever possible, NaCl based encryption. They want to solve the problem of multiple devices and not having to share the private key between all of them. As far as I know they are working on a messaging app as well.
      - Nadya 10y ago
        They also have the KBFS which is very interesting. But yes, very clearly pivoted away from PGP and are working on other problems.
parennoob 10y ago
To me, Keybase (https://keybase.io https://keybase.io) seems to solve the "PGP has a bad user experience" problem correctly for like 90% of the population. You post proofs of your public key to known media (Twitter, Github, your website, etc.) which you control. These can be checked by anyone. Even if the remote person doesn't know they are talking to you (as a human entity), they know they are talking to the combined online persona of all those accounts, which is all that matters for the vast majority of them. Yes, it is possible for all these services to collude and post false proofs, but that would be relatively easily detectable, and realistically not a concern for the majority of people out there, whose alternative is to not use any encryption. People who are really concerned can always fall back to standard PGP. [Edit: Looks like I didn't read the article carefully enough, the author himself says he actually does use Keybase too.]
- stonemetal 10y ago
  The combined online persona of those accounts is only as strong as their combined security. aka: Why would services need to collude when they can get the job done by ineptitude? https://medium.com/@N/how-i-lost-my-50-000-twitter-username-24eb09e026dd#.ap51boulz https://medium.com/@N/how-i-lost-my-50-000-twitter-username-...
  - parennoob 10y ago
    I agree, a lot of services displayed a shocking amount of incompetence in that post. However, a) The more proofs you have, the harder it becomes to force them. YC for example is one location, and is run (in my opinion) by very smart people where it would be hard to get a compromise. b) My point is that this is an excellent alternative to not using anything in a way that is both friendly to people ("just make this post on [website]") and compatible with an older, better method of privacy (PGP) that people have been using for years. It may not be as perfect as some of the more esoteric alternatives that people have suggested elsewhere in the thread (I'm not sure about this, can an incompetent phone company employee compromise some of the phone-based ones? I've come across a lot of incompetent phone company people), but much easier for the regular person to use.
  - 10y ago
kzrdude 10y ago
gpg is promoted as a kind of swiss army knife of privacy, but its interface always puts email first. If you use it for something else, you must paranoidly guard every command so that it doesn't by mistake publish information about your privately used keys, for example.
- lmm 10y ago
  Very true. A high-quality library (that was actually built as a library) for OpenPGP would be a very valuable thing to have.
milge 10y ago
I've been thinking a lot about PGP and other encrypted messengers lately. It's incredibly hard to get a lot of people to agree on one messaging app besides default SMS. I wish there was an open source suite of tools for mobile/desktop that easily layered PGP on top of SMS/email experience and would fall back in the absence of keys. Perhaps bluetooth for swapping keys with friends. It's something that needs to be seamless enough that the end user can't tell the difference. I don't think messaging encryption will achieve mass adoption until something like that is built or built into mobile OS's.
- erelde 10y ago
  Carriers would need to change the way they handle SMS, and everything a carrier does is subject to state regulations. And states seem to like clear text.
  - milge 10y ago
    Why's that? I understand the message would increase in size because of the encryption, but I think it would be technically feasible now. Didn't even apple just introduce encryption into their messenger? My issue with apple's encryption is it's closed source and apple only.
    - heartbreak 10y ago
      iMessage end-to-end encryption is not a recent introduction. It has been in place for several years, though I can't find the exact iOS version it was introduced in.
      - milge 10y ago
        Recent to me is the last few years, technology-wise. Your timeline may look different.
        heartbreak 10y ago
        Fair point. We are talking about a 5 year old product though...
rbcgerard 10y ago
Usability is the "key" - it's hard enough to get people to use signal ("why do I need another messaging app?")
- erelde 10y ago
  If they don't have Signal you could get them to either use Whatsapp, or only use the encrypted conversation feature of Facebook's Messenger. They should have one or the other already installed if they're complaining about "another messaging app".
  - ReverseCold 10y ago
    This works fine until you get someone who only uses iMessage, and you use Android.
    - floatrock 10y ago
      Exactly what finally convinced me to add whatsapp.
  - rbcgerard 10y ago
    Very true, i do default to WhatsApp quite often, but not being in FB's eco system is something I'd like to avoid (especially given the the privacy bargain that comes with both)
eriknstr 10y ago
Good points, but also I would like to point out that https://www.usenix.org/system/files/1401_08-12_mickens.pdf https://www.usenix.org/system/files/1401_08-12_mickens.pdf linked from the blog post was an entertaining read so for anyone that didn't read said PDF, do.
- mikecb 10y ago
  There's quite a few Mickens rants, and they're all well written. Edit: Link http://mickens.seas.harvard.edu/wisdom-james-mickens http://mickens.seas.harvard.edu/wisdom-james-mickens
  - LongTermBond007 10y ago
    Guess I have some homework- thanks for linking these!
- LongTermBond007 10y ago
  > “But James,” you protest, “there are many best practices for choosing passwords!” Yes, I am aware of the “use a vivid image” technique, and if I lived in a sensory deprivation tank and I had never used the Internet, I could easily remember a password phrase like “Gigantic Martian Insect Party.” Unfortunately, I have used the Internet, and this means that I have seen, heard, and occasionally paid money for every thing that could ever be imagined. I have seen a video called “Gigantic Martian Insect Party,” and I have seen another video called “Gigantic Martian Insect Party 2: Don’t Tell Mom,” and I hated both videos, but this did not stop me from directing the sequel “Gigantic Mar- tian Insect Party Into Darkness. This is hilarious, thanks for pointing this out!
  - acqq 10y ago
    I like: "It’s like, websites are amazing BUT DON’T CLICK ON THAT LINK, and your phone can run all of these amazing apps BUT MANY OF YOUR APPS ARE EVIL, and if you order a Russian bride on Craigslist YOU MAY GET A CONFUSED FILIPINO MAN WHO DOES NOT LIKE BEING SHIPPED IN A BOX. It’s not clear what else there is to do with computers besides click on things, run applications, and fill spiritual voids using destitute mail-ordered foreigners. If the security people are correct, then the only provably safe activity is to stare at a horseshoe whose integrity has been verified by a quorum of Rivest, Shamir, and Adleman." For his claim "YOU’RE STILL GONNA BE MOSSAD’ED UPON" I still don't know how to interpret the fact that Snowden seems to be relatively fine. Maybe that he had the idea about the blind spots of the system in which he worked. His opinion on PGP "web of trust": "“Chains of Attestation” is a great name for a heavy metal band, but it is less practical in the real, non- Ozzy-Ozbourne-based world, since I don’t just need a chain of attestation between me and some unknown, filthy stranger— I also need a chain of attestation for each link in that chain. This recursive attestation eventually leads to fractals and H.P. Lovecraft-style madness." It is an opsec problem that all the connections are then cryptographically provable.
esseti 10y ago
I've been using PGP for mostly 1 year and yes, I agree. I still send around signed email, but never received one encrypted so far. Generating keys and backing them up is tricky and I have probably made mistake in generating or storing them at some point in time. Is there a step-by-step good-practice on how to use PGP?
qrbLPHiKpiux 10y ago
9/10 end users just don't understand that security and convenience are inversely related.
- cpuguy83 10y ago
  I think they understand that quite well, that's why when security gets in the way they just find a way bypass it. Security has to be usable, if it's not usable then (almost) no one will use it.
- epistasis 10y ago
  Systems like Signal and WhatsApp show that that's not necessarily true to the degree of previous solutions.
  - nickik 10y ago
    They only manage that by compromising on other fronts. That is not an option with E-Mail.
  - j1vms 10y ago
    > Systems like Signal and WhatsApp show that that's not necessarily true to the degree of previous solutions. I dunno if I'd really believe that until either company is willing to put a rising bounty starting at say $10 million USD for a real* break. Then we'll see. *not due to user carelessness or social engineering
  - orblivion 10y ago
    I think that the analysis is a little more involved than that. Roughly, I'd say that at any given point you can make "trivial" tradeoffs between security and convenience. However there can be some groundbreaking advances in one that don't cost you on the other. And then that point you may be able to do a "trivial" rebalance if you'd like.
zitterbewegung 10y ago
Me too. The reason I gave up on PGP is I couldn't find anyone that would willingly use the service through email. With Signal I can find people that use it.
m3ta 10y ago
There isn't a lot to unpack in this article. Most is set-up; explaining how connected he is to a community that is enthusiastic about PGP yet doesn't apply secure operations in practice. Then there is the main complaint: > I haven't done a formal study, but I'm almost positive that everyone that used PGP to contact me has or would have done (if asked) one of the following: > - pulled the best-looking key from a keyserver, most likely not even over TLS > - used a different key if replied with "this is my new key" > - resent the email unencrypted if provided an excuse like "I'm traveling" I haven't done a formal study either, but no one I know that uses PGP would do any of these things under any circumstances. PGP works fine for myself and the group of people I know that use it, because we adhere to security protocols that are just as important -- if not more -- than using PGP itself.
- pricechild 10y ago
  Have you tested your group of people?
- FiloSottile 10y ago
  That is definitely not my main complaint, and I suspect it might have caught your eye because it's the one that wouldn't apply to you (which is absolutely possible). The article is about the flaws of long-term identity keys, and it would stand even if there weren't UX, adoption, or security protocols adherence issues. Maybe try to unpack a bit more :)
  - m3ta 10y ago
    You're right, long-term identity keys are bad. Long-term identity keys are not a concept mandated by PGP, they are a result of how people use PGP or how PGP is implemented in a third party app. No part of PGP requires you to use a key more than once. This phenomenon is a result of a consensus of people deciding on a terrible operations strategy over a long period of time. Edit: this comes to mind https://gist.github.com/grugq/03167bed45e774551155 https://gist.github.com/grugq/03167bed45e774551155
    - FiloSottile 10y ago
ritonlajoie 10y ago
On a related thought, using a 'secure' (or so they say ?) email provider à là protonmail is just secure if you send your email to another protonmail user. Problem with services like that is they omit to tell their users that email is not E2E, and sending from protonmail to gmail will just disable the benefits of using protonmail. So yes, if you are trying to send encrypted email to a GMAIL user, your only way is to use GPG. Or to get them onboard of protonmail and the likes. It's... impossible.
- nickik 10y ago
  I don't want to be a defender of snake-oil email providers but I think a 'secure' e-mail provider hopefully does more then just GPG to other users. They hopefully have a good secure authentication system (Protonmail just added SRP and 2Fa) and hopefully have correct policy for things such as DKIM, SPF. They hopefully also keep up with security updates and stuff like that. Doing these things seems normal to many, but the reality is that many E-Mail providers have non of those things.
- j-conn 10y ago
  When sending to a non-protonmail account, you have the option to encrypt the message contents-- recipient has to open a link and enter the password. I think decryption is done in the browser in that case too (not 100% sure tho)
  - pfooti 10y ago
