5 ms·

> 99% of the PGP-encrypted emails we get to security@golang.org are bogus security reports. Whereas “cleartext” security reports are only about 5-10% bogus. Th

> 99% of the PGP-encrypted emails we get to security@golang.org are bogus security reports. Whereas “cleartext” security reports are only about 5-10% bogus. That seems odd. I wonder why it's like that?

w8rbt 10y ago
Super Crypto Nerd Man - Here to save the day!!!
winstonewert 10y ago
First guess: people with a high degree of paranoia tend to both think it worthwhile to encrypt their e-mails and incorrectly diagnose security problems where non exist.
vertex-four 10y ago
Honestly, most people I've met with a serious interest in security wind up using some combination of Signal, XMPP OTR, IRC, and unencrypted email to communicate - it wouldn't surprise me that most of GPG's userbase is made up of hobbyist security types with little understanding of what they're doing.
- sigjuice 10y ago
  The golang project says "send PGP encrypted email if you like" right here https://golang.org/security https://golang.org/security Why should people be ridiculed for sending PGP encrypted email then?
  - justin66 10y ago
    If it's accurate that 99% of their reports are bogus, that's a pretty decent reason to dish out a little ridicule.
  - falcolas 10y ago
    I don't think they should, especially since sending and receiving PGP encrypted emails is easy when you use a non-web mail client. IMO, it's ultimately a problem with Gmail - which makes integration with PGP hard - and not a problem with PGP emails itself. If I use Thunderbird, or even Mail.app, integrating PGP is as easy as installing a plugin, after which sending or receiving a PGP encrypted email requires a minimum of additional effort (once you have a key in your keyring, it's encrypted by default). If Gmail made PGP integration easy, there would be no extra time wasted when viewing PGP encrypted emails. The validity signaling would even remain the same, but without the "this is hard for me so don't do it, even though we invite you to do it" idiocy.
djsumdog 10y ago
Because you can't easily run them through a spam filter (without unlocking the PGP key for the spam filter or having the passphrase in plain text somewhere). Spam is such a huge problem that most spam filters have gotten terribly over aggressive. Even with proper SPF and DKIM records, Google/Microsoft will ignore/silently drop most mail coming from small personally run e-mail servers: http://penguindreams.org/blog/how-google-and-microsoft-made-email-unreliable/ http://penguindreams.org/blog/how-google-and-microsoft-made-...
- c2h5oh 10y ago
  This is largely a myth. I've run a pair of email servers - one small (maybe 250 outgoing emails/week) and one larger (80-100k/week) from 2007 to late 2016 and had no problems with deliverability. It's just there are way more factors than SPF & DKIM: - static IPs that remain the same for years (no cloud) - IPs not in questionable subnets (no cloud) - forward-confirmed A DNS records for all sending servers - a valid SSL cert on MX servers (anecdotal evidence here) - never rapidly increase email volume. +50% day over day and +100% week over week is safe - rate limit outgoing email by recipients server/domain
  - djsumdog 10y ago
    I think my biggest problems include limited e-mail output (<10 week really, because it's just me) and I'm currently on Linode; most likely on a spammy subnet. I do have static IPs for IPv4 and IPv6. Every spam analysis tool I've thrown at it says all my records are valid. My TLS cert is valid (paid for, but going to move to Lets Encrypt when it expires). I'm planning on moving to another hosting service like Vultr. They do require individuals apply to host e-mail servers (an unblock the SMTP port) so maybe I'll have better luck there.
    - c2h5oh 10y ago
      Avoid cloud & cloud-like/mostly-vps providers. While they will most likely not have entire IP blocks straight blacklisted there might be a rule that just brings you closer to the spam score threshold. Oddly enough medium-large enterprise is more likely to include those rules - I've recently seen 20% bounce rate on a large mailing list spanning some 300 companies with most of the bounces being due to AWS IP blocks being blacklisted. That's why using Sparkpost for that kind of recipients is a bad idea (all their sending servers are on AWS). Going back to hosting - pick a company that: - lets you set PTR records for your IPs - lets you get your own IP block and assign it however you want (even it is just a tiny one) - offers primarily dedicated servers/collocation - even if their vps is going to be a bit more expensive
Ar-Curunir 10y ago
Most cryptographers/security researchers don't use cryptographic tools, from the sample I've seen as a crypto researcher.
emmelaich 10y ago
That was addressed in the original discussion. It's good reading: https://news.ycombinator.com/item?id=14122278 https://news.ycombinator.com/item?id=14122278

w8rbt 10y ago

Super Crypto Nerd Man - Here to save the day!!!

