4 ms·

And yet all of those bypass the hard part of validating the sender. These again trust the service. PGP is more than simply encryption. It provides a means of t

And yet all of those bypass the hard part of validating the sender. These again trust the service. PGP is more than simply encryption. It provides a means of trusted identity. End to End encryption is pointless if you have no way to validate that a message came sender. Relying on automated systems for key exchange will always suffer from this problem.

tptacek 7y ago
That "means of trusted identity" doesn't work, to a first approximation nobody even attempts to use it, of those that do, a vanishing fraction "succeed", and their reward for doing so is the adoption of rickety 1990s encryption. Among practicing cryptography engineers, "web of trust" is a punch line, not a goal. The lucky PGP users stick to the command line, which is so clunky that they'll use it rarely. The less fortunate will use PGP email clients which are so poorly thought out that they just last year managed to exfiltrate plaintext to attackers. Signal use in the real world dwarfs that of OpenPGP; it's almost certainly many orders of magnitude.
- mbrumlow 7y ago
  I am not trying to win a popularity contest. If you care about secure messaging, and want to be sure you about who you are talking to -- then you have to use something like pgp. I don't think the number of people using something invalidates a technology's technical merits. All we now have is a bunch of people thinking they are secure to one day have a very rude awakening not if, but when their communications are compromised at for the sake of popularity and ease of use. Most of the arguments against PGP are about clunky clients, and such, this again is not a argument refuting the technology. Meanwhile the new systems solve the ui problems by dropping the most important part of encryption -- the ability to validate. So for me, I will stick with gpgp and the like.
  - tptacek 7y ago
    The only people who agree with you about the need for PGP in serious secure messaging are members of the PGP cheering section. They're an old and venerable social organization dating back to the pre-HMAC CFB-mode cryptography in PGP itself. I have nothing bad to say about their justified and ancient society other than that they are wrong about everything involving cryptography and that they recommend tools that get people hurt. People who care very deeply about these problems and who have studied them more carefully than almost any message board commenter have evaluated PGP and Signal. Among secure messaging and cryptography engineers, PGP is alternately either amusing or an unfunny hindrance to progress. Signal, on the other hand, won the Levchin Prize at Real World Crypto. Don't use PGP.
    - mbrumlow 7y ago
      PGP is a protocol, there is nothing wrong with it. If you want to complain about good PGP based apps that is a entirely different argument (and it think that is what you are arguing). Signal is not a protocol, it is a application. It uses open whisper (or some mutation of it) as its underlying protocol. That being said, you are still relying on trust provided by the signal servers that they properly authenticated your phone number. A phone number is a super weak way to verify identity. Lucky signal does provide a way to verify you are actually talking to who you are via the safety code process (in person or out of band). So the end result is Trust us first, then verify later. While most PGP applications require zero trust until verification by means of key exchange. After all that there is nothing stopping anybody from making a application that works just as signal does but based of PGP, and being just as secure as Signal using PGP. The problem is people who understand this know that using PGP chained with a week service phone number base validation invalidates using the entire point -- so they don't. I personally think that is a mistake. As PGP is way better in the long run because it can be used for more than text chats, and video calls. > tools that get people hurt. People hurt them selves using tools improperly.
