8 ms·

> The emerging consensus among experts "conseunsus"? a few blog posts about some bad user experience with GnuPG / the PGP ecosystem is, at best, just an (re)em

• lallysingh 10y ago
  The hardest problem, IMHO, has been key management. How do you get+trust the other's key? I think a combination of keybase + a useful client can help, but the reasons listed in parent are pretty convincing.
  • Sunset 10y ago
    >How do you get+trust the other's key? Snail mail + several other out of band methods. Or you can exchange a one time pad, physically.
    • cvwright 10y ago
      This also raises the question: With a walled garden like Signal/Wire/etc, how do you get+trust the other's key? Their convenience comes at a cost.
      • maxerickson 10y ago
        There are mechanisms to use out of band communication to verify a key: https://github.com/WhisperSystems/Signal-iOS/wiki/FAQ#can-i-verify-the-safety-number https://github.com/WhisperSystems/Signal-iOS/wiki/FAQ#can-i-... https://support.wire.com/hc/en-us/articles/207692235-How-can-I-compare-key-fingerprints- https://support.wire.com/hc/en-us/articles/207692235-How-can...
        • cvwright 10y ago
          Yup, and I've done these. But you can do similar things with PGP public keys, too.
          • maxerickson 10y ago
            I don't understand. You've verified a Signal key but still felt the need to ask the question With a walled garden like Signal/Wire/etc, how do you get+trust the other's key? What cost were you talking about then?
            • cvwright 10y ago
              Sorry if my earlier comment came off as rude. I was just trying to say that the walled gardens aren't really that much better than plain old PGP, and in practice they tend to lull people into a false sense of security. I think too many people are way too trusting of shiny new apps with a pretty UI. If you don't do the extra work of verifying the key, you're effectively letting the service provider act as your one and only CA. If you can verify a Signal key fingerprint, you can verify a PGP public key fingerprint.
              • maxerickson 10y ago
                I didn't think it was rude, it just contradicted your other comment. I still don't see what cost you were speaking about. Mistakes with PGP are at least as likely as mistakes with the shiny easy to use GUI.
      • 10y ago
  • mikegerwitz 10y ago
    If you care about the physical identity of someone: web of trust. At some point, you'll have to ideally meet at least one person in the flesh to exchange keys and verify their identity. After that point, it's possible that others you are trying to communicate with might be within your web of trust. If not, you'll have to go through your keysigning procedure again. https://www.gnupg.org/gph/en/manual/x334.html Some organizations facilitate keysigning: https://wiki.debian.org/Keysigning/Coordination But that might not be necessary for you. For example, I don't necessarily care about the physical identity for some of the people I communicate with online. If I see in e-mail archives that person is using the same key to sign their mail for the past N years, I'll use that key to encrypt to them. Similarly with commit signing and such. In that case, I just care that my message is reaching the intended recipient. I communicate with a number of GNU hackers. Package maintainers upload their signing keys to Savannah, and sign each of their releases with that key. If I simply want to know that my message is reaching that maintainer, I can get the key that way. But if I want to know that I'm actually speaking to the person that the maintainer _claims_ to be, I'd want to use the web of trust. They could very well be an imposter!
    • zeveb 10y ago
      > After that point, it's possible that others you are trying to communicate with might be within your web of trust. The problem with the web of trust is that it simply doesn't work: the fact that I know you means nothing about whether I trust you to vouch for others. The fact that I trust you to vouch for employees of Acme Widgets means nothing about whether I trust you to vouch for members of the a political party. PGP's usable despite the fact that the Web of Trust is kinda a misfeature.
      • coldtea 10y ago
        >The problem with the web of trust is that it simply doesn't work: the fact that I know you means nothing about whether I trust you to vouch for others. Actually it means a lot. That's how trust works in the real world as well.
        • 10y ago
  • dredmorbius 10y ago
    TOFU works within a number of contexts. Though not all. Generally, out-of-band or reference-based (e.g., third-party vouching) of identity. Web-of-trust is useful but IMO ultimately a tool of limited use, and presents numerous issues with data disclosure, as it is an independent and public validation of social networks. Often who knows who is more critical than who says what to whom. PGP-over-email unfortunately leaks massive amounts of metadata.
• m3rc 10y ago
  There are federated options for messengers, the fact that the current darlings aren't is not a mark against the option itself. Riot exists. Can you find a security expert RECOMMENDING email? That would be a better example of how it's not a consensus, like you claim.
  • darfs 10y ago
    For those(like me) who are looking for the famous reference Implementation Vector, it got a rename[0] to Riot[1] lately. [0]Rename: https://medium.com/@RiotChat/lets-riot-f5b0aa99dc8e#.3toozs7r6 https://medium.com/@RiotChat/lets-riot-f5b0aa99dc8e#.3toozs7... Homepage: https://matrix.org/docs/projects/client/riot.html https://matrix.org/docs/projects/client/riot.html
  • anigbrowl 10y ago
    Riot might be a great platform for doing business, but it's pretty useless for any other kind of activity. If you're a political activist having an app called 'Riot' on your phone or computer is not going to look good to anyone in law enforcement.
    • Arathorn 10y ago
      well, it's FOSS; someone could maintain a fork with a less controversial name (I hear 'vector' is up for grabs O:-)
    • dtornabene 10y ago
      "having an app called riot" is the absolute least of an actual activists concern when selecting something to help them communicate. One of the most well known leftist platforms for email is riseup.
