5 ms·

So for those us that need to run Windows/OSX to run software, like Photoshop, for our job, we should just give up on PGP? Seems like a supporting argument for t

So for those us that need to run Windows/OSX to run software, like Photoshop, for our job, we should just give up on PGP? Seems like a supporting argument for the article then.

verytrivial 10y ago
Your argument comes down to the threat model. A journalist whom also uses Photoshop is free to use whatever system they have sufficient trust in for the nature of the communication at hand. If they're likely to be killed because someone reads the content of their messages, they should easily be able to weigh that cost against needing to boot of USB every now and again. So that said, if you use crypto-system X on a machine you cannot trust, crypt-system X will not be able to protect you very much.
- nemothekid 10y ago
  I understand the threat model. However that notion implies that those of us who aren't at risk of death over our emails should give up PGP. Given that (I assume) most of us aren't at risk of murder by the nation-state, PGP is dead. I would prefer a solution where everyone could reasonably get end-to-end encrypted emails. Unfortunately, given the unfitness of PGP for this goal, coupled with recent work in the space, it looks like we will either get plaintext over decentrailzed email, or e2ee inside walled gardens.
  - verytrivial 10y ago
    There is nothing stopping you from having more than one identity. If you don't mind too much if malware has your PGP details, then all good. If you would like a more way to securely store these details for other sorts of communication, perhaps a different machine, a live-CD or hardware token[1][2] can be justified. I think it is also worth remembering that even the most liberal western democracies have laws that one way or another prevent people from keeping secrets from the law. If everyone has it, and uses it, and it cannot be back-doored, it will be banned rather quickly IMHO. And the people who don't care about privacy -- i.e. most everyone -- won't care about crypto being banned either after the right wing press is done with them. (Restated: we shouldn't force people to close their curtains any more than we force them to open them). I'm rambling, sorry. Both of these might also work with your phone via NFC. [1] https://www.fidesmo.com/ https://www.fidesmo.com/ [2] https://www.yubico.com/products/yubikey-hardware/yubikey-neo/ https://www.yubico.com/products/yubikey-hardware/yubikey-neo...
TallGuyShort 10y ago
You don't have to run exclusively on any operating system. You can use multiple operating systems for different parts of your job, and there's a whole spectrum of convenience / security for how to go between the two that you can choose from.
Bartweiss 10y ago
Traditionally, you should have a second cheap machine running Tails, and do your email through PGP there. The idea isn't that PGP is compromised on a Windows box with outside software, it's that everything is compromised on that box. Changing algorithm or app doesn't matter if your hardware might be recording every key stroke and sending it through a side channel.
- 1001101 10y ago
  As another example, take the newer remote management "features" included in modern BIOSes that run on a separate microcontroller in the system and allow access to network, memory, peripherals, etc., even if the computer is shut down (but still on mains). Let's imagine someone had an exploit or the keys for that. With that hole, you could never fully lock down. Sneakernet over a wide airgap is a good policy.
  - Bartweiss 10y ago
    Ugh, yep. I totally forgot about how many machines come with entire parallel communication systems. The Intel Management Engine, for example, is horrific. It's a machine-compromising threat built into the CPU and (as far as I know) totally unremovable. I haven't heard about any kind of compromise, but it's far from impossible. Well-meant, sure (why make two production runs at higher expense), but that's not very comforting. We already know the US government intercepts some machines in transit; silently enabling and owning the IME would be an elegant way to beat a physical inspection on delivery. It's only reasonable to assume China and similar players do the same. (If the IME is disabled, will the CPU still complain if you physically destroy the thing? Does anyone know?) There's also the rather nasty proof-of-concept attack where air-gapped machines output audio data at ultrasonic frequencies to beat the gap. Sure, it takes initial compromise to activate, but that's a plausible risk for someone running nation-state defense. Sneakernet continues to be a solid policy. I don't remember who, but some notable security researcher talking about Lulzsec summarized the issue with "If I were crossing a government, my opsec would be a stolen library card in a city I don't live in."
    - 10y ago
Nadya 10y ago
Tails can boot from USB. You don't need to not use Windows/OSX, you just need to boot into Tails prior to using PGP. Is it inconvenient? Yes. Almost all privacy/security is. Security is largely a series of tradeoffs between privacy and convenience. The more privacy and security you desire - the less convenient everything is going to be. Burner phones, faraday cages, encrypted harddrives, using cash/bitcoins (which should be purchased with cash), using a VPN over Tor (and not Tor over a VPN). Making sure any phone calls from different locations with none being near work/home, that the call is kept very short and preferably with a short and precise coded language. Cycling your PGP key frequently, and scheduling all electronic communications as to not give any hint of any "active hours". All of those are inconvenient, but necessary, if privacy and security are desired.
derefr 10y ago
No, you just keep your work computer separate from your whistleblowing/terrorism computer. Productivity and secure+anonymous communications have different needs, and an air-gap between them is pretty much the only way to achieve both. Luckily, in the modern world, owning a second single-purpose device is really easy: your secure+anonymous communications can be done on a rooted Android phone or a Tails-reformatted Chromebook for ~$150.
theon144 10y ago
Those of you that need (outdated) proprietary software should just give up on security to begin with, PGP or no PGP. >if you can get root on the client device, you own everything. No security model will protect you from a compromised system.
- PhasmaFelis 10y ago
  > Those of you that need (outdated) proprietary software I'm not clear how Photoshop is "outdated", unless you're trying to make some convoluted dig about proprietary software being obsolete as a concept. > should just give up on security to begin with, PGP or no PGP. This kind of smug dismissal of the average user's needs and abilities is exactly why Linux on the desktop never took off.
  - theon144 10y ago
    >I'm not clear how Photoshop is "outdated", unless you're trying to make some convoluted dig about proprietary software being obsolete as a concept. Outdated software was mentioned earlier in the thread. >This kind of smug dismissal of the average user's needs and abilities is exactly why Linux on the desktop never took off. Irrelevant :) Besides, it's not a matter of dismissal, smug or not, but just basic systems theory. Read up.
ori_b 10y ago
> So for those us that need to run Windows/OSX to run software, like Photoshop, for our job, we should just give up on PGP? Seems like a supporting argument for the article then. If you're paranoid, run that stuff in a VM. If you're really paranoid, run it on a separate machine.