      - tptacek 7y ago
        Both of those statements are false. There are clear things wrong with the PGP protocol. PGP predates authenticated encryption (let alone modern AEAD ciphers) and the hacks PGP came up with to authenticate ciphertext resulted both in stripping attacks and, indirectly, in the Efail attack from last year. It was also Signal's linear packet based key format that resulted in the GnuPG/SKS attacks. Signal is a protocol; in fact, it was "Signal Protocol" that won the Levchin prize. Signal also doesn't verify identities with phone numbers. These are just basic, fundamental factual problems with your claims. We're not even getting close to serious comparisons between the two systems; we haven't even talked about forward secrecy, compromise repair, modern primitives, complexity, and UX.
        mbrumlow 7y ago
        > Both of those statements are false. Pop on over to wikipeida, you will how wrong you actually are. >> "Signal uses standard cellular mobile numbers as identifiers" >> "The applications include mechanisms by which users can independently verify >> the identity of their messaging correspondents and the integrity of the data >> channel." That is what I described, its trust us first, and maybe verify later if you think of it. >> "Open Whisper Systems introduced the second version of their TextSecure Protocol >> (now Signal Protocol)" Looks like it is Open Whisper, just V2 and renamed... Well maybe TextSecure. > hacks PGP came up with to authenticate ciphertext resulted both in stripping attacks and, indirectly, in the Efail attack from last year. A quick look at Efail shows clients were at fault and the fix was fix was patching clients. I can assure you my email client had no such issue. So again, you are blaming something on PGP that really just involved PGP. If Signals code has a bug in it too can leak encrypted messages after the client decrypts them. > key format that resulted in the GnuPG/SKS attacks Again you are back on keyservers, a method of offline verification to a 3rd party. > Signal also doesn't verify identities with phone numbers. Yes it does, unless you do the second step of verification, which is not done by default. Have you used signal before? When I installed it on my phone magically people I knew showed up base off -- what is that? A phone number. And again Wikipedia - " Signal uses standard cellular mobile numbers as identifiers, " > These are just basic, fundamental factual problems with your claims. You keep conflating things with PGP that are not PGP, thus I have to refute insane statements that don't have to do with pgp, but things like email clients, or now how signal actually works. You thus far have just said I am wrong, but yet not described how any of this works. Yet I am here pointing to and describing in great detail how you are wrong. Simply saying I am wrong, and not demonstrating it does not make you right. > We're not even getting close to serious comparisons between the two systems; You are right, because you are talking about end to end encryption and I am talking about the importance of verifying who you are talking to. Signal fundamentally solves a different problem that PGP is attempting to solve -- and it does so giving up some very strong benefits that PGP brought to the table. Signal is amazing if you don't want onlookers to see your message, not so good if you want to authenticate the sender (unless you go through the extra steps, in which case it is the same cumbersome process as pgp keys.) In any case, i don't have any more time to spend on this. If you chose to reply I will read it but I am done because think we are going to come to a agreement.