winstonewert 10y ago

First guess: people with a high degree of paranoia tend to both think it worthwhile to encrypt their e-mails and incorrectly diagnose security problems where non exist.

vertex-four 10y ago

Honestly, most people I've met with a serious interest in security wind up using some combination of Signal, XMPP OTR, IRC, and unencrypted email to communicate - it wouldn't surprise me that most of GPG's userbase is made up of hobbyist security types with little understanding of what they're doing.

sigjuice 10y ago
The golang project says "send PGP encrypted email if you like" right here https://golang.org/security https://golang.org/security Why should people be ridiculed for sending PGP encrypted email then?
- justin66 10y ago
  If it's accurate that 99% of their reports are bogus, that's a pretty decent reason to dish out a little ridicule.
- falcolas 10y ago
  I don't think they should, especially since sending and receiving PGP encrypted emails is easy when you use a non-web mail client. IMO, it's ultimately a problem with Gmail - which makes integration with PGP hard - and not a problem with PGP emails itself. If I use Thunderbird, or even Mail.app, integrating PGP is as easy as installing a plugin, after which sending or receiving a PGP encrypted email requires a minimum of additional effort (once you have a key in your keyring, it's encrypted by default). If Gmail made PGP integration easy, there would be no extra time wasted when viewing PGP encrypted emails. The validity signaling would even remain the same, but without the "this is hard for me so don't do it, even though we invite you to do it" idiocy.

djsumdog 10y ago

Because you can't easily run them through a spam filter (without unlocking the PGP key for the spam filter or having the passphrase in plain text somewhere). Spam is such a huge problem that most spam filters have gotten terribly over aggressive. Even with proper SPF and DKIM records, Google/Microsoft will ignore/silently drop most mail coming from small personally run e-mail servers: http://penguindreams.org/blog/how-google-and-microsoft-made-email-unreliable/ http://penguindreams.org/blog/how-google-and-microsoft-made-...

c2h5oh 10y ago
This is largely a myth. I've run a pair of email servers - one small (maybe 250 outgoing emails/week) and one larger (80-100k/week) from 2007 to late 2016 and had no problems with deliverability. It's just there are way more factors than SPF & DKIM: - static IPs that remain the same for years (no cloud) - IPs not in questionable subnets (no cloud) - forward-confirmed A DNS records for all sending servers - a valid SSL cert on MX servers (anecdotal evidence here) - never rapidly increase email volume. +50% day over day and +100% week over week is safe - rate limit outgoing email by recipients server/domain
- djsumdog 10y ago
  I think my biggest problems include limited e-mail output (<10 week really, because it's just me) and I'm currently on Linode; most likely on a spammy subnet. I do have static IPs for IPv4 and IPv6. Every spam analysis tool I've thrown at it says all my records are valid. My TLS cert is valid (paid for, but going to move to Lets Encrypt when it expires). I'm planning on moving to another hosting service like Vultr. They do require individuals apply to host e-mail servers (an unblock the SMTP port) so maybe I'll have better luck there.
  - c2h5oh 10y ago
    Avoid cloud & cloud-like/mostly-vps providers. While they will most likely not have entire IP blocks straight blacklisted there might be a rule that just brings you closer to the spam score threshold. Oddly enough medium-large enterprise is more likely to include those rules - I've recently seen 20% bounce rate on a large mailing list spanning some 300 companies with most of the bounces being due to AWS IP blocks being blacklisted. That's why using Sparkpost for that kind of recipients is a bad idea (all their sending servers are on AWS). Going back to hosting - pick a company that: - lets you set PTR records for your IPs - lets you get your own IP block and assign it however you want (even it is just a tiny one) - offers primarily dedicated servers/collocation - even if their vps is going to be a bit more expensive

Ar-Curunir 10y ago

Most cryptographers/security researchers don't use cryptographic tools, from the sample I've seen as a crypto researcher.

emmelaich 10y ago

That was addressed in the original discussion. It's good reading: https://news.ycombinator.com/item?id=14122278 https://news.ycombinator.com/item?id=14122278