      • anigbrowl 10y ago
        I'm aware of that, and I think flagging yourself by choosing such a branded platform is the height of stupidity. Maybe my social circles are just more privacy-oriented.
• losvedir 10y ago
  > "consensus"? a few blog posts about some bad user experience with GnuPG / the PGP ecosystem is, at best, just an (re)emerging topic on HN, not the end of email encryption. Well, tptacek is himself an expert. As he's the founder of a successful security consultancy who has friends among academic cryptographers, I took his comment to mean the belief among himself and his peers. It's ultimately an appeal to authority, but it's a useful data point. Maybe there are different "circles" of security/cryptography experts, and tptacek runs in a different one from others who haven't given up on email, but I suspect he would have said that if that's the case.
  • milesrout 10y ago
    >As he's the founder of a successful security consultancy who has friends among academic cryptographers, I took his comment to mean the belief among himself and his peers. Security consultants are who you should trust the least when dealing with security. They aren't interested in reliable, easy-to-use and widespread security. They are interested in difficult, interesting security that breaks and needs consultants.
    • grzm 10y ago
      And all developers purposefully write spaghetti code while sysadmins hide passwords and secret configurations, all for job security. Do you truly believe everyone is so cynical? Of course there are some bad actors, in all jobs and all domains. But not everyone—I'd argue the majority of people—are just out to screw everyone else.
    • andrewflnr 10y ago
      Security consultants don't need to engage in sabotage to keep job security. User incompetence is adequate.
    • cpach 10y ago
      Let’s say that what you wrote holds true. Who should we trust then, when it comes to security advice?
• EGreg 10y ago
  Why use PGP anymore when you can use Keybase and the next generation of key management? Instead of having one master key for your identity, the paradigm is changed: Identity is a set of claims "X on domain A is Y on domain B". That's it. "Domain" can refer to a server-based service such as reddit, or a client app on a device. Such proofs are easy: 1) For public identity on sites which don't support this scheme, X simply signs something with their private key for A, and posts it on A at a URL only they control (such as an About page or a Facebook post). Presumably, X and A had to cooperate to do that. Now, to prove "you are X on A", you simply claim your your identity and the url to check, and sign it with the same private key. The verification proceeds by checking the https url for the actual claim. You hold that key. If A wants to revoke your identity proof, they just delete it from eg your profile. Each site A has to be supported individually by the client lib though, because "urls you control" are different on each site. 2) For private identity on sites that cooperate, there is a huge variety of things you could do. Everything from oAuth 2, to the signature scheme above, except the user id X on A can be different for each relying party B. So the claim "X[B] on A is Y on B" is a private claim - others can verify it only if they identify themselves as B (eg X must be logged into A and using https on A and B and doing cross-domain communication using iframes). They can't satisfy these conditions unless they spoof B's SSL certificate and trick X into visiting their site via a poisoned DNS. And in that case they can just find out that X is X[B] on A. Very limited privacy leak. They still can't decrypt or sign anything as X on A. This is the scheme anyone can implement and use. It should be standardized IMHO somewhere.
  • hdhzy 10y ago
    There is an RFC extension for OpenPGP that does just that: https://tools.ietf.org/html/draft-vb-openpgp-linked-ids-00 https://tools.ietf.org/html/draft-vb-openpgp-linked-ids-00 It's implemented in Android OpenKeychain.
  • rch 10y ago
    Planned to say this as well. The Keybase model is working well for me, and there's nothing special about that network: similarly implemented alternatives could probably strengthen one another.
  • 10y ago
• anigbrowl 10y ago
  You know, I've been having this conversation ever since PGP first came into existence. And much as I love the idea of encryption, and despite having invested lots of time in arguing for the right to encrypt and to share encryption algorithms etc. etc. I've always had to admit that if you're not a geek who loves computing for its own sake then encrypting all your email is a massive pain in the ass, whose costs substantially exceed the benefits for most people. Given that this argument has been going on for 20 years and that hardly anyone encrypts their emails on a daily basis, I'd say that the empirical evidence is that your solution, while clever, is Not Good because it doesn't meet people's actual needs. Stop telling me why you like it and build something that's easy for other people to use. In your pursuit of technical excellence you are completely ignoring the importance of network effects on adoption and the disutility of standing out from the crowd by your use of super-solid encryption. Nobody wants to maintain a collection of public keys for every single person they know. No matter how bad things get politically there is not going to be a sudden mass awakening that will cause everyone to start using public key encryption for email, or we'd have already seen it take off like wildfire in politically repressive jurisdictions. It's. Not. Going. To. Happen.
  • macrael 10y ago
    The fact that Osama Bin Laden didn't use PGP should be the final nail in its coffin.
    • nickpsecurity 10y ago
      That the NSA said GPG was gsme over for mass collection in the Snowden lesks should be a reason for everyone to try to improve its UI.
      • dtornabene 10y ago
        thats a pretty terrible argument. And how it follows for your own logic is beyond me.
        • nickpsecurity 10y ago
• crispinb 10y ago
  I've been using email since 1992 in a huge variety of work, study and personal contexts. I installed PGP now and then in the '90's out of curiosity but never sent a single encrypted email as I never came across any recipients with it installed. I have never had anyone request email encryption. I don't know what the expert consensus is. But the user consensus is that PGP is invisible, and will never be used outside of a few tiny niches.
• drdeadringer 10y ago
  Whilst you focus on "consensus" as the key word, I focused on "emerging" as the key word. Perhaps "a few blog posts" is where this consensus is emerging.