4 ms·

PGP support in an email client is worse than nothing. https://latacora.micro.blog/2019/07/16/the-pgp-problem.html https://latacora.micro.blog/2019/07/16/the-pgp

PGP support in an email client is worse than nothing. https://latacora.micro.blog/2019/07/16/the-pgp-problem.html https://latacora.micro.blog/2019/07/16/the-pgp-problem.html > Email is insecure. Even with PGP, it’s default-plaintext, which means that even if you do everything right, some totally reasonable person you mail, doing totally reasonable things, will invariably CC the quoted plaintext of your encrypted message to someone else (we don’t know a PGP email user who hasn’t seen this happen). PGP email is forward-insecure. Email metadata, including the subject (which is literally message content), are always plaintext. In 2020, someone should know better than to to add pretend encryption to email. The metadata leaks alone should lead you to conclude that this isn't worth doing. Don't use email for secure communications, period. Use a secure messaging app like Signal, instead.

bsder 7y ago
> even if you do everything right, some totally reasonable person you mail, doing totally reasonable things, will invariably CC the quoted plaintext of your encrypted message to someone else (we don’t know a PGP email user who hasn’t seen this happen). I agree with the other complaints but not this one. If my human client, who demanded I use PGP, does something stupid with the email, that is not my problem (The bits are colored blue like you asked--the fact that you uncolored them again is your fault). People forget that computer tasks in the real world are often more about liability transfer than actual security.
- dfabulich 7y ago
  It is your problem, because it was your secret, and the human client just inadvertently revealed it. Instead, you both should have used a secure messaging app like Signal, which doesn't have a prominent UI button to forward messages in plain text.
acqq 7y ago
Whoever wrote what you quoted avoided to mention that the plugin (and I’d expect this new implementation) can protect the user from replying in plaintext to the encrypted message. And using PGP in some scenarios has an advantage for the users and is indeed less convenient for eavesdroppers. It seems that the later are especially motivated to promote fear against PGP.
- dfabulich 7y ago
  "The plugin" (which plugin? I'm referring to the GPG plugin for macOS mail) doesn't prevent forwarding as far as I can see. The point isn't "use non-PGP email", the point is "don't use email at all for secure communications. Use a secure messaging app instead."
  - heavenlyblue 7y ago
    So let’s say I copy a message from WhatsApp to a message board, does that disqualify WhatsApp from being a “secure messaging app”?
    - dfabulich 7y ago
      The point isn't that you forwarded the secret (indeed, that was on purpose). The point is that you forwarded the secret in plaintext, because email is plaintext by default, and the forwarding person probably didn't realize that, because no email client (even with GPG plugins) posts a big red warning label saying "stop! this is plaintext" because that's 99% of all emails.
      - acqq 7y ago
        > because no email client (even with GPG plugins) posts a big red warning label saying "stop! this is plaintext" I've used a plugin that did exactly that: warned when the encrypted e-mail is replied to or forwarded as plain text. If such a plugin is not commonly used with e-mail clients that can't be a proof that e-mail encryption is inherently bad, just that that feature should exist. Mozilla implementers, I hope you're inspired.
- tptacek 7y ago
  That'd be me, and I avoided to mention that because it doesn't matter. People aren't making up the plaintext-reply problem; a person on HN that tells me they've never seen it is more loudly communicating that they rarely actually use PGP.
tzs 7y ago
> The metadata leaks alone should lead you to conclude that this isn't worth doing I don't buy that argument. Every time I can remember where I've wanted to use email encryption has been a situation where I was fine with the metadata leaks. E.g., it was email to someone I regularly correspond with, on a subject we regularly correspond on, at a time when we would be expected to be corresponding on this subject. It only differed from our normal correspondence in that I had one or two things I wanted to include in the body that were more sensitive than normal.
- tptacek 7y ago
  Like Key Compromise Impersonation in a serious cryptosystem, metadata leaks are just a design flaw. They might not matter in most or even many situations, but when they do matter, they matter a lot. There is no reason to have them; we accept them in PGP because we unduly venerate a 1990s protocol that people have used to organize IRL parties. The two real reasons to avoid encrypted email are: 1. There's no realistic way to do it with forward secrecy, so any point-in-time compromise of a key --- which is inevitable --- will decrypt every message ever sent through that user. 2. Email is default-plaintext, and most people who have used PGP or S/MIME "at scale" have seen people repeatedly forget or misconfigure and send plaintext replies to encrypted emails, often with the plaintext of previous messages quoted. Both of those reasons are, for me, dispositive.
tptacek 7y ago
To be clear: the argument for "worse than nothing" is: 1. PGP email is easy to screw up, even with client support. 2. If you need PGP to work, those screwups are life-threatening. This isn't an abstraction or a just-so argument. PGP team members have, in the recent past, discussed how DoS attacks on their keyservers were upsetting because dissidents in specific, murderously authoritarian countries were ostensibly relying on PGP. (They mostly aren't, by the way; they use Telegram, which I trust even less. At least I believe the PGP people mean well.)
jcranmer 7y ago
Saying you shouldn't use PGP isn't the same as saying an email client shouldn't support it. There are few exceedingly narrow use cases for secure email (where "thou must use email" is requirement #1). So minimal support for decryption of email (and understanding application/pkcs7-signature) isn't necessarily a bad thing. And while you're doing it, you might try to make the UX harder for people to do things like quote encrypted text in plaintext messages. But I do think it's improper to make ease of PGP or S/MIME use a primary touted feature, and I wouldn't recommend its use to lay users. In other words, support it, but don't advocate it. (I am probably in disagreement with the rest of the Thunderbird team here).
dngray 7y ago
> PGP support in an email client is worse than nothing. https://latacora.micro.blog/2019/07/16/the-pgp-problem.html https://latacora.micro.blog/2019/07/16/the-pgp-problem.html Often who you're talking to is not sensitive. What you were talking about on the other hand might be. https://arstechnica.com/information-technology/2016/12/signal-does-not-replace-pgp/ https://arstechnica.com/information-technology/2016/12/signa... With things like MTA-STS and DANE we're only gonna get metadata leaks really to the mail servers themselves. > Don't use email for secure communications, period. Use a secure messaging app like Signal, instead. This assumes you're okay in giving everyone your phone number. What if you do that and then one of your contacts starts calling you all the time? So then it's suggested to have two SIM cards. Here in my country that either means post paid paying a monthly bill or pre paid, and having to recharge it or lose it. It's not like we haven't seem SIM jacking related attacks either. Phone numbers are a really terrible identifier. I am also curious to know what will happen if the US/UK ever passes laws like Australia did. Signal LLC is American, and therefore would have to comply with the laws there if they ever passed something like Australia did. Realistically if we're going to throw PGP out, we shouldn't be suggesting centralized systems as an alternative. Has anyone forgotten about William Barr? He's been trying all year to get backdoor in Whatsapp E2EE, the same E2EE used by Signal.
- Tomte 7y ago
  > What if you do that and then one of your contacts starts calling you all the time? The same as if they start emailing you all the time: you block them. And since phone numbers are harder and costlier to just generate and use, that block is more meaningful blocking an email address.
  - dngray 7y ago
    > The same as if they start emailing you all the time: you block them. > And since phone numbers are harder and costlier to just generate and use, that block is more meaningful blocking an email address. You might think that but throwaway phone numbers can be bought cheap for the purpose of spamming. I cannot think last when I got spam emails in my inbox. I can however think of when I got spam SMSes. It's also obviously cheap enough they can use robots to say things too. Could this be because someone who knew my number had a compromised phone? quite possibly. I am not very happy about Facebook having my phone number even though I don't have an account with them.