So for those us that need to run Windows/OSX to run software, like Photoshop, for our job, we should just give up on PGP? Seems like a supporting argument for the article then.

verytrivial 10y ago

Your argument comes down to the threat model. A journalist whom also uses Photoshop is free to use whatever system they have sufficient trust in for the nature of the communication at hand. If they're likely to be killed because someone reads the content of their messages, they should easily be able to weigh that cost against needing to boot of USB every now and again. So that said, if you use crypto-system X on a machine you cannot trust, crypt-system X will not be able to protect you very much.

nemothekid 10y ago
I understand the threat model. However that notion implies that those of us who aren't at risk of death over our emails should give up PGP. Given that (I assume) most of us aren't at risk of murder by the nation-state, PGP is dead. I would prefer a solution where everyone could reasonably get end-to-end encrypted emails. Unfortunately, given the unfitness of PGP for this goal, coupled with recent work in the space, it looks like we will either get plaintext over decentrailzed email, or e2ee inside walled gardens.
- verytrivial 10y ago
  There is nothing stopping you from having more than one identity. If you don't mind too much if malware has your PGP details, then all good. If you would like a more way to securely store these details for other sorts of communication, perhaps a different machine, a live-CD or hardware token[1][2] can be justified. I think it is also worth remembering that even the most liberal western democracies have laws that one way or another prevent people from keeping secrets from the law. If everyone has it, and uses it, and it cannot be back-doored, it will be banned rather quickly IMHO. And the people who don't care about privacy -- i.e. most everyone -- won't care about crypto being banned either after the right wing press is done with them. (Restated: we shouldn't force people to close their curtains any more than we force them to open them). I'm rambling, sorry. Both of these might also work with your phone via NFC. [1] https://www.fidesmo.com/ https://www.fidesmo.com/ [2] https://www.yubico.com/products/yubikey-hardware/yubikey-neo/ https://www.yubico.com/products/yubikey-hardware/yubikey-neo...