    That is correct. The recipient can reply from that webpage as well, however you can't have a conversation there (your replies to their replies don't show up in that page, they have to get new URLs in their email).
- chefandy 10y ago
  From what I remember, Protonmail is more about protecting the client and contents of the inbox from snooping than protecting the email content in transit between their servers and other people's clients. Supposedly, they use in-browser encryption to encrypt traffic between the browser and webmail server, and encrypt the mailbox so access to the server won't provide easy access to your account's contents. They also claim that hosting in Switzerland reduces the risk of server-side government interference.
Arathorn 10y ago
The conclusions here (avoiding long-lived per-identity keys and having the option to easily rotate and re-validate per-device keys) are very much what we've aimed for in the end-to-end crypto for Matrix.org (https://matrix.org/blog/2016/11/21/matrixs-olm-end-to-end-encryption-security-assessment-released-and-implemented-cross-platform-on-riot-at-last/ https://matrix.org/blog/2016/11/21/matrixs-olm-end-to-end-en...). Rather than using a silo like Signal or WhatsApp, it is possible to get the flexibility of an open federated network built on an open standard, whilst still having the lighter weight approach of trust common to E2E messaging apps like WhatsApp. Or at least that's the hope :)
- buzzybee 10y ago
  When I mention Matrix, a lot of people seem to pigeonhole it as a chat system alone because Riot is such a dominating part of the application ecosystem. It would be really great to have more code and demonstrations available; adding Matrix was suggested for Mastodon[0] to potentially gain chat and private messaging features that aren't part of GNUSocial, but as of right now it's considered out of scope. [0] https://github.com/Gargron/mastodon/ https://github.com/Gargron/mastodon/
  - Arathorn 10y ago
    Hum, just found the bug at https://github.com/Gargron/mastodon/issues/311 https://github.com/Gargron/mastodon/issues/311 - shame that folks there haven't grokked what Matrix is. Yes, pigeonholing it as a chat system is kinda missing the point, but it's an easy way to kick the tyres and prove its potential. Once threading lands in Matrix we'll be adding in gateways for SMTP, IMAP, NNTP, Discourse, and possibly Gnusocial etc - either written by us or from the community. Then hopefully the bigger picture will be more obvious(!)
  - NoGravitas 10y ago
    I would love to see a full-federated email-like (as opposed to chat-like) system built on top of Matrix.
- nickik 10y ago
nickik 10y ago
I feel the pain as well. I'm not ready to make the same jump however. I really do support Keybase, there I see the potential to solve many of the issues. I would love some better integration into the E-Mail ecosystem, but sadly its not there jet, and its not there focus.
module0000 10y ago
PGP may have broken down for the author, but it's still used in a lot of places. For example, to communicate with our bankers at work, every email has to be properly encrypted and signed - or it goes into a blackhole. The only way to exchange public keys(initially) is in person. Once that is done, new keys are provided from that person, and the WoT expands. tldr; it doesn't work for the author, but it does work for lots of individuals and even more companies with secrets to protect.
- runn1ng 10y ago
  PGP is also used very heavily on darknet on drug marketplaces. OTR (or even Signal) is not possible there, so people stick to good-and-tried PGP.
  - TheGrumpyBrit 10y ago
    I think darkweb marketplaces are a slightly different use case though. The requirements for a darkweb transaction are the ability to tell the vendor your address so they can send you illegal goods, while hiding it from the marketplace itself in case their servers are seized. A random PGP key with no real name and no verification is entirely adequate for this purpose - indeed, any kind of identity validation would probably be seen as a negative for such a situation.
- sickbeard 10y ago
  In otherwords, it only works in controlled environments, not out in the wild
  - 5ilv3r 10y ago
    Not to be glib, but this is true in much the same way as secure http. Really the only way to do it properly is to control the root key for your organization. The chain of trust starting with the vendor you got the computer from is bonkers.
    - dpark 10y ago
mtgx 10y ago
I guess this is a good opportunity to review Matthew Green and Moxie's posts on PGP, too: https://blog.cryptographyengineering.com/2014/08/13/whats-matter-with-pgp/ https://blog.cryptographyengineering.com/2014/08/13/whats-ma... https://moxie.org/blog/gpg-and-me/ https://moxie.org/blog/gpg-and-me/
- sgarman 10y ago
  I really like what moxie wrote here. There is a big difference from the best thing and the thing that can actually exist in the real world right now.
upofadown 10y ago
One perfectly valid way so solve the web of trust issue with PGP is to simply ignore the web of trust issue with PGP. Just stick your pubkey on your website and you are done. You just understand that there is a very low chance that any encrypted email from an unknown entity is actually from a composite entity. If you think that you are of interest to entities that have the ability to MITM your pubkey, you might want to mention the problem to potential unknown email senders as a disclaimer on your web page. In practice an entity with the power to MITM pubkeys is not going to use the facility unless they are really really sure as they are eventually going to get caught at it. Things like Signal and Whatapp don't solve the web of trust issue either so you are not any worse off by using the head in the sand approach.
cestith 10y ago
There was not a single mention of CA-signed S/MIME certificates. That seems quite an oversight.
devilsavocado 10y ago
People who use PGP keys, can you give examples of your use? I'm genuinely curious. Who are you contacting, or who is contacting you? The author says he only receives 2 encrypted emails a year. Not only do I not have a PGP key, I don't think I've ever found myself in a situation where it was even an option to use one.
- lmm 10y ago
  a) signing scala libraries I release b) ordinary emails to a few of my friends c) facebook notification emails I don't think I've ever used PGP when emailing a stranger, but I very rarely email strangers in the first place.
  - devilsavocado 10y ago
    I was only thinking about keeping communication private. I didn't think about uses like signing libraries. Great example, thanks.
- nuclear_eclipse 10y ago
  I've only ever used my PGP key for two purposes: - to sign tags in Git for open source projects that I maintain - to sign custom packages I build (and host) for Arch Linux
- halvdan 10y ago
  Haven't used it for communication but I've been using it as a means to store encrypted backups with a cloud provider. If you're interested, check out duplicity at http://duplicity.nongnu.org/ http://duplicity.nongnu.org/.
- lukaslalinsky 10y ago
  1) I occasionally use it to send secrets (password, certificates, private keys) to people when I can't meet them in person. 2) I share a file-based password manager with other people, that is basically just a collection of PGP-encrypted files with multiple recipients (managed using "pass"). 3) I sign git tags, so that people know I have made the release. 4) I rely on the fact that all Ubuntu packages are signed and I will not accidentally install a package from an unknown source. 5) I have encrypted backups.
lmm 10y ago
> Yeah, about that. I never ever ever successfully used the WoT to validate a public key. If you ever installed a Debian package then you did. A long-term identity as "Bob Jones" might not be terribly useful - but that's not the kind of long-term identity we care about a lot in real life either. A long-term identity as "Debian release manager" or "Signatory on bank account xyz" or even "Wikileaks committee member" is a lot more important, and for those cases PGP becomes very useful. > Then, there's the UX problem. Easy crippling mistakes. Messy keyserver listings from years ago. "I can't read this email on my phone". "Or on the laptop, I left the keys I never use on the other machine". These are real problems. We should fix them. But we don't need a new crypto standard to do so! It never fails to amaze me how many people/organizations are like "I don't have the time/money/patience to write a high-quality OpenPGP libary (or a high-quality GPG frontend), but I'm perfectly placed to create a new cryptosystem from scratch." > Your average adversary probably can't MitM Twitter DMs (which means you can use them to exchange fingerprints opportunistically, while still protecting your privacy). The Mossad will do Mossad things to your machine, whatever key you use. This is pets vs cattle in the opposite direction. Can Mossad Mossad you personally? Yes, if you're a big enough target, but they can't Mossad everyone. Whereas the NSA can MitM key fingerprints exchanged via Twitter on an industrial scale. > Mostly I'll use Signal or WhatsApp, which offer vastly better endpoint security on iOS, ephemerality, and smoother key rotation. If you're using iOS you've already given up against state-level attackers. Anything actually encrypted (e.g. IRC with SSL) is more than adequate in that case. Most people don't need the jump up to PGP, sure. But it's important that the option is there for people that really do need it. It bears repeating that we know, from their complaints in leaked emails, that the NSA can't break PGP when used correctly. That's an extremely strong seal of approval for the most critical use cases for encryption.
- nothrabannosir 10y ago
  > If you're using iOS you've already given up against state-level attackers. Wasn't the recent apple vs FBI debacle evidence to the contrary?
  - matkam 10y ago
    There's also this https://blog.cryptographyengineering.com/2016/11/24/android-n-encryption/ https://blog.cryptographyengineering.com/2016/11/24/android-...
runn1ng 10y ago
I will add what I wrote on a different thread PGP is used very heavily on online drug marketplaces. You really can't use Signal or WhatsApp there - leaking too much metadata - and even OTR is leaking too much data. PGP is quite good for this, and people use it for encoding their communication.
orblivion 10y ago
How is the author so seriously involved in PGP and only receive two encrypted emails a year? I'm basically just a dude who uses PGP because it's cool and I get tens of them. You just need one friend who also thinks it's cool.
- brightsize 10y ago
  Same question. I have one friend, smart and technical but just middle-of-the-pack when it comes to his non-domain-specific computer skills, and I got him using PGP regularly in our communications. He insisted on using webmail so we went with Mailvelope which mostly worked well up until it seemed to be losing his keypairs. He got pretty frustrated with that so now we're trying the ProtonMail approach and hoping for the best. To your point though, we've exchanged many dozens, perhaps 100 PGP-encrypted emails over the past year and I'm sure he's never heard of a "key-signing party".
- andrey_utkin 10y ago
  Even Zimmermann, PGP author, has given up as this journal says https://www.scmagazine.com/phil-zimmermann-doesnt-encrypt-emails/article/532484/ https://www.scmagazine.com/phil-zimmermann-doesnt-encrypt-em...
  - Nadya 10y ago
    A rather large misrepresentation of what was actually said. >Zimmermann later clarified in a Motherboard article that PGP, acquired by Symantec in 2010, isn't compatible with his MacBook, and the technology never worked with any iOS device.
koevet 10y ago
"Yubikeys would get exposed to hotel rooms." Can someone please elaborate on this?
- kardos 10y ago
  I took that to mean he left it in a hotel room while going somewhere, exposing it to any number of maids, possibly including those of a malevolent nature.
  - koevet 10y ago
    As far as I understand, it is not possible to extract a private key from a Yubikey [1] [1] https://www.yubico.com/2012/12/yubikey-neo-openpgp/ https://www.yubico.com/2012/12/yubikey-neo-openpgp/
makecheck 10y ago
I use MacGPG to sign commits on GitHub but I have to admit that the E-mail portion has fallen by the wayside. (The last time I really used it was to E-mail a professor of a cryptography course for an assignment!) While I also don’t know many people that use this for E-mail, it doesn’t help that virtually every OS update in the last 5 years has consistently broken it, taking sometimes months for a fix. For those reasons, this needs to be baked into the OS to be viable. Only when somebody like Apple can install it by default, and make sure it works between updates, will it have the reliability and widespread availability that is necessary for success.
CalChris 10y ago