bsder 7y ago

> even if you do everything right, some totally reasonable person you mail, doing totally reasonable things, will invariably CC the quoted plaintext of your encrypted message to someone else (we don’t know a PGP email user who hasn’t seen this happen). I agree with the other complaints but not this one. If my human client, who demanded I use PGP, does something stupid with the email, that is not my problem (The bits are colored blue like you asked--the fact that you uncolored them again is your fault). People forget that computer tasks in the real world are often more about liability transfer than actual security.

dfabulich 7y ago
It is your problem, because it was your secret, and the human client just inadvertently revealed it. Instead, you both should have used a secure messaging app like Signal, which doesn't have a prominent UI button to forward messages in plain text.

acqq 7y ago

Whoever wrote what you quoted avoided to mention that the plugin (and I’d expect this new implementation) can protect the user from replying in plaintext to the encrypted message. And using PGP in some scenarios has an advantage for the users and is indeed less convenient for eavesdroppers. It seems that the later are especially motivated to promote fear against PGP.

dfabulich 7y ago
"The plugin" (which plugin? I'm referring to the GPG plugin for macOS mail) doesn't prevent forwarding as far as I can see. The point isn't "use non-PGP email", the point is "don't use email at all for secure communications. Use a secure messaging app instead."
- heavenlyblue 7y ago
  So let’s say I copy a message from WhatsApp to a message board, does that disqualify WhatsApp from being a “secure messaging app”?
  - dfabulich 7y ago
    The point isn't that you forwarded the secret (indeed, that was on purpose). The point is that you forwarded the secret in plaintext, because email is plaintext by default, and the forwarding person probably didn't realize that, because no email client (even with GPG plugins) posts a big red warning label saying "stop! this is plaintext" because that's 99% of all emails.
    - acqq 7y ago
      > because no email client (even with GPG plugins) posts a big red warning label saying "stop! this is plaintext" I've used a plugin that did exactly that: warned when the encrypted e-mail is replied to or forwarded as plain text. If such a plugin is not commonly used with e-mail clients that can't be a proof that e-mail encryption is inherently bad, just that that feature should exist. Mozilla implementers, I hope you're inspired.
tptacek 7y ago
That'd be me, and I avoided to mention that because it doesn't matter. People aren't making up the plaintext-reply problem; a person on HN that tells me they've never seen it is more loudly communicating that they rarely actually use PGP.

