5 ms·
When will people start using plain old PGP — a tool that does one thing only, and does it right? Sure, it's a little harder than using just one tool that handl
by JasonFruit 8y ago
When will people start using plain old PGP — a tool that does one thing only, and does it right? Sure, it's a little harder than using just one tool that handles contacts, communication, formatting, and encryption, while making popcorn and walking the dog, but it works, and it's secure if you use it right.
Our efforts to make encryption easy are going to get someone killed.
- roywiggins 8y agoliterally this week https://news.ycombinator.com/item?id=17064129 https://news.ycombinator.com/item?id=17064129
- JasonFruit 8y agoLiterally not PGP, but clients built around it to make encrypted email easy. Read the article you linked. EDIT: typo.
- roywiggins 8y agoIt relies on several features of PGP that mean that messages aren't tamper-proof. If PGP made sure messages replayed and altered by attackers would not decrypt, then the attacks wouldn't work- you couldn't replay an email back to someone to steal it. It relies on a client having an HTML renderer, but the underlying issue is messages that can be tampered with.
- JasonFruit 8y agoIt also relies on clients misusing an API call. And then passing the result to a full HTML viewer that can access the internet. So, again, not an exploit if you use plain PGP.
- 0xCMP 8y agoAh, so don't use the now secured opensource client using Signal's protocol. We should use PGP with all the weak yet-to-be-patched clients. Cause it's not PGP which got hacked it was the client. Very different from how the Signal client got hacked not their protocol. /s
- JasonFruit 8y agoNo, I'm saying use just PGP - manually - and don't use any client interface to it. Control the encryption yourself. Your sarcasm is misplaced.
- twr 8y agoGiven the absent security of desktop Linux, and the dreadful opsec of its users, as revealed by many cryptocurrency wallet thefts, I wouldn't place much trust in persistent PGP secrecy unless all participants used Heads, and renewed keys regularly, and ran nothing except gpg. How many people do that, in the entire world, do you think? A hundred, at best?
- 0xCMP 8y agoIf I accept that using PGP manually is acceptable for getting wide-spread encryption then you're right, but the fact is that tech people rarely use it because it's so cumbersome that the chance of normal users using it successfully, let alone using the terminal these days, is so slim that it's basically absurd to think that is the way we're gonna get wide spread encryption. I don't want to only talk to my tech friends. My best friend runs a small business doing nothing to do with tech and when I talk to him I want to be sure no one else can read/listen to what we're saying because it's private. There is no version where my friend learns to properly use PGP consistently so we can talk that way. The only reasonable way is WhatsApp or Signal.
- 4ad 8y agoThe PGP vulnerability is actually in e-mail clients, and it affects almost nobody. And how often do PGP vulnerabilities happen? Signal got two vulnerabilities that affect everyone JUST THIS WEEK.
- tptacek 8y agoBy "almost nobody", you mean everyone who used Apple Mail/GPGTools and Thunderbird/Enigma, meaning, the vast majority of everybody who used PGP?
- pera 8y agoAre GPGMail and Enigmail really more popular than other extensions/clients? genuinely asking since I am not aware of any study on PGP usage.
- 4ad 8y agoThunderbird does not download remote content by default. I don't know anybody who is using Apple Mail with GPG, but if there are such people, they have been doing it very wrong regardless of this vulnerability. It's an unsafe combination. I have no statistics on what people use PGP with, but asserting that most people use it with Apple Mail and Thunderbird is baseless and without proof.
- pfg 8y ago> Thunderbird does not download remote content by default. The researchers behind EFAIL found a number of ways to bypass the remote content setting. Not only that, but Hanno Böck found another one today[1] that hasn't been fixed yet. [1]: https://twitter.com/hanno/status/997138771194859521 https://twitter.com/hanno/status/997138771194859521
- girvo 8y agoWhy would Apple Mail and PGP be a unsafe combination by default?
- AnaniasAnanas 8y ago
- kasey_junk 8y agoIf you can find 3 crypto engineers who aren’t PGP maintainers that agree with this I might start using PGP for secure comms.
- rixrax 8y agoSurely this is sarcasm. Just in case it isn't, it's only fitting to link back to what Moxie Marlinspike wrote about PGP/GPG: https://moxie.org/blog/gpg-and-me/ https://moxie.org/blog/gpg-and-me/ (HN commentary: https://news.ycombinator.com/item?id=9104188 https://news.ycombinator.com/item?id=9104188 ). TL;DR: When will people start using gpg: they won't.
- Ar-Curunir 8y agoI don't know anyone who uses PGP/GPG to communicate securely, and I'm a cryptographer!
- geofft 8y ago> a tool that does one thing only, and does it right? It does multiple things (signing messages, encrypting messages, signing and encrypting messages, signing other people's keys, publishing keys, downloading keys, finding trust paths between keys, publishing your contact list to the world, publishing information about when you met certain people, displaying photos of people, revoking keys, symmetrically encrypting files with a password), and it does none of those things right. In particular, it unambiguously does authenticated encryption wrong (streaming decrypt, then authenticate), which was one of the root causes of the EFAIL vulnerability.