I think his security threat model was nation state when he really needed APT, annoyingly persistent teenager. There are elements of what he did that I'd do if they were automated. But if the NSA, Mossad, Hacking Team want to get me, they're going to get me. And it would only be vanity to say they are even thinking of me. So this is the perfect being the enemy of the good. I need good privacy and good security. I'm not going to torture myself for perfect privacy and perfect security. Cut to the last scene of The Conversation where Gene Hackman's character tears apart his office ripping down the walls to find the bug and the eavesdropper taunts him. Who is torturing whom?
gkya 10y ago
What's this? But seriously what is this? I use GnuPG and am quite fond of it. I've a pubkey.asc up my website, and I use gpg to encrypt some files and my backup tarballs. PGP is not a mail tool, it's for encrypting strings. Yhis guy does not know what it is and cries for having done much ado for nothing. Key signing parties? I certainly have better things to do. Just generate a key and put it on mit key server, call it done. And he complains he don't get encrypted mail. So what, I'd rather be happy. It'll be useful when it'll be w/ email, and has many other uses otherwise.
- camiller 10y ago
  He clearly knows what it is. He isn't ranting against PGP he is ranting against the WoT. If you got an encrypted email from Linus Torvalds, how would you verify it was him? https://news.ycombinator.com/item?id=12296974 https://news.ycombinator.com/item?id=12296974
  - gkya 10y ago
    I wouldn't. If I'm going to get an encrypted mail from someone, I've alread verified the sender.
glxxyz 10y ago
With only "2 encrypted emails a year", it's not surprising that the author is giving up. I wonder if he has any real secrets to exchange with anyone else, or if setting up keys and participating in a WoT was really just a hobby.
rgzn 10y ago
This story is political.
andrey_utkin 10y ago
> I never ever ever successfully used the WoT to validate a public key. TOFU, anyone? From: Werner Koch wk at gnupg.org Date: Fri Dec 4 14:06:49 CET 2015 Subject: [Announce] GnuPG 2.1.10 released Hello! The GnuPG team is pleased to announce the availability of a new release of GnuPG modern: Version 2.1.10. The main features of this release are support for TOFU (Trust-On-First-Use) and anonymous key retrieval via Tor. ...
simias 10y ago
I have given up on the "web of trust" a long time ago for most of the reasons the author states. I think in order to work PGP would need to reach a critical mass of users that seems totally out of reach at the moment. Maybe if Google or Facebook starts issuing mandatory PGP keys linked with each account or something like that. Not sure why they'd want to do that though. That being said there's still a lot of good and useful in PGP even if you ignore the WoT completely. I use it to secure my passwords, log into remote servers securely with SSH and I sign all of my emails with it, which is probably useless 99.9% of the time but at least it can be used in retrospect to prove that I did write those messages. I can also use it to sign git tags so that my code can still be trusted even if there's a breach in, say, github. I have a rather vast choice of GnuPG tokens I can purchase if I want an added layer of convenience and (hopefully) security. Sure, WoT is simply unusable currently unless you're communicating mostly with hardcore PGP enthusiasts. That won't be enough to make me give up on PGP.
zobzu 10y ago
it is mainly the tools that are blamed even in this post. nobody wants to make a better sks keyserver or gpg cli. why? because you dont get no fame or money from it. filippo show me your gpg commits.
Drdrdrq 10y ago
Yeah. A friend of mine said it best: "if there is a conflict between convenience and security/privacy/anything else, convenience always wins." PGP didn't stand a chance.
khana 10y ago
The 'deficiency' of PGP lay in the leaky nature of the computer itself. How do you maintain your all important private keys? On disk? In memory? USB? All are leaky from the get go. And this, I posit, is the problem gents.
pfooti 10y ago
So, to distinguish, there's web-of-trust things and general pgp/gpg encryption (and signing) UX. Both of these are pretty abysmal for non-technical users. I don't think "muggle" users would be interested in the web of trust at all, and I doubt they can really handle it all that well. But I'm a pretty technical person (MS in Computer Science, PhD in a different field), and well: http://keyserver.ubuntu.com/pks/lookup?op=vindex&search=eric+eslinger&fingerprint=on http://keyserver.ubuntu.com/pks/lookup?op=vindex&search=eric... I don't think the web of trust really matters- would you look at that and say, "hey, this Eric fellow has a 2004 key for his gmail, and an unrelated 2016 one, I'd better not trust him." Doubtful. Honestly, in today's internet (I know, dangerously political...) I think there should be a stronger move toward broad-spectrum encryption of all emails. I actually generate trust with most of my email correspondents independently, but I sure would like to encrypt my communication. Signal is good for shorter messages, but email is still email. It isn't like I have state secrets in my email, but I do have stuff I don't want random government snoops reading, especially if they're bulk-collecting. Furthermore, I think it's important for more people (even people who don't need it) to encrypt their correspondence, so we can provide cover for people who really do need it. Journalists and dissidents won't stand out as much if everybody is encrypting. To that end, I think pgp / gpg is still pretty cruddy for UX. There are decent solutions for each platform, but nothing really good, and my friends / family aren't likely to use a mail client or webmail that's not at least almost as good as gmail/inbox just because I am worried about privacy. I've recently moved to protonmail for most mail, since it has a very slick user experience and I want to know it well enough to be able to recommend it to other people. However, protonmail doesn't let me have my private key (or its analogue - I'm not 100% sure how things really work, but I have a public key that I can give to other people, and those other people can send me encrypted stuff from off-platform. I just can't reply in the same fashion). That means if I lose my protonmail account, woops, I can't read the emails you sent me encrypted to my @protonmail.com account, even if I get the emails. This is more of A Thing now that you can set up protonmail as your MX, and therefore get emails addressed to domains you control on the platform - if I ever swapped my personal domain around, I'd like to have the key. So, for end-to-end encrypted simple messages, signal is great. I just wish protonmail did interop, and then I'd really recommend it to other people.
joveian 10y ago
Summary: The author decided that being connected to long term keys does more harm than good, partly due to the pressure to stay with potentially compromised keys due to the difficulty of starting over. The author will instead focus on secure IM using short term keys bootstrapped by social media accounts. 1) As others have pointed out, I really think the author is overestimating the effort required to compromise a twitter or other social media account. There are many accounts of this happening, including to people like Brian Krebs who knows he is a target and does everything possible to avoid the attacks. 2) Encrypted IM as the primary higher security communication channel seems to be a popular option these days, mostly leaving those of us who don't like IM to look at alternatives. 3) Briar (briarproject.org) is a promising alternative for messaging, although not ready yet and currently only targeting android, which has its own major security issues. Due to the focus on enabling offline, forward secure messaging, it can be used to defeat mass (network) survailance. It can also be used online and addresses some of the specific concerns raised. 4) General purpose computers are both handy and necessarily have security issues. Special purpose devices for more limited secure communication would help with many issues. 5) Secure communication isn't much of a goal; it is more helpful to consider specific threats. If you do something non-trivial towards a vague goal, it is easy to find a way it doesn't meet that goal when you feel like not doing it any more. I'm not sure what the author was trying to achieve with PGP in the first place.
- colejohnson66 10y ago
  Kind of off topic: I really like iMessage. Not to be an Apple fanboi, but it really is one of those things where It Just Works(tm). Encryption shouldn't have to be something the end user has to worry about; it should be transparent to the user while still being as secure as possible (HTTPS and TLS are a great example of this). For the user who cares about encryption, they don't have to configure anything. For the user that doesn't care, they still benefit. By baking it into the OS, Apple ensures that anyone with an iDevice benefits from it. Compare that to having to download an app that may change depending on possible compromises. Anyone who's tried to convince a family member to use Signal, Telegram, etc. knows how much of a pain it is.
  - 10y ago
technion 10y ago
My ongoing concern is around where reasonable alternatives fit in. - Securedrop, where users upload messages and they are automatically encrypted - Darknet services - Businesses where users communicate via desktops. Signal/ etc works in a different space and doesn't provide an alternative to these.
a3_nm 10y ago
The proposed solution is to use Twitter to use Signal or Whatsapp. This forces your correspondents to use one of these centralized services, and also to run proprietary software to be able to use them. I'm also irritated by GPG and OpenPGP's shortcomings, but it still gives people a way to contact you with reasonable security and without having to use specific proprietary services.
danielweber 10y ago
Years ago I worked with a guy who literally wrote a book about how to use PGP. I asked him if he could help me set it up and he said "I don't use it, it's too hard."
- 3131s 10y ago
  It's not too hard, at least not on Linux and for anyone with some familiarity with the terminal. Getting started can be done like this... Install GPG: sudo apt-get install gnupg Generate a key: gpg --gen-key Export your public key as ASCII text and then post it somewhere publicly: gpg --armor --export $your_uid > your_public_key.gpg Import my public key: gpg --import my_public_key.gpg Verify my key by viewing my fingerprint (type fpr) and confirming it with me, then sign it (type sign): gpg --edit-key $my_uid Encrypt the file message.txt and then send message.gpg to me via any medium: gpg --output message.gpg --encrypt --recipient $my_uid message.txt Decrypt my response to you: gpg --output response.txt --decrypt response.gpg I know that's pretty complicated for an average user, but it's not harder than any of the day to day work that we do as programmers. I have not used GPG in years though since my deep web adventures, so hopefully I didn't mess anything up and prove the point that GPG is too hard!
fbis251 10y ago
Who here is using keybase to manage your public key being distributed? It seems like a great idea since your key is tied to your online identity
- elahd 10y ago
  Keybase is great for managing my keys, but I haven't found any services that make it easy to natively use them. They've sat unused for the ~2 years I've had a Keybase account. That said, I have about 25 invitations. Anyone want one? Edit: Not true. I used my keys once to sign a GitHub release for a novelty project nobody uses.
theszak 10y ago
?What experiences have folks with ZixMail https://www.zixcorp.com/why-zix/email-encryption https://www.zixcorp.com/why-zix/email-encryption
ubernostrum 10y ago
Encryption is a political topic. Get it off HN.
deleted 10y ago
[deleted]
blunte 10y ago
The #1 problem, beyond the usability issues, is that most users still just do not care. They are willfully ignorant (a mentality which is actively celebrated these days in some influential countries), and cannot be convinced in the value of privacy or security. I have tried without much success to get people to move to ProtonMail. I have tried without much success to get people to move to Wire messenger. (And incidentally, the author mentions Signal and WhatsApp... I wonder why he doesn't use Wire?) So without consumers who care, the only audience for PGP and other security focused tools are the geeks who too easily tolerate bad interfaces.
cdevs 10y ago
Never heard of yubikeys, pretty cool. Thanks.
torrent-of-ions 10y ago
Why is WhatsApp trusted? Isn't it proprietary and controlled by Zuckerberg? What am I missing here?
ergot 10y ago
"One click encryption is one click too many" - Bruce Schneier
stefek99 10y ago
I gave up 3 years ago: http://blog.mostlydoing.com/2014/03/how-to-securely-store-private-keys.html http://blog.mostlydoing.com/2014/03/how-to-securely-store-pr... (I don't trust myself to securely store my private keys)

