5 ms·

What do you use for secure communication in lieu of openpgp?

by na85 7y ago

tptacek 7y ago
Signal or Wire, magic-wormhole. The obvious stuff.
- mbrumlow 7y ago
  And yet all of those bypass the hard part of validating the sender. These again trust the service. PGP is more than simply encryption. It provides a means of trusted identity. End to End encryption is pointless if you have no way to validate that a message came sender. Relying on automated systems for key exchange will always suffer from this problem.
  - tptacek 7y ago
    That "means of trusted identity" doesn't work, to a first approximation nobody even attempts to use it, of those that do, a vanishing fraction "succeed", and their reward for doing so is the adoption of rickety 1990s encryption. Among practicing cryptography engineers, "web of trust" is a punch line, not a goal. The lucky PGP users stick to the command line, which is so clunky that they'll use it rarely. The less fortunate will use PGP email clients which are so poorly thought out that they just last year managed to exfiltrate plaintext to attackers. Signal use in the real world dwarfs that of OpenPGP; it's almost certainly many orders of magnitude.
    - mbrumlow 7y ago
      I am not trying to win a popularity contest. If you care about secure messaging, and want to be sure you about who you are talking to -- then you have to use something like pgp. I don't think the number of people using something invalidates a technology's technical merits. All we now have is a bunch of people thinking they are secure to one day have a very rude awakening not if, but when their communications are compromised at for the sake of popularity and ease of use. Most of the arguments against PGP are about clunky clients, and such, this again is not a argument refuting the technology. Meanwhile the new systems solve the ui problems by dropping the most important part of encryption -- the ability to validate. So for me, I will stick with gpgp and the like.
      - tptacek 7y ago
        The only people who agree with you about the need for PGP in serious secure messaging are members of the PGP cheering section. They're an old and venerable social organization dating back to the pre-HMAC CFB-mode cryptography in PGP itself. I have nothing bad to say about their justified and ancient society other than that they are wrong about everything involving cryptography and that they recommend tools that get people hurt. People who care very deeply about these problems and who have studied them more carefully than almost any message board commenter have evaluated PGP and Signal. Among secure messaging and cryptography engineers, PGP is alternately either amusing or an unfunny hindrance to progress. Signal, on the other hand, won the Levchin Prize at Real World Crypto. Don't use PGP.
        mbrumlow 7y ago
        PGP is a protocol, there is nothing wrong with it. If you want to complain about good PGP based apps that is a entirely different argument (and it think that is what you are arguing). Signal is not a protocol, it is a application. It uses open whisper (or some mutation of it) as its underlying protocol. That being said, you are still relying on trust provided by the signal servers that they properly authenticated your phone number. A phone number is a super weak way to verify identity. Lucky signal does provide a way to verify you are actually talking to who you are via the safety code process (in person or out of band). So the end result is Trust us first, then verify later. While most PGP applications require zero trust until verification by means of key exchange. After all that there is nothing stopping anybody from making a application that works just as signal does but based of PGP, and being just as secure as Signal using PGP. The problem is people who understand this know that using PGP chained with a week service phone number base validation invalidates using the entire point -- so they don't. I personally think that is a mistake. As PGP is way better in the long run because it can be used for more than text chats, and video calls. > tools that get people hurt. People hurt them selves using tools improperly.
        tptacek 7y ago
        Both of those statements are false. There are clear things wrong with the PGP protocol. PGP predates authenticated encryption (let alone modern AEAD ciphers) and the hacks PGP came up with to authenticate ciphertext resulted both in stripping attacks and, indirectly, in the Efail attack from last year. It was also Signal's linear packet based key format that resulted in the GnuPG/SKS attacks. Signal is a protocol; in fact, it was "Signal Protocol" that won the Levchin prize. Signal also doesn't verify identities with phone numbers. These are just basic, fundamental factual problems with your claims. We're not even getting close to serious comparisons between the two systems; we haven't even talked about forward secrecy, compromise repair, modern primitives, complexity, and UX.
- dependenttypes 7y ago
  Would you happen to know if you can send stuff using Signal to someone whose phone is offline? You do seem to be able to do it using Wire but I would rather avoid it as the device verification seems broken.
  - haffenloher 7y ago
    Sure. Messaging via Signal (or via any other modern mobile messaging app) is designed to be asynchronous and doesn't require all participants of a chat to be online at the same time.
    - dependenttypes 7y ago
      Signal has perfect forward secrecy though. I am unsure how that could be achieved if phone 1 sends a message, the phone gets disconnected and then phone 2 connects to it.
      - haffenloher 7y ago
        For an explanation on how Signal achieves forward and future secrecy, see https://signal.org/blog/advanced-ratcheting/ https://signal.org/blog/advanced-ratcheting/ (or https://signal.org/docs/specifications/doubleratchet/ https://signal.org/docs/specifications/doubleratchet/ for something more detailed).

