4 ms·

I am not trying to win a popularity contest. If you care about secure messaging, and want to be sure you about who you are talking to -- then you have to use so

I am not trying to win a popularity contest. If you care about secure messaging, and want to be sure you about who you are talking to -- then you have to use something like pgp. I don't think the number of people using something invalidates a technology's technical merits. All we now have is a bunch of people thinking they are secure to one day have a very rude awakening not if, but when their communications are compromised at for the sake of popularity and ease of use. Most of the arguments against PGP are about clunky clients, and such, this again is not a argument refuting the technology. Meanwhile the new systems solve the ui problems by dropping the most important part of encryption -- the ability to validate. So for me, I will stick with gpgp and the like.

tptacek 7y ago
The only people who agree with you about the need for PGP in serious secure messaging are members of the PGP cheering section. They're an old and venerable social organization dating back to the pre-HMAC CFB-mode cryptography in PGP itself. I have nothing bad to say about their justified and ancient society other than that they are wrong about everything involving cryptography and that they recommend tools that get people hurt. People who care very deeply about these problems and who have studied them more carefully than almost any message board commenter have evaluated PGP and Signal. Among secure messaging and cryptography engineers, PGP is alternately either amusing or an unfunny hindrance to progress. Signal, on the other hand, won the Levchin Prize at Real World Crypto. Don't use PGP.
- mbrumlow 7y ago
  PGP is a protocol, there is nothing wrong with it. If you want to complain about good PGP based apps that is a entirely different argument (and it think that is what you are arguing). Signal is not a protocol, it is a application. It uses open whisper (or some mutation of it) as its underlying protocol. That being said, you are still relying on trust provided by the signal servers that they properly authenticated your phone number. A phone number is a super weak way to verify identity. Lucky signal does provide a way to verify you are actually talking to who you are via the safety code process (in person or out of band). So the end result is Trust us first, then verify later. While most PGP applications require zero trust until verification by means of key exchange. After all that there is nothing stopping anybody from making a application that works just as signal does but based of PGP, and being just as secure as Signal using PGP. The problem is people who understand this know that using PGP chained with a week service phone number base validation invalidates using the entire point -- so they don't. I personally think that is a mistake. As PGP is way better in the long run because it can be used for more than text chats, and video calls. > tools that get people hurt. People hurt them selves using tools improperly.
  - tptacek 7y ago
    Both of those statements are false. There are clear things wrong with the PGP protocol. PGP predates authenticated encryption (let alone modern AEAD ciphers) and the hacks PGP came up with to authenticate ciphertext resulted both in stripping attacks and, indirectly, in the Efail attack from last year. It was also Signal's linear packet based key format that resulted in the GnuPG/SKS attacks. Signal is a protocol; in fact, it was "Signal Protocol" that won the Levchin prize. Signal also doesn't verify identities with phone numbers. These are just basic, fundamental factual problems with your claims. We're not even getting close to serious comparisons between the two systems; we haven't even talked about forward secrecy, compromise repair, modern primitives, complexity, and UX.
    - mbrumlow 7y ago
