4 ms·

It's always sad to see someone taking down a project that is run with the best intentions. However, it may be time to move away from the entire PGP ecosystem.

It's always sad to see someone taking down a project that is run with the best intentions. However, it may be time to move away from the entire PGP ecosystem. Consider the post's "We've known for a decade this attack is possible. It's now here and it's devastating.". Consider also the final section, "PGP is bad technology and it’s making a bad community", of https://blog.cryptographyengineering.com/2018/05/17/was-the-efail-disclosure-horribly-screwed-up/ https://blog.cryptographyengineering.com/2018/05/17/was-the-... (by noted cryptographer Matthew Green.) My sympathies to the victims of this attack. [EDIT: reworked slightly at 7m to try to be as kind as possible]

clarkmoody 7y ago
The idea of Internet actors (human or machine) owning cryptographic identities in a distributed system is a good one. I don't think we should stray from this approach. From your Matthew Green link: > If PGP went away, I estimate it would take the security community less than a year to entirely replace (the key bits of) the standard with something much better and modern. It would have modern crypto and authentication, and maybe even extensions for future post-quantum future security. It would be simple. Many bright new people would get involved to help write the inevitable Rust, Go and Javascript clients and libraries. Those word were written a little more than a year ago. What if right now is the time to assume that PGP has gone away and start building the next thing? What alternate projects are people excited about that are solving the problem of distributed cryptographic identity and messaging?
- cyphar 7y ago
  > What alternate projects are people excited about that are solving the problem of distributed cryptographic identity and messaging? I would argue Matrix is a good contender. The Matrix project is working on secure messaging, and they have a lot of really cool solutions for key distribution and federated communication. "Distributed cryptographic identity" is a slightly hard concept to pin down. In Matrix this is still an open problem, but that's just for the service which links third-party IDs (phone numbers, email addresses, etc) to Matrix IDs (@cyphar:cyphar.com, for instance). But if the problem is distributing keys, then that is a solvable problem. But then again, maybe a different solution is needed to fill the PGP niche.
  - tptacek 7y ago
    The best replacement to PGP would be a messaging network with opt-in, poorly supported encryption? https://www.reddit.com/r/privacy/comments/9avyen/sad_state_of_e2ee_in_matrix_clients/ https://www.reddit.com/r/privacy/comments/9avyen/sad_state_o... I don't know what it is with people and Matrix. It seems like a good project, hamstrung by its overzealous cheering section.
    - cyphar 7y ago
      > opt-in Device cross-signing (from my understanding, the last must-have feature before e2ee is considered ready to be the default) is very close to being merged now that Matrix 1.0 is out. Yes, it took several years to get there, but I think its fair to say that the e2ee design now looks much better than anything else available (and had to solve many more technical problems than [for instance] Signal, due to the needs of federation). > poorly supported There are many unmaintained Matrix clients (this is what the top comment of your link points out). Personally I'd prefer if they stopped advertising them on matrix.org, because all of the newer clients either do or will support e2ee. > hamstrung by its overzealous cheering section Given that it seems to be the only project that provides modern e2ee in a way where your data is actually controlled by you without a central authority, I'm surprised that so few people are cheering them on.
      - tptacek 7y ago
        "All newer clients either do or will support e2ee" is my favorite thing I've ever heard someone say about Matrix.
        Arathorn 7y ago
        well, it's true - if you run a daemon like pantalaimon, even one-liner Matrix requests via curl can speak full E2EE. So arguably the older clients now support E2EE too :)
      - pgeorgi 7y ago
        > Given that it seems to be the only project that provides modern e2ee in a way where your data is actually controlled by you without a central authority, ... OMEMO on XMPP?
