5 ms·

End-to-end encryption is still a very challenging problem almost everywhere except for direct connection server-side TLS. Yet, everyone has a problem that encry

by bdamm 7y ago

End-to-end encryption is still a very challenging problem almost everywhere except for direct connection server-side TLS. Yet, everyone has a problem that encryption solves, which is that you actually cannot if some entity has been interfering with your email, perhaps re-writing certain paragraphs. There is plenty of evidence that actually interfering with email is in fact something that happens. Similarly, in the age before widespread use of TLS, cases of ISPs injecting content/javascript/trackers into web traffic was also widespread.

hoistbypetard 7y ago
Encryption is not signing, and relying on it to tell if someone has interfered with the content of a document has a track record of disaster. You need to rely on signing for that. Even if you're using an encryption scheme that claims to preserve integrity. Signing is easier, because only the sender needs to set it up for it to be effective. At any rate, I think I see your point, and that's why I chose the word "suffered." People have suffered from not using server side TLS. Practically no one knows of any consequence they've suffered for sticking to plaintext email.
- inetknght 7y ago
  > Practically no one knows of any consequence they've suffered for sticking to plaintext email. Quite the contrary. Unauthenticated plaintext email is a major vector for malware and phishing.
  - hoistbypetard 7y ago
    Encryption does not do a thing to prevent malware or phishing. Quite the contrary, it prevents the various middle boxes we have scanning our email from scanning for malware or phishing attempts. There are signing schemes that could help, but they'd not help much if the mail were encrypted before signing unless you're imagining client implementations wildly different than what we see today.
matheusmoreira 7y ago
> End-to-end encryption is still a very challenging problem almost everywhere except for direct connection server-side TLS. Is this the case with WhatsApp and Signal? Their implementations have been working great. Why can't email work the same way? > There is plenty of evidence that actually interfering with email is in fact something that happens. Please cite examples. I know Avast antivirus used to obnoxiously tamper with the emails sent by users in order to spam other people with its own advertising.
- upofadown 7y ago
  WhatsApp and Signal require the user to verify some identity numbers to prevent MITM attacks. No one does that. If you are OK with that level of protection then everything gets easy, even email encryption.
  - johannes1234321 7y ago
    It works a little better - it tells me when "the security code" changes. Thus an unnoticed mitm attack has to begin at the beginning of the conversation or at a plausible change of the device. The attacker must be ready to intercept the "you got a new phone? Which one did you get? How broke the previous one?" and keep the conversation plausible. There are certainly targets where such attacks are relevant, but for many it's quite good.
- lmm 7y ago
  > Is this the case with WhatsApp and Signal? Their implementations have been working great. Why can't email work the same way? The ratchet protocol that that approach relies on requires both ends to be online at the same time. And those implementations haven't been working great. WhatsApp was definitely compromisable by an attacker who had access to the server. I have yet to be convinced that Signal couldn't be; all the descriptions of its protocol are suspiciously ambiguous about whether the attacker is assumed to control the server or the server is trusted (since the server has to be involved in allowing offline messages to work). Furthermore we've seen nothing to suggest that the NSA isn't reading WhatsApp/Signal messages; given that those systems are tightly coupled to closed-source ecosystems (and in particular closed-source "random" sources for key generation) I suspect that serious adversaries aren't even trying to attack their cryptography directly. Contrast with PGP where we know (from Snowden's leaks) that the NSA was frustrated by their inability to break it when used properly.

by bdamm 7y ago

hoistbypetard 7y ago

Encryption is not signing, and relying on it to tell if someone has interfered with the content of a document has a track record of disaster. You need to rely on signing for that. Even if you're using an encryption scheme that claims to preserve integrity. Signing is easier, because only the sender needs to set it up for it to be effective. At any rate, I think I see your point, and that's why I chose the word "suffered." People have suffered from not using server side TLS. Practically no one knows of any consequence they've suffered for sticking to plaintext email.

inetknght 7y ago
> Practically no one knows of any consequence they've suffered for sticking to plaintext email. Quite the contrary. Unauthenticated plaintext email is a major vector for malware and phishing.
- hoistbypetard 7y ago
  Encryption does not do a thing to prevent malware or phishing. Quite the contrary, it prevents the various middle boxes we have scanning our email from scanning for malware or phishing attempts. There are signing schemes that could help, but they'd not help much if the mail were encrypted before signing unless you're imagining client implementations wildly different than what we see today.

matheusmoreira 7y ago

> End-to-end encryption is still a very challenging problem almost everywhere except for direct connection server-side TLS. Is this the case with WhatsApp and Signal? Their implementations have been working great. Why can't email work the same way? > There is plenty of evidence that actually interfering with email is in fact something that happens. Please cite examples. I know Avast antivirus used to obnoxiously tamper with the emails sent by users in order to spam other people with its own advertising.

upofadown 7y ago
WhatsApp and Signal require the user to verify some identity numbers to prevent MITM attacks. No one does that. If you are OK with that level of protection then everything gets easy, even email encryption.
- johannes1234321 7y ago
  It works a little better - it tells me when "the security code" changes. Thus an unnoticed mitm attack has to begin at the beginning of the conversation or at a plausible change of the device. The attacker must be ready to intercept the "you got a new phone? Which one did you get? How broke the previous one?" and keep the conversation plausible. There are certainly targets where such attacks are relevant, but for many it's quite good.
lmm 7y ago
> Is this the case with WhatsApp and Signal? Their implementations have been working great. Why can't email work the same way? The ratchet protocol that that approach relies on requires both ends to be online at the same time. And those implementations haven't been working great. WhatsApp was definitely compromisable by an attacker who had access to the server. I have yet to be convinced that Signal couldn't be; all the descriptions of its protocol are suspiciously ambiguous about whether the attacker is assumed to control the server or the server is trusted (since the server has to be involved in allowing offline messages to work). Furthermore we've seen nothing to suggest that the NSA isn't reading WhatsApp/Signal messages; given that those systems are tightly coupled to closed-source ecosystems (and in particular closed-source "random" sources for key generation) I suspect that serious adversaries aren't even trying to attack their cryptography directly. Contrast with PGP where we know (from Snowden's leaks) that the NSA was frustrated by their inability to break it when used properly.