745 points by FiloSottile 10y ago

mixedCase 10y ago

Dark Mail seems to be dead. Are there any efforts to make e-mail secure by default and e2e encrypted?.

psiconaut 10y ago
A few projects that I'm aware of (disclaimer: I'm involved with LEAP): - https://pixelated-project.org/ https://pixelated-project.org/ - https://www.mailpile.is/ https://www.mailpile.is/ - https://modernpgp.org/memoryhole/ https://modernpgp.org/memoryhole/ - https://inbome.readthedocs.io/en/latest/ https://inbome.readthedocs.io/en/latest/ - https://leap.se/ https://leap.se/ Edit: btw, if you're in Berlin from 14-18 Dec, drop by the AME2016 unconf+hackaton https://github.com/mailencrypt/ame2016 https://github.com/mailencrypt/ame2016
- rakoo 10y ago
  That's a very nice list of links and overlaps with some idea I had, thanks a lot ! INBOME in particular looks to me to be (part of) the way forward, is there any way to follow progress ?
  - psiconaut 10y ago
    some discussiong going on in the ame2016 ML: https://lists.mayfirst.org/mailman/listinfo/ame2016 https://lists.mayfirst.org/mailman/listinfo/ame2016 you can also track the repo: https://github.com/mailencrypt/inbome/ https://github.com/mailencrypt/inbome/
- 102030485868 10y ago
  Hah: http://i.imgur.com/YphQVru.png http://i.imgur.com/YphQVru.png
  - raimue 10y ago
    It does not have a valid certificate just like any other custom domain hosted on GitHub Pages.
    - mixedCase 10y ago
      Then you shouldn't consider either GH pages for hosting a security-oriented project or a custom domain redirect.
deleted 10y ago
[deleted]
CalRobert 10y ago
Doesn't cover "default", but mailvelope is a project working on making email for real people (i.e. webmail) easy to secure. I use it often. https://www.mailvelope.com/ https://www.mailvelope.com/
- 45h34jh53k4j 10y ago
  Requires private keys to loaded into the browser extension. No thanks! Google's E2E is the same, which is to, say garbage.
  - mixedCase 10y ago
    There's no way of doing E2E without a key in the client, per its very definition.
kkl 10y ago
Most interesting e2e projects have abandoned email, specifically SMTP, as a secure messaging platform. I would look outside SMTP-based solutions if I were to start using a different project (assuming doing so is an option... I hope it is!). My recommendation here is Signal: https://whispersystems.org/ https://whispersystems.org/
- CmdrSprinkles 10y ago
  A big problem is that a lot of this is driven less by people who have a genuine need for encrypted communication and more by people who want one on principle. And the latter tend to include the people who are more likely to try The Next New Thing. And it also makes sense. A lot of these services are from companies that need to make money. And there isn't much money in the journalists and dissidents who don't have a bespoke solution.
- Freak_NL 10y ago
  The author of the article mentions Signal as well, but how do you handle communication from a laptop or desktop computer and/or with people who don't own an Android or IOS smartphone?
  - kkl 10y ago
    Signal does have a desktop application. I believe you can also register a Signal account using a phone number from a service like Twilio. I'm not 100% sure that will work with Signal desktop though. https://whispersystems.org/blog/signal-desktop/ https://whispersystems.org/blog/signal-desktop/
    - sliken 10y ago
      Signal in a chrome app can pair to signal on android/IOS. But I don't believe you can use chrome only. The chrome app just waits for you to pair with a phone and can't send/receive messages until you do so.
- NoGravitas 10y ago
  Signal is nice, and I use it. But it's an instant messaging system. Email has different use cases. I think what we're going to need is a new, non-SMTP protocol, which preserves all of the good things about email, while providing e2e encryption and (pseudonymous) identity assurance. I don't know enough to be involved in designing that protocol, though, other than saying what I want to see as an end-user.
CoryG89 10y ago
There is a reason they mostly don't exist, at least in the US. After Lavabit was so publicly shut down, it's going to be a losing proposition for anyone to put so much time and effort into it, just to then be given a choice between providing a backdoor or shutting down as soon as the government realizes they can't break your service. If your going to start such a service, it needs to be in a country that will respect free speech. And there aren't many.
- mixedCase 10y ago
  Lavabit didn't do E2E or at least stored the user's keys; since the owner did in fact have the keys needed to unencrypt the Snowden e-mails (and sent them to the FBI in paper using infinitely small character size, apparently).
  - CoryG89 10y ago
    IIRC, they did not store user's keys. What they wanted was for Lavabit to turn over their SSL key, which would have compromised security for the entire service, rather than just targeting Snowden specifically. Presumably they did not have the ability to turn over the emails themselves, so they wanted Lavabit to provide a vector to do a man in the middle attack.
drzaiusapelord 10y ago
Why not S/MIME? Most clients support it, its stupid easy, and has had a lot of eyes on it considering its age. Constantly re-inventing email encryption seems to be the problem here. None of them really make this stuff any better. Key distribution is still going to be PITA, but sticking with a supported standard makes the most sense.
- drdaeman 10y ago
  No one seem to want to touch anything that already exists. Never heard of anyone thinking of redesigning UI/UX for a typical MUA or browser's keystore (throwing in BTBV option or whatever), although I still believe that must be possible. Everyone's off with their own proprietary non-interoperable (occasionally, "open") standards. Also, _almost_ no client supports _any_ form of authentication and encryption on mobile, be it OpenPGP, S/MIME, PEP, SaltPack or whatever else. There are few, but that's not even remotely close to "most". Neither there is much choice of good desktop client software as well.
  - drzaiusapelord 10y ago
    iPhone supports S/MIME out of the box. Android has 3rd party mail clients that do. Several desktop clients do, including Outlook. Its not as dire as you make it to be. People just dont want the hassle and don't value their email privacy. Once they do value this, which they should considering all the breaches of late, then it'll catch on. I work with companies that have S/MIME internally for just this reason. Its completely feasible.
  - noinsight 10y ago
    > authentication and encryption on mobile The iOS built-in Mail application supports S/MIME. However, it doesn't support anything above TLS 1.0 for IMAP, curiously. K-9 and the Android mail client don't support S/MIME, however. On the desktop, Thunderbird and Outlook support S/MIME. So does mutt.
mtgx 10y ago
Google's End-To-End also seems dead. https://github.com/google/end-to-end https://github.com/google/end-to-end I would say ProtonMail or the miniLock-based Peerio.com are now the most interesting projects for encrypted email. EDIT: https://minilock.io/ https://minilock.io/ https://github.com/PeerioTechnologies/peerio-client https://github.com/PeerioTechnologies/peerio-client
- 45h34jh53k4j 10y ago
  Private keys accessible to the browser is the worst model. I don't think this was ever taken seriously at Google either...
  - mtgx 10y ago
    It's not the worst model. It's still significantly better than what Google/Microsoft/Yahoo are offering. And at least it's a model that can scale. When we'll get 10% of the email users to use (real) PGP, then we can talk about about switching everything else to it, too. But I assume that's never going to happen. The only way PGP would reach those numbers is if Google actually finishes the End-to-End tool, and not only that, but then it actually makes it part of the Chrome browser and automatically asks all Gmail users at sign-in if they want to set-up End-to-End, too. That's the only way I can see PGP reach 10% of the email market. But even then I assume you'd argue it's still "browser-based" encryption. So I guess it's pointless.
  - nickik 10y ago
    Private key required in the browser is bad. However if we had a system where those people that want or care can key their keys offline (or on a Smartcard) while those that don't want. Protonmail with SRP and 2FA where a attack has to pretty tricky stuff but you still get a e2e system is far better then what we have now. Its a far more involved attack to just look at your old emails, and its easier to detect. We will never have a useable experience for all user if we do not accept compromises. I would prefer if everybody of my family was on some system like that, compared to gmx or yahoo. There is a lot more you can do to protect the client from the server as well. Keybase is doing some interesting stuff in that direction. We just have the change our assumption of what it means if a email arrives encrypted with GPG. GPG is already not perfect and we should move away from it anyway, again, Keybase is offering some interesting steps in the right direction. Steps on a long road.
teddyh 10y ago
https://pep.foundation/ https://pep.foundation/ Commercial offerings for companies at https://www.prettyeasyprivacy.com/ https://www.prettyeasyprivacy.com/ (No, they are not, as far as I know “open core” – they are 100% free software.)