What do you use for secure communication in lieu of openpgp?

by na85 7y ago

What do you use for secure communication in lieu of openpgp?

tptacek 7y ago

Signal or Wire, magic-wormhole. The obvious stuff.

mbrumlow 7y ago
And yet all of those bypass the hard part of validating the sender. These again trust the service. PGP is more than simply encryption. It provides a means of trusted identity. End to End encryption is pointless if you have no way to validate that a message came sender. Relying on automated systems for key exchange will always suffer from this problem.
- tptacek 7y ago
  That "means of trusted identity" doesn't work, to a first approximation nobody even attempts to use it, of those that do, a vanishing fraction "succeed", and their reward for doing so is the adoption of rickety 1990s encryption. Among practicing cryptography engineers, "web of trust" is a punch line, not a goal. The lucky PGP users stick to the command line, which is so clunky that they'll use it rarely. The less fortunate will use PGP email clients which are so poorly thought out that they just last year managed to exfiltrate plaintext to attackers. Signal use in the real world dwarfs that of OpenPGP; it's almost certainly many orders of magnitude.
  - mbrumlow 7y ago
    I am not trying to win a popularity contest. If you care about secure messaging, and want to be sure you about who you are talking to -- then you have to use something like pgp. I don't think the number of people using something invalidates a technology's technical merits. All we now have is a bunch of people thinking they are secure to one day have a very rude awakening not if, but when their communications are compromised at for the sake of popularity and ease of use. Most of the arguments against PGP are about clunky clients, and such, this again is not a argument refuting the technology. Meanwhile the new systems solve the ui problems by dropping the most important part of encryption -- the ability to validate. So for me, I will stick with gpgp and the like.
    - tptacek 7y ago
      The only people who agree with you about the need for PGP in serious secure messaging are members of the PGP cheering section. They're an old and venerable social organization dating back to the pre-HMAC CFB-mode cryptography in PGP itself. I have nothing bad to say about their justified and ancient society other than that they are wrong about everything involving cryptography and that they recommend tools that get people hurt. People who care very deeply about these problems and who have studied them more carefully than almost any message board commenter have evaluated PGP and Signal. Among secure messaging and cryptography engineers, PGP is alternately either amusing or an unfunny hindrance to progress. Signal, on the other hand, won the Levchin Prize at Real World Crypto. Don't use PGP.
      - mbrumlow 7y ago
        PGP is a protocol, there is nothing wrong with it. If you want to complain about good PGP based apps that is a entirely different argument (and it think that is what you are arguing). Signal is not a protocol, it is a application. It uses open whisper (or some mutation of it) as its underlying protocol. That being said, you are still relying on trust provided by the signal servers that they properly authenticated your phone number. A phone number is a super weak way to verify identity. Lucky signal does provide a way to verify you are actually talking to who you are via the safety code process (in person or out of band). So the end result is Trust us first, then verify later. While most PGP applications require zero trust until verification by means of key exchange. After all that there is nothing stopping anybody from making a application that works just as signal does but based of PGP, and being just as secure as Signal using PGP. The problem is people who understand this know that using PGP chained with a week service phone number base validation invalidates using the entire point -- so they don't. I personally think that is a mistake. As PGP is way better in the long run because it can be used for more than text chats, and video calls. > tools that get people hurt. People hurt them selves using tools improperly.
        tptacek 7y ago
        Both of those statements are false. There are clear things wrong with the PGP protocol. PGP predates authenticated encryption (let alone modern AEAD ciphers) and the hacks PGP came up with to authenticate ciphertext resulted both in stripping attacks and, indirectly, in the Efail attack from last year. It was also Signal's linear packet based key format that resulted in the GnuPG/SKS attacks. Signal is a protocol; in fact, it was "Signal Protocol" that won the Levchin prize. Signal also doesn't verify identities with phone numbers. These are just basic, fundamental factual problems with your claims. We're not even getting close to serious comparisons between the two systems; we haven't even talked about forward secrecy, compromise repair, modern primitives, complexity, and UX.
dependenttypes 7y ago
Would you happen to know if you can send stuff using Signal to someone whose phone is offline? You do seem to be able to do it using Wire but I would rather avoid it as the device verification seems broken.
- haffenloher 7y ago
  Sure. Messaging via Signal (or via any other modern mobile messaging app) is designed to be asynchronous and doesn't require all participants of a chat to be online at the same time.
  - dependenttypes 7y ago
    Signal has perfect forward secrecy though. I am unsure how that could be achieved if phone 1 sends a message, the phone gets disconnected and then phone 2 connects to it.
    - haffenloher 7y ago
      For an explanation on how Signal achieves forward and future secrecy, see https://signal.org/blog/advanced-ratcheting/ https://signal.org/blog/advanced-ratcheting/ (or https://signal.org/docs/specifications/doubleratchet/ https://signal.org/docs/specifications/doubleratchet/ for something more detailed).