      > Both of those statements are false. Pop on over to wikipeida, you will how wrong you actually are. >> "Signal uses standard cellular mobile numbers as identifiers" >> "The applications include mechanisms by which users can independently verify >> the identity of their messaging correspondents and the integrity of the data >> channel." That is what I described, its trust us first, and maybe verify later if you think of it. >> "Open Whisper Systems introduced the second version of their TextSecure Protocol >> (now Signal Protocol)" Looks like it is Open Whisper, just V2 and renamed... Well maybe TextSecure. > hacks PGP came up with to authenticate ciphertext resulted both in stripping attacks and, indirectly, in the Efail attack from last year. A quick look at Efail shows clients were at fault and the fix was fix was patching clients. I can assure you my email client had no such issue. So again, you are blaming something on PGP that really just involved PGP. If Signals code has a bug in it too can leak encrypted messages after the client decrypts them. > key format that resulted in the GnuPG/SKS attacks Again you are back on keyservers, a method of offline verification to a 3rd party. > Signal also doesn't verify identities with phone numbers. Yes it does, unless you do the second step of verification, which is not done by default. Have you used signal before? When I installed it on my phone magically people I knew showed up base off -- what is that? A phone number. And again Wikipedia - " Signal uses standard cellular mobile numbers as identifiers, " > These are just basic, fundamental factual problems with your claims. You keep conflating things with PGP that are not PGP, thus I have to refute insane statements that don't have to do with pgp, but things like email clients, or now how signal actually works. You thus far have just said I am wrong, but yet not described how any of this works. Yet I am here pointing to and describing in great detail how you are wrong. Simply saying I am wrong, and not demonstrating it does not make you right. > We're not even getting close to serious comparisons between the two systems; You are right, because you are talking about end to end encryption and I am talking about the importance of verifying who you are talking to. Signal fundamentally solves a different problem that PGP is attempting to solve -- and it does so giving up some very strong benefits that PGP brought to the table. Signal is amazing if you don't want onlookers to see your message, not so good if you want to authenticate the sender (unless you go through the extra steps, in which case it is the same cumbersome process as pgp keys.) In any case, i don't have any more time to spend on this. If you chose to reply I will read it but I am done because think we are going to come to a agreement.
- na85 7y ago
  If someone solved the UI/UX problems with gnupg, and came up with a more elegant method of exchanging/validating keys (or even just an alternate keyserver infrastructure with better properties), wouldn't that solve the problem? Edit: how about a response instead of a downnvote, anonymous detractor?
  - mbrumlow 7y ago
    EDIT: guidelines As a note, I think there are probably better crypto technologies these days, but none of them do what pgp aimed to do, but rather we have a bunch of smaller tools that do small parts that pgp did. I am not going to send you a singed file over singal, and I think it is silly to have to use a alternative means of sending the file that will either remove the ability for authenticity, or require me to do the authentication dance again with you. PGP suffers from bad tooling, and further suffers from the relentless onslaught of people who want fancy electron or phone apps that can only do a small % of what pgp would allow. Final note, I think something better than PGP could exist, but nobody has made it yet. In either case, validating keys will always be a hard problem and any attempt to automate it will result in false sense of security. While end to end encryption will keep on lookers from viewing your communications -- you just might find out one day you are talking directly to the people you were trying to hind your communication from.
    - tptacek 7y ago
      First, the guidelines ask you not to talk about downvotes. You can find out more about that by reading the guidelines. Secondly, Signal sends files just fine, and does so more securely than GPG. If you don't want to use Signal to do that, you can also use Magic Wormhole, which also works better and is more secure than PGP.
- intricatedetail 7y ago
  If you need ultimate privacy and true end to end encryption , PGP is your tool. You can use over channels you don't trust, e.g. you can easily send PGP messages over Signal or other messenger you can't verify. Only people to discourage use of PGP would be gov reps, as you can choke messenger company to give you a tap to messages, but if someone uses PGP over it, tough luck.
- madez 7y ago
  > Don't use PGP. How else do you recommend to independently establish a verifiable identity?