psiconaut 10y ago

I find very interesting the point about the split between what WoT was supposed to be, in theory, and what little it represents, in practice, in terms of practices about key verification. It has been said many times that the lack of adoption of pgp in mail was due to the average user not being able to grasp the concepts behind the proper operation for key management, but the article points to common practices among "power users" that will drop the theoretical best practices and switch to fallback, unsecure modes, given the effort needed to properly verify a key binding. If the community that cares about encryption and privacy is not able to routinely verify keys, the whole system definitely has a weak link. I wonder if pgp is fundamentally flawed, or we have a deep conceptual usability issue here. And to me, assuming that the most usable thing we can use instead is something that relies on mobile phone identifiers, more often than not tied to a phisical world identity, is really something to worry about.

jerf 10y ago
"I wonder if pgp is fundamentally flawed, or we have a deep conceptual usability issue here." I think it's the key model that's fundamentally flawed rather than pgp itself, which I believe the author of the article is also asserting. In cryptography, it is often explained that despite the fact a one-time pad is guaranteed-secure (given various conditions I'm eliding), it is not practical in the vast majority of cases because of a chicken-and-egg problem: How do you distribute the one time pad in the first place? If you do it insecurely, it's a waste of time. If you can do it "securely", why not just use that secure channel to send the message in the first place? OTPs can still be useful because you can establish a secure channel once for a limited duration of time and then use it to temporally shift your security into the future, but that's a relatively rare use case. (That is, the vast bulk of encryption is being used between people who may never have had a "secure" channel between them; think HTTPS here.) Similarly, PGP's got this significant problem where given that you have the correct keys and that you know you can trust them, it secures your communication quite effectively. But the question is, how do we get to the point where you know that you have the correct keys and you can trust them? Well... that's a hard problem itself. Especially considered over time. So alternate models must be pursued. Like the author, I think the Keybase approach is a good idea. In fact I'd even suggest that the idea should be generalized away from "social media accounts" to just "potentially unreliable mechanism" in general. If I have 6 mechanisms for asserting identity on my key, each of which are 95% reliable over the course of a year, then from an absolutist security point of view, that key is still insecure... but assuming even modest independence between the unreliable mechanisms (assuming naive total independence is definitely incorrect, once one is hacked the others are certainly more likely, but neither is it the case that one hack guarantees all others can be hacked), it's still much more secure than nothing at all.

keeganjw 10y ago

After all that, he was only getting two encrypted emails a year! Damn. That's crazy.

jgrahamc 10y ago
This has been my experience. The only "good" experience I've had with encrypted messages through email was a back and forth exchange I had with a fellow Keybase user where I manually copy and pasted blocks of encrypted text into/out of their web interface.
- Nadya 10y ago
  From my experience - the only PGP users I've spoken to were all on Keybase or interested in a Keybase invite. It was about 6 people for the entirety of last year - and 3 people this year...it certainly has a problem of "almost nobody uses it" but Keybase seems to have eased things slightly - or at least made it easier to discover people who also use PGP. I see the two problems being "People don't bother with the clunkiness of using PGP when sending an email about what to pick up from the store" and "most users have no reason to talk to most other users". I'm considering making it a point to message people with interesting Keybase avatars or social profiles tied to their Keybase if only to have an excuse to use PGP more, as silly as that might sound.
  - nickik 10y ago
    Keybase has clearly moved away from PGP. They want to use Saltpack whenever possible, NaCl based encryption. They want to solve the problem of multiple devices and not having to share the private key between all of them. As far as I know they are working on a messaging app as well.
    - Nadya 10y ago
      They also have the KBFS which is very interesting. But yes, very clearly pivoted away from PGP and are working on other problems.

parennoob 10y ago

To me, Keybase (https://keybase.io https://keybase.io) seems to solve the "PGP has a bad user experience" problem correctly for like 90% of the population. You post proofs of your public key to known media (Twitter, Github, your website, etc.) which you control. These can be checked by anyone. Even if the remote person doesn't know they are talking to you (as a human entity), they know they are talking to the combined online persona of all those accounts, which is all that matters for the vast majority of them. Yes, it is possible for all these services to collude and post false proofs, but that would be relatively easily detectable, and realistically not a concern for the majority of people out there, whose alternative is to not use any encryption. People who are really concerned can always fall back to standard PGP. [Edit: Looks like I didn't read the article carefully enough, the author himself says he actually does use Keybase too.]

stonemetal 10y ago
The combined online persona of those accounts is only as strong as their combined security. aka: Why would services need to collude when they can get the job done by ineptitude? https://medium.com/@N/how-i-lost-my-50-000-twitter-username-24eb09e026dd#.ap51boulz https://medium.com/@N/how-i-lost-my-50-000-twitter-username-...
- parennoob 10y ago
  I agree, a lot of services displayed a shocking amount of incompetence in that post. However, a) The more proofs you have, the harder it becomes to force them. YC for example is one location, and is run (in my opinion) by very smart people where it would be hard to get a compromise. b) My point is that this is an excellent alternative to not using anything in a way that is both friendly to people ("just make this post on [website]") and compatible with an older, better method of privacy (PGP) that people have been using for years. It may not be as perfect as some of the more esoteric alternatives that people have suggested elsewhere in the thread (I'm not sure about this, can an incompetent phone company employee compromise some of the phone-based ones? I've come across a lot of incompetent phone company people), but much easier for the regular person to use.
- 10y ago

kzrdude 10y ago

gpg is promoted as a kind of swiss army knife of privacy, but its interface always puts email first. If you use it for something else, you must paranoidly guard every command so that it doesn't by mistake publish information about your privately used keys, for example.

lmm 10y ago
Very true. A high-quality library (that was actually built as a library) for OpenPGP would be a very valuable thing to have.

milge 10y ago

I've been thinking a lot about PGP and other encrypted messengers lately. It's incredibly hard to get a lot of people to agree on one messaging app besides default SMS. I wish there was an open source suite of tools for mobile/desktop that easily layered PGP on top of SMS/email experience and would fall back in the absence of keys. Perhaps bluetooth for swapping keys with friends. It's something that needs to be seamless enough that the end user can't tell the difference. I don't think messaging encryption will achieve mass adoption until something like that is built or built into mobile OS's.

erelde 10y ago
Carriers would need to change the way they handle SMS, and everything a carrier does is subject to state regulations. And states seem to like clear text.
- milge 10y ago
  Why's that? I understand the message would increase in size because of the encryption, but I think it would be technically feasible now. Didn't even apple just introduce encryption into their messenger? My issue with apple's encryption is it's closed source and apple only.
  - heartbreak 10y ago
    iMessage end-to-end encryption is not a recent introduction. It has been in place for several years, though I can't find the exact iOS version it was introduced in.
    - milge 10y ago
      Recent to me is the last few years, technology-wise. Your timeline may look different.
      - heartbreak 10y ago
        Fair point. We are talking about a 5 year old product though...

rbcgerard 10y ago

Usability is the "key" - it's hard enough to get people to use signal ("why do I need another messaging app?")