- soulofmischief 7y ago
  It's not the silver bullet we need, but I really like Keybase's approach. I think any PGP replacement should take notes from their architecture.
  - StavrosK 7y ago
    It's not a silver bullet, but is it not better than PGP? Is it not good enough?
    - soulofmischief 7y ago
      It's still too centralized. You and I can't run our own compatible public Keybase servers, or our own private servers. Understandable, as their investors expect them not to give away everything for free. The client is open source so reverse engineering and improving the server architecture is far from impossible. I think Keybase is making great strides on exploring how we can utilize asymmetric E2E encryption for communication, organization, storage, and everything in between. I think they've made tremendous progress in making E2E cryptography accessible. However we need a 100% FOSS system. See: https://github.com/keybase/client/issues/6374 https://github.com/keybase/client/issues/6374
  - rocqua 7y ago
    I love their approach, but it is still PGP based. Moreover, it is a bit too centralized. Thing is, a non-centralized system is really hard to monetize. There might be space for some long-form (as opposed to whatsapp, etc) encrypted messaging. But a solution for portable encrypted files (using either symmetric or asymmetric crypto) is hard to monetize. Note that, while portable encrypted files could be used for encrypted messaging, the use cases and ergonomics are sufficiently different that a good solution for one will not be a great fit for the other.
    - soulofmischief 7y ago
      There's nothing technically wrong (baring a yet-unrevealed exploit) with PGP itself. This thread's topic was about a weakness in SKS. PGP just suffers from major UX problems, which Keybase has largely addressed. To use Keybase, one doesn't even need to know what PGP is. It all "just works". I have successfully introduced non-technical people to Keybase and what's more, these people use it actively and appreciate what it can do for them. Can't really say that about PGP. > Thing is, a non-centralized system is really hard to monetize Until our government supports such infrastructure, the only solution is trust funds / non-profit organizations which released all of their R&D for free.
- Reelin 7y ago
  The idea expressed in that quote is utter nonsense. If it's so easy to "entirely replace (the key bits of) the standard with something much better and modern", then go build it! Talk is cheap. If people aren't adopting an objectively superior solution that currently exists and addresses all of the current use cases, that's an entirely different issue. I doubt that's the case here though. I think (one of) the issues is that no one has yet managed to clearly define a set of goals that satisfy all current use cases while also addressing concerns about centralization, interoperability, and ease of implementation.
- stevetodd 7y ago
  Sovrin[1] seems pretty interesting to me for distributed/decentralized identity. They use a distributed ledger for identity and allow for piecemeal disclosure of identity data. So by default the identity data isn’t public. [1] https://sovrin.org/ https://sovrin.org/
kyrra 7y ago
PGP for pre-shared keys is exceptionally useful still. In the payments world, we use it regularly for both interactive application/message level encryption, and also when moving files between companies. It could die for email, but still be heavily used elsewhere.
secfirstmd 7y ago
FWIW Robert Hansen is a nice guy and a total gentleman. Met him at a number of internet freedom and privacy conferences.
gtirloni 7y ago
> However, it may be time to move away from the entire PGP ecosystem. To what exactly?
Rapzid 7y ago
I appreciate the sentiment; the wider ecosystem is a shite show. Consider that recent RHEL releases still don't come with an rpm version that supports subkey signing, and that it took something like 10-15+ years to get that added in after it was first brought up. Then, you have gpg forcing the agent down peoples throats turning a task that should involve a static binary to sign packages into a potential life altering event... The v1 to v2 changes and differences(like the dang agent) and timeline. It's so embedded in stuff though, even if it feels jammed in and is half sticking out, I can't imagine it going away super soon.