tptacek 7y ago

The only people who agree with you about the need for PGP in serious secure messaging are members of the PGP cheering section. They're an old and venerable social organization dating back to the pre-HMAC CFB-mode cryptography in PGP itself. I have nothing bad to say about their justified and ancient society other than that they are wrong about everything involving cryptography and that they recommend tools that get people hurt. People who care very deeply about these problems and who have studied them more carefully than almost any message board commenter have evaluated PGP and Signal. Among secure messaging and cryptography engineers, PGP is alternately either amusing or an unfunny hindrance to progress. Signal, on the other hand, won the Levchin Prize at Real World Crypto. Don't use PGP.

mbrumlow 7y ago
PGP is a protocol, there is nothing wrong with it. If you want to complain about good PGP based apps that is a entirely different argument (and it think that is what you are arguing). Signal is not a protocol, it is a application. It uses open whisper (or some mutation of it) as its underlying protocol. That being said, you are still relying on trust provided by the signal servers that they properly authenticated your phone number. A phone number is a super weak way to verify identity. Lucky signal does provide a way to verify you are actually talking to who you are via the safety code process (in person or out of band). So the end result is Trust us first, then verify later. While most PGP applications require zero trust until verification by means of key exchange. After all that there is nothing stopping anybody from making a application that works just as signal does but based of PGP, and being just as secure as Signal using PGP. The problem is people who understand this know that using PGP chained with a week service phone number base validation invalidates using the entire point -- so they don't. I personally think that is a mistake. As PGP is way better in the long run because it can be used for more than text chats, and video calls. > tools that get people hurt. People hurt them selves using tools improperly.
- tptacek 7y ago
  Both of those statements are false. There are clear things wrong with the PGP protocol. PGP predates authenticated encryption (let alone modern AEAD ciphers) and the hacks PGP came up with to authenticate ciphertext resulted both in stripping attacks and, indirectly, in the Efail attack from last year. It was also Signal's linear packet based key format that resulted in the GnuPG/SKS attacks. Signal is a protocol; in fact, it was "Signal Protocol" that won the Levchin prize. Signal also doesn't verify identities with phone numbers. These are just basic, fundamental factual problems with your claims. We're not even getting close to serious comparisons between the two systems; we haven't even talked about forward secrecy, compromise repair, modern primitives, complexity, and UX.
  - mbrumlow 7y ago
    > Both of those statements are false. Pop on over to wikipeida, you will how wrong you actually are. >> "Signal uses standard cellular mobile numbers as identifiers" >> "The applications include mechanisms by which users can independently verify >> the identity of their messaging correspondents and the integrity of the data >> channel." That is what I described, its trust us first, and maybe verify later if you think of it. >> "Open Whisper Systems introduced the second version of their TextSecure Protocol >> (now Signal Protocol)" Looks like it is Open Whisper, just V2 and renamed... Well maybe TextSecure. > hacks PGP came up with to authenticate ciphertext resulted both in stripping attacks and, indirectly, in the Efail attack from last year. A quick look at Efail shows clients were at fault and the fix was fix was patching clients. I can assure you my email client had no such issue. So again, you are blaming something on PGP that really just involved PGP. If Signals code has a bug in it too can leak encrypted messages after the client decrypts them. > key format that resulted in the GnuPG/SKS attacks Again you are back on keyservers, a method of offline verification to a 3rd party. > Signal also doesn't verify identities with phone numbers. Yes it does, unless you do the second step of verification, which is not done by default. Have you used signal before? When I installed it on my phone magically people I knew showed up base off -- what is that? A phone number. And again Wikipedia - " Signal uses standard cellular mobile numbers as identifiers, " > These are just basic, fundamental factual problems with your claims. You keep conflating things with PGP that are not PGP, thus I have to refute insane statements that don't have to do with pgp, but things like email clients, or now how signal actually works. You thus far have just said I am wrong, but yet not described how any of this works. Yet I am here pointing to and describing in great detail how you are wrong. Simply saying I am wrong, and not demonstrating it does not make you right. > We're not even getting close to serious comparisons between the two systems; You are right, because you are talking about end to end encryption and I am talking about the importance of verifying who you are talking to. Signal fundamentally solves a different problem that PGP is attempting to solve -- and it does so giving up some very strong benefits that PGP brought to the table. Signal is amazing if you don't want onlookers to see your message, not so good if you want to authenticate the sender (unless you go through the extra steps, in which case it is the same cumbersome process as pgp keys.) In any case, i don't have any more time to spend on this. If you chose to reply I will read it but I am done because think we are going to come to a agreement.
na85 7y ago
If someone solved the UI/UX problems with gnupg, and came up with a more elegant method of exchanging/validating keys (or even just an alternate keyserver infrastructure with better properties), wouldn't that solve the problem? Edit: how about a response instead of a downnvote, anonymous detractor?
- mbrumlow 7y ago
  EDIT: guidelines As a note, I think there are probably better crypto technologies these days, but none of them do what pgp aimed to do, but rather we have a bunch of smaller tools that do small parts that pgp did. I am not going to send you a singed file over singal, and I think it is silly to have to use a alternative means of sending the file that will either remove the ability for authenticity, or require me to do the authentication dance again with you. PGP suffers from bad tooling, and further suffers from the relentless onslaught of people who want fancy electron or phone apps that can only do a small % of what pgp would allow. Final note, I think something better than PGP could exist, but nobody has made it yet. In either case, validating keys will always be a hard problem and any attempt to automate it will result in false sense of security. While end to end encryption will keep on lookers from viewing your communications -- you just might find out one day you are talking directly to the people you were trying to hind your communication from.
  - tptacek 7y ago
    First, the guidelines ask you not to talk about downvotes. You can find out more about that by reading the guidelines. Secondly, Signal sends files just fine, and does so more securely than GPG. If you don't want to use Signal to do that, you can also use Magic Wormhole, which also works better and is more secure than PGP.
intricatedetail 7y ago
If you need ultimate privacy and true end to end encryption , PGP is your tool. You can use over channels you don't trust, e.g. you can easily send PGP messages over Signal or other messenger you can't verify. Only people to discourage use of PGP would be gov reps, as you can choke messenger company to give you a tap to messages, but if someone uses PGP over it, tough luck.
madez 7y ago
> Don't use PGP. How else do you recommend to independently establish a verifiable identity?