erelde 10y ago
If they don't have Signal you could get them to either use Whatsapp, or only use the encrypted conversation feature of Facebook's Messenger. They should have one or the other already installed if they're complaining about "another messaging app".
- ReverseCold 10y ago
  This works fine until you get someone who only uses iMessage, and you use Android.
  - floatrock 10y ago
    Exactly what finally convinced me to add whatsapp.
- rbcgerard 10y ago
  Very true, i do default to WhatsApp quite often, but not being in FB's eco system is something I'd like to avoid (especially given the the privacy bargain that comes with both)

eriknstr 10y ago

Good points, but also I would like to point out that https://www.usenix.org/system/files/1401_08-12_mickens.pdf https://www.usenix.org/system/files/1401_08-12_mickens.pdf linked from the blog post was an entertaining read so for anyone that didn't read said PDF, do.

mikecb 10y ago
There's quite a few Mickens rants, and they're all well written. Edit: Link http://mickens.seas.harvard.edu/wisdom-james-mickens http://mickens.seas.harvard.edu/wisdom-james-mickens
- LongTermBond007 10y ago
  Guess I have some homework- thanks for linking these!
LongTermBond007 10y ago
> “But James,” you protest, “there are many best practices for choosing passwords!” Yes, I am aware of the “use a vivid image” technique, and if I lived in a sensory deprivation tank and I had never used the Internet, I could easily remember a password phrase like “Gigantic Martian Insect Party.” Unfortunately, I have used the Internet, and this means that I have seen, heard, and occasionally paid money for every thing that could ever be imagined. I have seen a video called “Gigantic Martian Insect Party,” and I have seen another video called “Gigantic Martian Insect Party 2: Don’t Tell Mom,” and I hated both videos, but this did not stop me from directing the sequel “Gigantic Mar- tian Insect Party Into Darkness. This is hilarious, thanks for pointing this out!
- acqq 10y ago
  I like: "It’s like, websites are amazing BUT DON’T CLICK ON THAT LINK, and your phone can run all of these amazing apps BUT MANY OF YOUR APPS ARE EVIL, and if you order a Russian bride on Craigslist YOU MAY GET A CONFUSED FILIPINO MAN WHO DOES NOT LIKE BEING SHIPPED IN A BOX. It’s not clear what else there is to do with computers besides click on things, run applications, and fill spiritual voids using destitute mail-ordered foreigners. If the security people are correct, then the only provably safe activity is to stare at a horseshoe whose integrity has been verified by a quorum of Rivest, Shamir, and Adleman." For his claim "YOU’RE STILL GONNA BE MOSSAD’ED UPON" I still don't know how to interpret the fact that Snowden seems to be relatively fine. Maybe that he had the idea about the blind spots of the system in which he worked. His opinion on PGP "web of trust": "“Chains of Attestation” is a great name for a heavy metal band, but it is less practical in the real, non- Ozzy-Ozbourne-based world, since I don’t just need a chain of attestation between me and some unknown, filthy stranger— I also need a chain of attestation for each link in that chain. This recursive attestation eventually leads to fractals and H.P. Lovecraft-style madness." It is an opsec problem that all the connections are then cryptographically provable.

esseti 10y ago

I've been using PGP for mostly 1 year and yes, I agree. I still send around signed email, but never received one encrypted so far. Generating keys and backing them up is tricky and I have probably made mistake in generating or storing them at some point in time. Is there a step-by-step good-practice on how to use PGP?

qrbLPHiKpiux 10y ago

9/10 end users just don't understand that security and convenience are inversely related.

cpuguy83 10y ago
I think they understand that quite well, that's why when security gets in the way they just find a way bypass it. Security has to be usable, if it's not usable then (almost) no one will use it.
epistasis 10y ago
Systems like Signal and WhatsApp show that that's not necessarily true to the degree of previous solutions.
- nickik 10y ago
  They only manage that by compromising on other fronts. That is not an option with E-Mail.
- j1vms 10y ago
  > Systems like Signal and WhatsApp show that that's not necessarily true to the degree of previous solutions. I dunno if I'd really believe that until either company is willing to put a rising bounty starting at say $10 million USD for a real* break. Then we'll see. *not due to user carelessness or social engineering
- orblivion 10y ago
  I think that the analysis is a little more involved than that. Roughly, I'd say that at any given point you can make "trivial" tradeoffs between security and convenience. However there can be some groundbreaking advances in one that don't cost you on the other. And then that point you may be able to do a "trivial" rebalance if you'd like.

zitterbewegung 10y ago

Me too. The reason I gave up on PGP is I couldn't find anyone that would willingly use the service through email. With Signal I can find people that use it.

m3ta 10y ago

There isn't a lot to unpack in this article. Most is set-up; explaining how connected he is to a community that is enthusiastic about PGP yet doesn't apply secure operations in practice. Then there is the main complaint: > I haven't done a formal study, but I'm almost positive that everyone that used PGP to contact me has or would have done (if asked) one of the following: > - pulled the best-looking key from a keyserver, most likely not even over TLS > - used a different key if replied with "this is my new key" > - resent the email unencrypted if provided an excuse like "I'm traveling" I haven't done a formal study either, but no one I know that uses PGP would do any of these things under any circumstances. PGP works fine for myself and the group of people I know that use it, because we adhere to security protocols that are just as important -- if not more -- than using PGP itself.

pricechild 10y ago
Have you tested your group of people?
FiloSottile 10y ago
That is definitely not my main complaint, and I suspect it might have caught your eye because it's the one that wouldn't apply to you (which is absolutely possible). The article is about the flaws of long-term identity keys, and it would stand even if there weren't UX, adoption, or security protocols adherence issues. Maybe try to unpack a bit more :)
- m3ta 10y ago
  You're right, long-term identity keys are bad. Long-term identity keys are not a concept mandated by PGP, they are a result of how people use PGP or how PGP is implemented in a third party app. No part of PGP requires you to use a key more than once. This phenomenon is a result of a consensus of people deciding on a terrible operations strategy over a long period of time. Edit: this comes to mind https://gist.github.com/grugq/03167bed45e774551155 https://gist.github.com/grugq/03167bed45e774551155
  - FiloSottile 10y ago

ritonlajoie 10y ago

On a related thought, using a 'secure' (or so they say ?) email provider à là protonmail is just secure if you send your email to another protonmail user. Problem with services like that is they omit to tell their users that email is not E2E, and sending from protonmail to gmail will just disable the benefits of using protonmail. So yes, if you are trying to send encrypted email to a GMAIL user, your only way is to use GPG. Or to get them onboard of protonmail and the likes. It's... impossible.

nickik 10y ago
I don't want to be a defender of snake-oil email providers but I think a 'secure' e-mail provider hopefully does more then just GPG to other users. They hopefully have a good secure authentication system (Protonmail just added SRP and 2Fa) and hopefully have correct policy for things such as DKIM, SPF. They hopefully also keep up with security updates and stuff like that. Doing these things seems normal to many, but the reality is that many E-Mail providers have non of those things.
j-conn 10y ago
When sending to a non-protonmail account, you have the option to encrypt the message contents-- recipient has to open a link and enter the password. I think decryption is done in the browser in that case too (not 100% sure tho)
- pfooti 10y ago
  That is correct. The recipient can reply from that webpage as well, however you can't have a conversation there (your replies to their replies don't show up in that page, they have to get new URLs in their email).
chefandy 10y ago
From what I remember, Protonmail is more about protecting the client and contents of the inbox from snooping than protecting the email content in transit between their servers and other people's clients. Supposedly, they use in-browser encryption to encrypt traffic between the browser and webmail server, and encrypt the mailbox so access to the server won't provide easy access to your account's contents. They also claim that hosting in Switzerland reduces the risk of server-side government interference.

Arathorn 10y ago

The conclusions here (avoiding long-lived per-identity keys and having the option to easily rotate and re-validate per-device keys) are very much what we've aimed for in the end-to-end crypto for Matrix.org (https://matrix.org/blog/2016/11/21/matrixs-olm-end-to-end-encryption-security-assessment-released-and-implemented-cross-platform-on-riot-at-last/ https://matrix.org/blog/2016/11/21/matrixs-olm-end-to-end-en...). Rather than using a silo like Signal or WhatsApp, it is possible to get the flexibility of an open federated network built on an open standard, whilst still having the lighter weight approach of trust common to E2E messaging apps like WhatsApp. Or at least that's the hope :)

buzzybee 10y ago
When I mention Matrix, a lot of people seem to pigeonhole it as a chat system alone because Riot is such a dominating part of the application ecosystem. It would be really great to have more code and demonstrations available; adding Matrix was suggested for Mastodon[0] to potentially gain chat and private messaging features that aren't part of GNUSocial, but as of right now it's considered out of scope. [0] https://github.com/Gargron/mastodon/ https://github.com/Gargron/mastodon/
- Arathorn 10y ago
  Hum, just found the bug at https://github.com/Gargron/mastodon/issues/311 https://github.com/Gargron/mastodon/issues/311 - shame that folks there haven't grokked what Matrix is. Yes, pigeonholing it as a chat system is kinda missing the point, but it's an easy way to kick the tyres and prove its potential. Once threading lands in Matrix we'll be adding in gateways for SMTP, IMAP, NNTP, Discourse, and possibly Gnusocial etc - either written by us or from the community. Then hopefully the bigger picture will be more obvious(!)
- NoGravitas 10y ago
  I would love to see a full-federated email-like (as opposed to chat-like) system built on top of Matrix.
nickik 10y ago

nickik 10y ago

I feel the pain as well. I'm not ready to make the same jump however. I really do support Keybase, there I see the potential to solve many of the issues. I would love some better integration into the E-Mail ecosystem, but sadly its not there jet, and its not there focus.