tzs 7y ago

> The metadata leaks alone should lead you to conclude that this isn't worth doing I don't buy that argument. Every time I can remember where I've wanted to use email encryption has been a situation where I was fine with the metadata leaks. E.g., it was email to someone I regularly correspond with, on a subject we regularly correspond on, at a time when we would be expected to be corresponding on this subject. It only differed from our normal correspondence in that I had one or two things I wanted to include in the body that were more sensitive than normal.

tptacek 7y ago
Like Key Compromise Impersonation in a serious cryptosystem, metadata leaks are just a design flaw. They might not matter in most or even many situations, but when they do matter, they matter a lot. There is no reason to have them; we accept them in PGP because we unduly venerate a 1990s protocol that people have used to organize IRL parties. The two real reasons to avoid encrypted email are: 1. There's no realistic way to do it with forward secrecy, so any point-in-time compromise of a key --- which is inevitable --- will decrypt every message ever sent through that user. 2. Email is default-plaintext, and most people who have used PGP or S/MIME "at scale" have seen people repeatedly forget or misconfigure and send plaintext replies to encrypted emails, often with the plaintext of previous messages quoted. Both of those reasons are, for me, dispositive.

tptacek 7y ago

To be clear: the argument for "worse than nothing" is: 1. PGP email is easy to screw up, even with client support. 2. If you need PGP to work, those screwups are life-threatening. This isn't an abstraction or a just-so argument. PGP team members have, in the recent past, discussed how DoS attacks on their keyservers were upsetting because dissidents in specific, murderously authoritarian countries were ostensibly relying on PGP. (They mostly aren't, by the way; they use Telegram, which I trust even less. At least I believe the PGP people mean well.)

jcranmer 7y ago

Saying you shouldn't use PGP isn't the same as saying an email client shouldn't support it. There are few exceedingly narrow use cases for secure email (where "thou must use email" is requirement #1). So minimal support for decryption of email (and understanding application/pkcs7-signature) isn't necessarily a bad thing. And while you're doing it, you might try to make the UX harder for people to do things like quote encrypted text in plaintext messages. But I do think it's improper to make ease of PGP or S/MIME use a primary touted feature, and I wouldn't recommend its use to lay users. In other words, support it, but don't advocate it. (I am probably in disagreement with the rest of the Thunderbird team here).

dngray 7y ago

> PGP support in an email client is worse than nothing. https://latacora.micro.blog/2019/07/16/the-pgp-problem.html https://latacora.micro.blog/2019/07/16/the-pgp-problem.html Often who you're talking to is not sensitive. What you were talking about on the other hand might be. https://arstechnica.com/information-technology/2016/12/signal-does-not-replace-pgp/ https://arstechnica.com/information-technology/2016/12/signa... With things like MTA-STS and DANE we're only gonna get metadata leaks really to the mail servers themselves. > Don't use email for secure communications, period. Use a secure messaging app like Signal, instead. This assumes you're okay in giving everyone your phone number. What if you do that and then one of your contacts starts calling you all the time? So then it's suggested to have two SIM cards. Here in my country that either means post paid paying a monthly bill or pre paid, and having to recharge it or lose it. It's not like we haven't seem SIM jacking related attacks either. Phone numbers are a really terrible identifier. I am also curious to know what will happen if the US/UK ever passes laws like Australia did. Signal LLC is American, and therefore would have to comply with the laws there if they ever passed something like Australia did. Realistically if we're going to throw PGP out, we shouldn't be suggesting centralized systems as an alternative. Has anyone forgotten about William Barr? He's been trying all year to get backdoor in Whatsapp E2EE, the same E2EE used by Signal.

Tomte 7y ago
> What if you do that and then one of your contacts starts calling you all the time? The same as if they start emailing you all the time: you block them. And since phone numbers are harder and costlier to just generate and use, that block is more meaningful blocking an email address.
- dngray 7y ago
  > The same as if they start emailing you all the time: you block them. > And since phone numbers are harder and costlier to just generate and use, that block is more meaningful blocking an email address. You might think that but throwaway phone numbers can be bought cheap for the purpose of spamming. I cannot think last when I got spam emails in my inbox. I can however think of when I got spam SMSes. It's also obviously cheap enough they can use robots to say things too. Could this be because someone who knew my number had a compromised phone? quite possibly. I am not very happy about Facebook having my phone number even though I don't have an account with them.