clarkmoody 7y ago

The idea of Internet actors (human or machine) owning cryptographic identities in a distributed system is a good one. I don't think we should stray from this approach. From your Matthew Green link: > If PGP went away, I estimate it would take the security community less than a year to entirely replace (the key bits of) the standard with something much better and modern. It would have modern crypto and authentication, and maybe even extensions for future post-quantum future security. It would be simple. Many bright new people would get involved to help write the inevitable Rust, Go and Javascript clients and libraries. Those word were written a little more than a year ago. What if right now is the time to assume that PGP has gone away and start building the next thing? What alternate projects are people excited about that are solving the problem of distributed cryptographic identity and messaging?

cyphar 7y ago
> What alternate projects are people excited about that are solving the problem of distributed cryptographic identity and messaging? I would argue Matrix is a good contender. The Matrix project is working on secure messaging, and they have a lot of really cool solutions for key distribution and federated communication. "Distributed cryptographic identity" is a slightly hard concept to pin down. In Matrix this is still an open problem, but that's just for the service which links third-party IDs (phone numbers, email addresses, etc) to Matrix IDs (@cyphar:cyphar.com, for instance). But if the problem is distributing keys, then that is a solvable problem. But then again, maybe a different solution is needed to fill the PGP niche.
- tptacek 7y ago
  The best replacement to PGP would be a messaging network with opt-in, poorly supported encryption? https://www.reddit.com/r/privacy/comments/9avyen/sad_state_of_e2ee_in_matrix_clients/ https://www.reddit.com/r/privacy/comments/9avyen/sad_state_o... I don't know what it is with people and Matrix. It seems like a good project, hamstrung by its overzealous cheering section.
  - cyphar 7y ago
    > opt-in Device cross-signing (from my understanding, the last must-have feature before e2ee is considered ready to be the default) is very close to being merged now that Matrix 1.0 is out. Yes, it took several years to get there, but I think its fair to say that the e2ee design now looks much better than anything else available (and had to solve many more technical problems than [for instance] Signal, due to the needs of federation). > poorly supported There are many unmaintained Matrix clients (this is what the top comment of your link points out). Personally I'd prefer if they stopped advertising them on matrix.org, because all of the newer clients either do or will support e2ee. > hamstrung by its overzealous cheering section Given that it seems to be the only project that provides modern e2ee in a way where your data is actually controlled by you without a central authority, I'm surprised that so few people are cheering them on.
    - tptacek 7y ago
      "All newer clients either do or will support e2ee" is my favorite thing I've ever heard someone say about Matrix.
      - Arathorn 7y ago
        well, it's true - if you run a daemon like pantalaimon, even one-liner Matrix requests via curl can speak full E2EE. So arguably the older clients now support E2EE too :)
    - pgeorgi 7y ago
      > Given that it seems to be the only project that provides modern e2ee in a way where your data is actually controlled by you without a central authority, ... OMEMO on XMPP?
soulofmischief 7y ago
It's not the silver bullet we need, but I really like Keybase's approach. I think any PGP replacement should take notes from their architecture.
- StavrosK 7y ago
  It's not a silver bullet, but is it not better than PGP? Is it not good enough?
  - soulofmischief 7y ago
    It's still too centralized. You and I can't run our own compatible public Keybase servers, or our own private servers. Understandable, as their investors expect them not to give away everything for free. The client is open source so reverse engineering and improving the server architecture is far from impossible. I think Keybase is making great strides on exploring how we can utilize asymmetric E2E encryption for communication, organization, storage, and everything in between. I think they've made tremendous progress in making E2E cryptography accessible. However we need a 100% FOSS system. See: https://github.com/keybase/client/issues/6374 https://github.com/keybase/client/issues/6374
- rocqua 7y ago
  I love their approach, but it is still PGP based. Moreover, it is a bit too centralized. Thing is, a non-centralized system is really hard to monetize. There might be space for some long-form (as opposed to whatsapp, etc) encrypted messaging. But a solution for portable encrypted files (using either symmetric or asymmetric crypto) is hard to monetize. Note that, while portable encrypted files could be used for encrypted messaging, the use cases and ergonomics are sufficiently different that a good solution for one will not be a great fit for the other.
  - soulofmischief 7y ago
    There's nothing technically wrong (baring a yet-unrevealed exploit) with PGP itself. This thread's topic was about a weakness in SKS. PGP just suffers from major UX problems, which Keybase has largely addressed. To use Keybase, one doesn't even need to know what PGP is. It all "just works". I have successfully introduced non-technical people to Keybase and what's more, these people use it actively and appreciate what it can do for them. Can't really say that about PGP. > Thing is, a non-centralized system is really hard to monetize Until our government supports such infrastructure, the only solution is trust funds / non-profit organizations which released all of their R&D for free.
Reelin 7y ago
The idea expressed in that quote is utter nonsense. If it's so easy to "entirely replace (the key bits of) the standard with something much better and modern", then go build it! Talk is cheap. If people aren't adopting an objectively superior solution that currently exists and addresses all of the current use cases, that's an entirely different issue. I doubt that's the case here though. I think (one of) the issues is that no one has yet managed to clearly define a set of goals that satisfy all current use cases while also addressing concerns about centralization, interoperability, and ease of implementation.
stevetodd 7y ago
Sovrin[1] seems pretty interesting to me for distributed/decentralized identity. They use a distributed ledger for identity and allow for piecemeal disclosure of identity data. So by default the identity data isn’t public. [1] https://sovrin.org/ https://sovrin.org/

kyrra 7y ago

PGP for pre-shared keys is exceptionally useful still. In the payments world, we use it regularly for both interactive application/message level encryption, and also when moving files between companies. It could die for email, but still be heavily used elsewhere.

secfirstmd 7y ago

FWIW Robert Hansen is a nice guy and a total gentleman. Met him at a number of internet freedom and privacy conferences.

gtirloni 7y ago

> However, it may be time to move away from the entire PGP ecosystem. To what exactly?

Rapzid 7y ago

I appreciate the sentiment; the wider ecosystem is a shite show. Consider that recent RHEL releases still don't come with an rpm version that supports subkey signing, and that it took something like 10-15+ years to get that added in after it was first brought up. Then, you have gpg forcing the agent down peoples throats turning a task that should involve a static binary to sign packages into a potential life altering event... The v1 to v2 changes and differences(like the dang agent) and timeline. It's so embedded in stuff though, even if it feels jammed in and is half sticking out, I can't imagine it going away super soon.