TallGuyShort 10y ago

You don't have to run exclusively on any operating system. You can use multiple operating systems for different parts of your job, and there's a whole spectrum of convenience / security for how to go between the two that you can choose from.

Bartweiss 10y ago

Traditionally, you should have a second cheap machine running Tails, and do your email through PGP there. The idea isn't that PGP is compromised on a Windows box with outside software, it's that everything is compromised on that box. Changing algorithm or app doesn't matter if your hardware might be recording every key stroke and sending it through a side channel.

1001101 10y ago
As another example, take the newer remote management "features" included in modern BIOSes that run on a separate microcontroller in the system and allow access to network, memory, peripherals, etc., even if the computer is shut down (but still on mains). Let's imagine someone had an exploit or the keys for that. With that hole, you could never fully lock down. Sneakernet over a wide airgap is a good policy.
- Bartweiss 10y ago
  Ugh, yep. I totally forgot about how many machines come with entire parallel communication systems. The Intel Management Engine, for example, is horrific. It's a machine-compromising threat built into the CPU and (as far as I know) totally unremovable. I haven't heard about any kind of compromise, but it's far from impossible. Well-meant, sure (why make two production runs at higher expense), but that's not very comforting. We already know the US government intercepts some machines in transit; silently enabling and owning the IME would be an elegant way to beat a physical inspection on delivery. It's only reasonable to assume China and similar players do the same. (If the IME is disabled, will the CPU still complain if you physically destroy the thing? Does anyone know?) There's also the rather nasty proof-of-concept attack where air-gapped machines output audio data at ultrasonic frequencies to beat the gap. Sure, it takes initial compromise to activate, but that's a plausible risk for someone running nation-state defense. Sneakernet continues to be a solid policy. I don't remember who, but some notable security researcher talking about Lulzsec summarized the issue with "If I were crossing a government, my opsec would be a stolen library card in a city I don't live in."
  - 10y ago

Nadya 10y ago

Tails can boot from USB. You don't need to not use Windows/OSX, you just need to boot into Tails prior to using PGP. Is it inconvenient? Yes. Almost all privacy/security is. Security is largely a series of tradeoffs between privacy and convenience. The more privacy and security you desire - the less convenient everything is going to be. Burner phones, faraday cages, encrypted harddrives, using cash/bitcoins (which should be purchased with cash), using a VPN over Tor (and not Tor over a VPN). Making sure any phone calls from different locations with none being near work/home, that the call is kept very short and preferably with a short and precise coded language. Cycling your PGP key frequently, and scheduling all electronic communications as to not give any hint of any "active hours". All of those are inconvenient, but necessary, if privacy and security are desired.

derefr 10y ago

No, you just keep your work computer separate from your whistleblowing/terrorism computer. Productivity and secure+anonymous communications have different needs, and an air-gap between them is pretty much the only way to achieve both. Luckily, in the modern world, owning a second single-purpose device is really easy: your secure+anonymous communications can be done on a rooted Android phone or a Tails-reformatted Chromebook for ~$150.

theon144 10y ago

Those of you that need (outdated) proprietary software should just give up on security to begin with, PGP or no PGP. >if you can get root on the client device, you own everything. No security model will protect you from a compromised system.

PhasmaFelis 10y ago
> Those of you that need (outdated) proprietary software I'm not clear how Photoshop is "outdated", unless you're trying to make some convoluted dig about proprietary software being obsolete as a concept. > should just give up on security to begin with, PGP or no PGP. This kind of smug dismissal of the average user's needs and abilities is exactly why Linux on the desktop never took off.
- theon144 10y ago
  >I'm not clear how Photoshop is "outdated", unless you're trying to make some convoluted dig about proprietary software being obsolete as a concept. Outdated software was mentioned earlier in the thread. >This kind of smug dismissal of the average user's needs and abilities is exactly why Linux on the desktop never took off. Irrelevant :) Besides, it's not a matter of dismissal, smug or not, but just basic systems theory. Read up.

ori_b 10y ago

> So for those us that need to run Windows/OSX to run software, like Photoshop, for our job, we should just give up on PGP? Seems like a supporting argument for the article then. If you're paranoid, run that stuff in a VM. If you're really paranoid, run it on a separate machine.