tptacek 7y ago

That "means of trusted identity" doesn't work, to a first approximation nobody even attempts to use it, of those that do, a vanishing fraction "succeed", and their reward for doing so is the adoption of rickety 1990s encryption. Among practicing cryptography engineers, "web of trust" is a punch line, not a goal. The lucky PGP users stick to the command line, which is so clunky that they'll use it rarely. The less fortunate will use PGP email clients which are so poorly thought out that they just last year managed to exfiltrate plaintext to attackers. Signal use in the real world dwarfs that of OpenPGP; it's almost certainly many orders of magnitude.

mbrumlow 7y ago
I am not trying to win a popularity contest. If you care about secure messaging, and want to be sure you about who you are talking to -- then you have to use something like pgp. I don't think the number of people using something invalidates a technology's technical merits. All we now have is a bunch of people thinking they are secure to one day have a very rude awakening not if, but when their communications are compromised at for the sake of popularity and ease of use. Most of the arguments against PGP are about clunky clients, and such, this again is not a argument refuting the technology. Meanwhile the new systems solve the ui problems by dropping the most important part of encryption -- the ability to validate. So for me, I will stick with gpgp and the like.
- tptacek 7y ago
  The only people who agree with you about the need for PGP in serious secure messaging are members of the PGP cheering section. They're an old and venerable social organization dating back to the pre-HMAC CFB-mode cryptography in PGP itself. I have nothing bad to say about their justified and ancient society other than that they are wrong about everything involving cryptography and that they recommend tools that get people hurt. People who care very deeply about these problems and who have studied them more carefully than almost any message board commenter have evaluated PGP and Signal. Among secure messaging and cryptography engineers, PGP is alternately either amusing or an unfunny hindrance to progress. Signal, on the other hand, won the Levchin Prize at Real World Crypto. Don't use PGP.
  - mbrumlow 7y ago
    PGP is a protocol, there is nothing wrong with it. If you want to complain about good PGP based apps that is a entirely different argument (and it think that is what you are arguing). Signal is not a protocol, it is a application. It uses open whisper (or some mutation of it) as its underlying protocol. That being said, you are still relying on trust provided by the signal servers that they properly authenticated your phone number. A phone number is a super weak way to verify identity. Lucky signal does provide a way to verify you are actually talking to who you are via the safety code process (in person or out of band). So the end result is Trust us first, then verify later. While most PGP applications require zero trust until verification by means of key exchange. After all that there is nothing stopping anybody from making a application that works just as signal does but based of PGP, and being just as secure as Signal using PGP. The problem is people who understand this know that using PGP chained with a week service phone number base validation invalidates using the entire point -- so they don't. I personally think that is a mistake. As PGP is way better in the long run because it can be used for more than text chats, and video calls. > tools that get people hurt. People hurt them selves using tools improperly.
    - tptacek 7y ago
      Both of those statements are false. There are clear things wrong with the PGP protocol. PGP predates authenticated encryption (let alone modern AEAD ciphers) and the hacks PGP came up with to authenticate ciphertext resulted both in stripping attacks and, indirectly, in the Efail attack from last year. It was also Signal's linear packet based key format that resulted in the GnuPG/SKS attacks. Signal is a protocol; in fact, it was "Signal Protocol" that won the Levchin prize. Signal also doesn't verify identities with phone numbers. These are just basic, fundamental factual problems with your claims. We're not even getting close to serious comparisons between the two systems; we haven't even talked about forward secrecy, compromise repair, modern primitives, complexity, and UX.
      - mbrumlow 7y ago
        > Both of those statements are false. Pop on over to wikipeida, you will how wrong you actually are. >> "Signal uses standard cellular mobile numbers as identifiers" >> "The applications include mechanisms by which users can independently verify >> the identity of their messaging correspondents and the integrity of the data >> channel." That is what I described, its trust us first, and maybe verify later if you think of it. >> "Open Whisper Systems introduced the second version of their TextSecure Protocol >> (now Signal Protocol)" Looks like it is Open Whisper, just V2 and renamed... Well maybe TextSecure. > hacks PGP came up with to authenticate ciphertext resulted both in stripping attacks and, indirectly, in the Efail attack from last year. A quick look at Efail shows clients were at fault and the fix was fix was patching clients. I can assure you my email client had no such issue. So again, you are blaming something on PGP that really just involved PGP. If Signals code has a bug in it too can leak encrypted messages after the client decrypts them. > key format that resulted in the GnuPG/SKS attacks Again you are back on keyservers, a method of offline verification to a 3rd party. > Signal also doesn't verify identities with phone numbers. Yes it does, unless you do the second step of verification, which is not done by default. Have you used signal before? When I installed it on my phone magically people I knew showed up base off -- what is that? A phone number. And again Wikipedia - " Signal uses standard cellular mobile numbers as identifiers, " > These are just basic, fundamental factual problems with your claims. You keep conflating things with PGP that are not PGP, thus I have to refute insane statements that don't have to do with pgp, but things like email clients, or now how signal actually works. You thus far have just said I am wrong, but yet not described how any of this works. Yet I am here pointing to and describing in great detail how you are wrong. Simply saying I am wrong, and not demonstrating it does not make you right. > We're not even getting close to serious comparisons between the two systems; You are right, because you are talking about end to end encryption and I am talking about the importance of verifying who you are talking to. Signal fundamentally solves a different problem that PGP is attempting to solve -- and it does so giving up some very strong benefits that PGP brought to the table. Signal is amazing if you don't want onlookers to see your message, not so good if you want to authenticate the sender (unless you go through the extra steps, in which case it is the same cumbersome process as pgp keys.) In any case, i don't have any more time to spend on this. If you chose to reply I will read it but I am done because think we are going to come to a agreement.