module0000 10y ago

PGP may have broken down for the author, but it's still used in a lot of places. For example, to communicate with our bankers at work, every email has to be properly encrypted and signed - or it goes into a blackhole. The only way to exchange public keys(initially) is in person. Once that is done, new keys are provided from that person, and the WoT expands. tldr; it doesn't work for the author, but it does work for lots of individuals and even more companies with secrets to protect.

runn1ng 10y ago
PGP is also used very heavily on darknet on drug marketplaces. OTR (or even Signal) is not possible there, so people stick to good-and-tried PGP.
- TheGrumpyBrit 10y ago
  I think darkweb marketplaces are a slightly different use case though. The requirements for a darkweb transaction are the ability to tell the vendor your address so they can send you illegal goods, while hiding it from the marketplace itself in case their servers are seized. A random PGP key with no real name and no verification is entirely adequate for this purpose - indeed, any kind of identity validation would probably be seen as a negative for such a situation.
sickbeard 10y ago
In otherwords, it only works in controlled environments, not out in the wild
- 5ilv3r 10y ago
  Not to be glib, but this is true in much the same way as secure http. Really the only way to do it properly is to control the root key for your organization. The chain of trust starting with the vendor you got the computer from is bonkers.
  - dpark 10y ago

mtgx 10y ago

I guess this is a good opportunity to review Matthew Green and Moxie's posts on PGP, too: https://blog.cryptographyengineering.com/2014/08/13/whats-matter-with-pgp/ https://blog.cryptographyengineering.com/2014/08/13/whats-ma... https://moxie.org/blog/gpg-and-me/ https://moxie.org/blog/gpg-and-me/

sgarman 10y ago
I really like what moxie wrote here. There is a big difference from the best thing and the thing that can actually exist in the real world right now.

upofadown 10y ago

One perfectly valid way so solve the web of trust issue with PGP is to simply ignore the web of trust issue with PGP. Just stick your pubkey on your website and you are done. You just understand that there is a very low chance that any encrypted email from an unknown entity is actually from a composite entity. If you think that you are of interest to entities that have the ability to MITM your pubkey, you might want to mention the problem to potential unknown email senders as a disclaimer on your web page. In practice an entity with the power to MITM pubkeys is not going to use the facility unless they are really really sure as they are eventually going to get caught at it. Things like Signal and Whatapp don't solve the web of trust issue either so you are not any worse off by using the head in the sand approach.

cestith 10y ago

There was not a single mention of CA-signed S/MIME certificates. That seems quite an oversight.

devilsavocado 10y ago

People who use PGP keys, can you give examples of your use? I'm genuinely curious. Who are you contacting, or who is contacting you? The author says he only receives 2 encrypted emails a year. Not only do I not have a PGP key, I don't think I've ever found myself in a situation where it was even an option to use one.

lmm 10y ago
a) signing scala libraries I release b) ordinary emails to a few of my friends c) facebook notification emails I don't think I've ever used PGP when emailing a stranger, but I very rarely email strangers in the first place.
- devilsavocado 10y ago
  I was only thinking about keeping communication private. I didn't think about uses like signing libraries. Great example, thanks.
nuclear_eclipse 10y ago
I've only ever used my PGP key for two purposes: - to sign tags in Git for open source projects that I maintain - to sign custom packages I build (and host) for Arch Linux
halvdan 10y ago
Haven't used it for communication but I've been using it as a means to store encrypted backups with a cloud provider. If you're interested, check out duplicity at http://duplicity.nongnu.org/ http://duplicity.nongnu.org/.
lukaslalinsky 10y ago
1) I occasionally use it to send secrets (password, certificates, private keys) to people when I can't meet them in person. 2) I share a file-based password manager with other people, that is basically just a collection of PGP-encrypted files with multiple recipients (managed using "pass"). 3) I sign git tags, so that people know I have made the release. 4) I rely on the fact that all Ubuntu packages are signed and I will not accidentally install a package from an unknown source. 5) I have encrypted backups.

lmm 10y ago

> Yeah, about that. I never ever ever successfully used the WoT to validate a public key. If you ever installed a Debian package then you did. A long-term identity as "Bob Jones" might not be terribly useful - but that's not the kind of long-term identity we care about a lot in real life either. A long-term identity as "Debian release manager" or "Signatory on bank account xyz" or even "Wikileaks committee member" is a lot more important, and for those cases PGP becomes very useful. > Then, there's the UX problem. Easy crippling mistakes. Messy keyserver listings from years ago. "I can't read this email on my phone". "Or on the laptop, I left the keys I never use on the other machine". These are real problems. We should fix them. But we don't need a new crypto standard to do so! It never fails to amaze me how many people/organizations are like "I don't have the time/money/patience to write a high-quality OpenPGP libary (or a high-quality GPG frontend), but I'm perfectly placed to create a new cryptosystem from scratch." > Your average adversary probably can't MitM Twitter DMs (which means you can use them to exchange fingerprints opportunistically, while still protecting your privacy). The Mossad will do Mossad things to your machine, whatever key you use. This is pets vs cattle in the opposite direction. Can Mossad Mossad you personally? Yes, if you're a big enough target, but they can't Mossad everyone. Whereas the NSA can MitM key fingerprints exchanged via Twitter on an industrial scale. > Mostly I'll use Signal or WhatsApp, which offer vastly better endpoint security on iOS, ephemerality, and smoother key rotation. If you're using iOS you've already given up against state-level attackers. Anything actually encrypted (e.g. IRC with SSL) is more than adequate in that case. Most people don't need the jump up to PGP, sure. But it's important that the option is there for people that really do need it. It bears repeating that we know, from their complaints in leaked emails, that the NSA can't break PGP when used correctly. That's an extremely strong seal of approval for the most critical use cases for encryption.

nothrabannosir 10y ago
> If you're using iOS you've already given up against state-level attackers. Wasn't the recent apple vs FBI debacle evidence to the contrary?
- matkam 10y ago
  There's also this https://blog.cryptographyengineering.com/2016/11/24/android-n-encryption/ https://blog.cryptographyengineering.com/2016/11/24/android-...

runn1ng 10y ago

I will add what I wrote on a different thread PGP is used very heavily on online drug marketplaces. You really can't use Signal or WhatsApp there - leaking too much metadata - and even OTR is leaking too much data. PGP is quite good for this, and people use it for encoding their communication.

orblivion 10y ago

How is the author so seriously involved in PGP and only receive two encrypted emails a year? I'm basically just a dude who uses PGP because it's cool and I get tens of them. You just need one friend who also thinks it's cool.

brightsize 10y ago
Same question. I have one friend, smart and technical but just middle-of-the-pack when it comes to his non-domain-specific computer skills, and I got him using PGP regularly in our communications. He insisted on using webmail so we went with Mailvelope which mostly worked well up until it seemed to be losing his keypairs. He got pretty frustrated with that so now we're trying the ProtonMail approach and hoping for the best. To your point though, we've exchanged many dozens, perhaps 100 PGP-encrypted emails over the past year and I'm sure he's never heard of a "key-signing party".
andrey_utkin 10y ago
Even Zimmermann, PGP author, has given up as this journal says https://www.scmagazine.com/phil-zimmermann-doesnt-encrypt-emails/article/532484/ https://www.scmagazine.com/phil-zimmermann-doesnt-encrypt-em...
- Nadya 10y ago
  A rather large misrepresentation of what was actually said. >Zimmermann later clarified in a Motherboard article that PGP, acquired by Symantec in 2010, isn't compatible with his MacBook, and the technology never worked with any iOS device.

koevet 10y ago

"Yubikeys would get exposed to hotel rooms." Can someone please elaborate on this?

kardos 10y ago
I took that to mean he left it in a hotel room while going somewhere, exposing it to any number of maids, possibly including those of a malevolent nature.
- koevet 10y ago
  As far as I understand, it is not possible to extract a private key from a Yubikey [1] [1] https://www.yubico.com/2012/12/yubikey-neo-openpgp/ https://www.yubico.com/2012/12/yubikey-neo-openpgp/

makecheck 10y ago

I use MacGPG to sign commits on GitHub but I have to admit that the E-mail portion has fallen by the wayside. (The last time I really used it was to E-mail a professor of a cryptography course for an assignment!) While I also don’t know many people that use this for E-mail, it doesn’t help that virtually every OS update in the last 5 years has consistently broken it, taking sometimes months for a fix. For those reasons, this needs to be baked into the OS to be viable. Only when somebody like Apple can install it by default, and make sure it works between updates, will it have the reliability and widespread availability that is necessary for success.

CalChris 10y ago

I think his security threat model was nation state when he really needed APT, annoyingly persistent teenager. There are elements of what he did that I'd do if they were automated. But if the NSA, Mossad, Hacking Team want to get me, they're going to get me. And it would only be vanity to say they are even thinking of me. So this is the perfect being the enemy of the good. I need good privacy and good security. I'm not going to torture myself for perfect privacy and perfect security. Cut to the last scene of The Conversation where Gene Hackman's character tears apart his office ripping down the walls to find the bug and the eavesdropper taunts him. Who is torturing whom?

gkya 10y ago

What's this? But seriously what is this? I use GnuPG and am quite fond of it. I've a pubkey.asc up my website, and I use gpg to encrypt some files and my backup tarballs. PGP is not a mail tool, it's for encrypting strings. Yhis guy does not know what it is and cries for having done much ado for nothing. Key signing parties? I certainly have better things to do. Just generate a key and put it on mit key server, call it done. And he complains he don't get encrypted mail. So what, I'd rather be happy. It'll be useful when it'll be w/ email, and has many other uses otherwise.

camiller 10y ago
He clearly knows what it is. He isn't ranting against PGP he is ranting against the WoT. If you got an encrypted email from Linus Torvalds, how would you verify it was him? https://news.ycombinator.com/item?id=12296974 https://news.ycombinator.com/item?id=12296974
- gkya 10y ago
  I wouldn't. If I'm going to get an encrypted mail from someone, I've alread verified the sender.

glxxyz 10y ago

With only "2 encrypted emails a year", it's not surprising that the author is giving up. I wonder if he has any real secrets to exchange with anyone else, or if setting up keys and participating in a WoT was really just a hobby.

rgzn 10y ago

This story is political.

andrey_utkin 10y ago

> I never ever ever successfully used the WoT to validate a public key. TOFU, anyone? From: Werner Koch wk at gnupg.org Date: Fri Dec 4 14:06:49 CET 2015 Subject: [Announce] GnuPG 2.1.10 released Hello! The GnuPG team is pleased to announce the availability of a new release of GnuPG modern: Version 2.1.10. The main features of this release are support for TOFU (Trust-On-First-Use) and anonymous key retrieval via Tor. ...

simias 10y ago

I have given up on the "web of trust" a long time ago for most of the reasons the author states. I think in order to work PGP would need to reach a critical mass of users that seems totally out of reach at the moment. Maybe if Google or Facebook starts issuing mandatory PGP keys linked with each account or something like that. Not sure why they'd want to do that though. That being said there's still a lot of good and useful in PGP even if you ignore the WoT completely. I use it to secure my passwords, log into remote servers securely with SSH and I sign all of my emails with it, which is probably useless 99.9% of the time but at least it can be used in retrospect to prove that I did write those messages. I can also use it to sign git tags so that my code can still be trusted even if there's a breach in, say, github. I have a rather vast choice of GnuPG tokens I can purchase if I want an added layer of convenience and (hopefully) security. Sure, WoT is simply unusable currently unless you're communicating mostly with hardcore PGP enthusiasts. That won't be enough to make me give up on PGP.

zobzu 10y ago

it is mainly the tools that are blamed even in this post. nobody wants to make a better sks keyserver or gpg cli. why? because you dont get no fame or money from it. filippo show me your gpg commits.

Drdrdrq 10y ago

Yeah. A friend of mine said it best: "if there is a conflict between convenience and security/privacy/anything else, convenience always wins." PGP didn't stand a chance.

khana 10y ago

The 'deficiency' of PGP lay in the leaky nature of the computer itself. How do you maintain your all important private keys? On disk? In memory? USB? All are leaky from the get go. And this, I posit, is the problem gents.

pfooti 10y ago

So, to distinguish, there's web-of-trust things and general pgp/gpg encryption (and signing) UX. Both of these are pretty abysmal for non-technical users. I don't think "muggle" users would be interested in the web of trust at all, and I doubt they can really handle it all that well. But I'm a pretty technical person (MS in Computer Science, PhD in a different field), and well: http://keyserver.ubuntu.com/pks/lookup?op=vindex&search=eric+eslinger&fingerprint=on http://keyserver.ubuntu.com/pks/lookup?op=vindex&search=eric... I don't think the web of trust really matters- would you look at that and say, "hey, this Eric fellow has a 2004 key for his gmail, and an unrelated 2016 one, I'd better not trust him." Doubtful. Honestly, in today's internet (I know, dangerously political...) I think there should be a stronger move toward broad-spectrum encryption of all emails. I actually generate trust with most of my email correspondents independently, but I sure would like to encrypt my communication. Signal is good for shorter messages, but email is still email. It isn't like I have state secrets in my email, but I do have stuff I don't want random government snoops reading, especially if they're bulk-collecting. Furthermore, I think it's important for more people (even people who don't need it) to encrypt their correspondence, so we can provide cover for people who really do need it. Journalists and dissidents won't stand out as much if everybody is encrypting. To that end, I think pgp / gpg is still pretty cruddy for UX. There are decent solutions for each platform, but nothing really good, and my friends / family aren't likely to use a mail client or webmail that's not at least almost as good as gmail/inbox just because I am worried about privacy. I've recently moved to protonmail for most mail, since it has a very slick user experience and I want to know it well enough to be able to recommend it to other people. However, protonmail doesn't let me have my private key (or its analogue - I'm not 100% sure how things really work, but I have a public key that I can give to other people, and those other people can send me encrypted stuff from off-platform. I just can't reply in the same fashion). That means if I lose my protonmail account, woops, I can't read the emails you sent me encrypted to my @protonmail.com account, even if I get the emails. This is more of A Thing now that you can set up protonmail as your MX, and therefore get emails addressed to domains you control on the platform - if I ever swapped my personal domain around, I'd like to have the key. So, for end-to-end encrypted simple messages, signal is great. I just wish protonmail did interop, and then I'd really recommend it to other people.

joveian 10y ago

Summary: The author decided that being connected to long term keys does more harm than good, partly due to the pressure to stay with potentially compromised keys due to the difficulty of starting over. The author will instead focus on secure IM using short term keys bootstrapped by social media accounts. 1) As others have pointed out, I really think the author is overestimating the effort required to compromise a twitter or other social media account. There are many accounts of this happening, including to people like Brian Krebs who knows he is a target and does everything possible to avoid the attacks. 2) Encrypted IM as the primary higher security communication channel seems to be a popular option these days, mostly leaving those of us who don't like IM to look at alternatives. 3) Briar (briarproject.org) is a promising alternative for messaging, although not ready yet and currently only targeting android, which has its own major security issues. Due to the focus on enabling offline, forward secure messaging, it can be used to defeat mass (network) survailance. It can also be used online and addresses some of the specific concerns raised. 4) General purpose computers are both handy and necessarily have security issues. Special purpose devices for more limited secure communication would help with many issues. 5) Secure communication isn't much of a goal; it is more helpful to consider specific threats. If you do something non-trivial towards a vague goal, it is easy to find a way it doesn't meet that goal when you feel like not doing it any more. I'm not sure what the author was trying to achieve with PGP in the first place.

colejohnson66 10y ago
Kind of off topic: I really like iMessage. Not to be an Apple fanboi, but it really is one of those things where It Just Works(tm). Encryption shouldn't have to be something the end user has to worry about; it should be transparent to the user while still being as secure as possible (HTTPS and TLS are a great example of this). For the user who cares about encryption, they don't have to configure anything. For the user that doesn't care, they still benefit. By baking it into the OS, Apple ensures that anyone with an iDevice benefits from it. Compare that to having to download an app that may change depending on possible compromises. Anyone who's tried to convince a family member to use Signal, Telegram, etc. knows how much of a pain it is.
- 10y ago

technion 10y ago

My ongoing concern is around where reasonable alternatives fit in. - Securedrop, where users upload messages and they are automatically encrypted - Darknet services - Businesses where users communicate via desktops. Signal/ etc works in a different space and doesn't provide an alternative to these.

a3_nm 10y ago

The proposed solution is to use Twitter to use Signal or Whatsapp. This forces your correspondents to use one of these centralized services, and also to run proprietary software to be able to use them. I'm also irritated by GPG and OpenPGP's shortcomings, but it still gives people a way to contact you with reasonable security and without having to use specific proprietary services.

danielweber 10y ago

Years ago I worked with a guy who literally wrote a book about how to use PGP. I asked him if he could help me set it up and he said "I don't use it, it's too hard."

3131s 10y ago
It's not too hard, at least not on Linux and for anyone with some familiarity with the terminal. Getting started can be done like this... Install GPG: sudo apt-get install gnupg Generate a key: gpg --gen-key Export your public key as ASCII text and then post it somewhere publicly: gpg --armor --export $your_uid > your_public_key.gpg Import my public key: gpg --import my_public_key.gpg Verify my key by viewing my fingerprint (type fpr) and confirming it with me, then sign it (type sign): gpg --edit-key $my_uid Encrypt the file message.txt and then send message.gpg to me via any medium: gpg --output message.gpg --encrypt --recipient $my_uid message.txt Decrypt my response to you: gpg --output response.txt --decrypt response.gpg I know that's pretty complicated for an average user, but it's not harder than any of the day to day work that we do as programmers. I have not used GPG in years though since my deep web adventures, so hopefully I didn't mess anything up and prove the point that GPG is too hard!

fbis251 10y ago

Who here is using keybase to manage your public key being distributed? It seems like a great idea since your key is tied to your online identity

elahd 10y ago
Keybase is great for managing my keys, but I haven't found any services that make it easy to natively use them. They've sat unused for the ~2 years I've had a Keybase account. That said, I have about 25 invitations. Anyone want one? Edit: Not true. I used my keys once to sign a GitHub release for a novelty project nobody uses.

theszak 10y ago

?What experiences have folks with ZixMail https://www.zixcorp.com/why-zix/email-encryption https://www.zixcorp.com/why-zix/email-encryption

ubernostrum 10y ago

Encryption is a political topic. Get it off HN.

deleted 10y ago

[deleted]

blunte 10y ago

The #1 problem, beyond the usability issues, is that most users still just do not care. They are willfully ignorant (a mentality which is actively celebrated these days in some influential countries), and cannot be convinced in the value of privacy or security. I have tried without much success to get people to move to ProtonMail. I have tried without much success to get people to move to Wire messenger. (And incidentally, the author mentions Signal and WhatsApp... I wonder why he doesn't use Wire?) So without consumers who care, the only audience for PGP and other security focused tools are the geeks who too easily tolerate bad interfaces.

cdevs 10y ago

Never heard of yubikeys, pretty cool. Thanks.

torrent-of-ions 10y ago

Why is WhatsApp trusted? Isn't it proprietary and controlled by Zuckerberg? What am I missing here?

ergot 10y ago

"One click encryption is one click too many" - Bruce Schneier

stefek99 10y ago

I gave up 3 years ago: http://blog.mostlydoing.com/2014/03/how-to-securely-store-private-keys.html http://blog.mostlydoing.com/2014/03/how-to-securely-store-pr... (I don't trust myself to securely store my private keys)