4 ms·

IMO, encrypted e-mail is a dead end. Latacora has a good blog post about it that I highly recommend: https://latacora.micro.blog/2020/02/19/stop-using-encrypted

by cpach 7y ago

IMO, encrypted e-mail is a dead end. Latacora has a good blog post about it that I highly recommend: https://latacora.micro.blog/2020/02/19/stop-using-encrypted.html https://latacora.micro.blog/2020/02/19/stop-using-encrypted....

gwd 7y ago
That post should really be called, "Stop using email". Which is fine when you don't need something like email. But sometimes you do.
- qqii 7y ago
  Although I agree with your point, both the article and your comment suffer from different use cases + threat models. I'd agree that there are no real alternatives to (regular) mail and email where longer form asynchronous communication can occur without the expectation of an instant reply. Unfortunately when it comes to this form of communication the reality is that there aren't any widely used alternatives that don't leak as much metadata as email.
dr_hooo 7y ago
Hmm, I don't really see any really convincing points, or workable alternatives that your linked article provides. Nevertheless I would like to read more about this claim: > It [PGP] was designed in the 1990s, and in the 20 years since it became popular, cryptography has advanced in ways that PGP has not kept up with. So, for example, it recently turned out to be possible for eavesdroppers to decrypt messages without a key, simply by tampering with encrypted messages. Most technologists who work with PGP don’t understand it at a low enough level to see what’s wrong with it. (I admit I am one of these technologists)
- dependenttypes 7y ago
  It is talking about things like efail.
- upofadown 7y ago
  My best guess is that they really meant EFAIL but didn't want to actually mention it because EFAIL had nothing to do with any weakness in the OpenPGP standard or the GnuPG implementation. Instead it was a HTML email horror story where someone figured out how to forward entire decrypted messages using image links. So just more pointless anti-PGP innuendo...
  - tptacek 7y ago
    That is not in fact a good description of EFail, which was indeed caused by a failure both of the PGP protocol and of GPG, its reference implementation.
    - upofadown 7y ago
      >...a failure both of the PGP protocol ... No. There were some changes in the actual protocol document that came out of EFAIL but no actual changes to the protocol other than a depreciation that was happening anyway. >...and of GPG, ... This also seems to be false. GPG didn't have to change anything as the result of EFAIL... >...its reference implementation. Also false. OpenPGP does not have a reference implementation.
      - tptacek 7y ago
        There were no changes in TLS after Bleichenbacher '98; instead, implementations just incorporated increasingly hacky workarounds. The PGP post upthread details the problems with the MDC, and the compounding implementation flaw in GPG that released unauthenticated plaintext to callers. That MDC-era PGP remains the global standard, and that GPG continues to release unauthenticated plaintext to callers, just calls out further the impossibly compromised position PGP-based cryptosystems are in. You can try to do things like Sequoia that modernize PGP, but nobody in the installed base will be compatible with you, and the most popular and important "driver" of the protocol (again, GPG) is disinterested in mitigating the flaws of legacy PGP. You can choose not to call GPG the PGP reference implementation, and there's no formal declaration anywhere saying that, but, it obviously is.
steerablesafe 7y ago
Whenever someone criticizes email encryption they fail to provide an actual replacement. Encrypted instant messaging is an alternative, but it's not a replacement.
- m-p-3 7y ago
  And yet encrypted instant messaging would have the same pitfalls if the platforms where federated like email is. It only works well and seamlessly because it works within a single provider.
  - upofadown 7y ago
    What about OMEMO?
laumars 7y ago
PGP is used for more than just email
- qqii 7y ago
  The writer of the article wrote another one that is linked where he criticises other uses of PGP[0]. [0]: https://latacora.micro.blog/2019/07/16/the-pgp-problem.html https://latacora.micro.blog/2019/07/16/the-pgp-problem.html
  - jeltz 7y ago
    Some of those issues are just properties of GPG and could be fixed by an alternative implementation, while others look inherent to the standard.
- m-p-3 7y ago
  Agreed, can be used for signing git and other stuff. PGP isn't only about encryption, it's also about authentication and integrity.
tptacek 7y ago
I wrote an actual piece about PGP: https://latacora.micro.blog/2019/07/16/the-pgp-problem.html https://latacora.micro.blog/2019/07/16/the-pgp-problem.html I stand by what I wrote in this post as well, but it's not a good first read for people surprised that cryptographers hate PGP.
- cpach 7y ago
  Perhaps I should have linked to both essays. People should read them both :) The reason I linked to the other one was that encrypted mails is the first use case listed on the Sequoia site.

by cpach 7y ago

gwd 7y ago

That post should really be called, "Stop using email". Which is fine when you don't need something like email. But sometimes you do.

qqii 7y ago
Although I agree with your point, both the article and your comment suffer from different use cases + threat models. I'd agree that there are no real alternatives to (regular) mail and email where longer form asynchronous communication can occur without the expectation of an instant reply. Unfortunately when it comes to this form of communication the reality is that there aren't any widely used alternatives that don't leak as much metadata as email.

dr_hooo 7y ago

Hmm, I don't really see any really convincing points, or workable alternatives that your linked article provides. Nevertheless I would like to read more about this claim: > It [PGP] was designed in the 1990s, and in the 20 years since it became popular, cryptography has advanced in ways that PGP has not kept up with. So, for example, it recently turned out to be possible for eavesdroppers to decrypt messages without a key, simply by tampering with encrypted messages. Most technologists who work with PGP don’t understand it at a low enough level to see what’s wrong with it. (I admit I am one of these technologists)

dependenttypes 7y ago
It is talking about things like efail.
upofadown 7y ago
My best guess is that they really meant EFAIL but didn't want to actually mention it because EFAIL had nothing to do with any weakness in the OpenPGP standard or the GnuPG implementation. Instead it was a HTML email horror story where someone figured out how to forward entire decrypted messages using image links. So just more pointless anti-PGP innuendo...
- tptacek 7y ago
  That is not in fact a good description of EFail, which was indeed caused by a failure both of the PGP protocol and of GPG, its reference implementation.
  - upofadown 7y ago
    >...a failure both of the PGP protocol ... No. There were some changes in the actual protocol document that came out of EFAIL but no actual changes to the protocol other than a depreciation that was happening anyway. >...and of GPG, ... This also seems to be false. GPG didn't have to change anything as the result of EFAIL... >...its reference implementation. Also false. OpenPGP does not have a reference implementation.
    - tptacek 7y ago
      There were no changes in TLS after Bleichenbacher '98; instead, implementations just incorporated increasingly hacky workarounds. The PGP post upthread details the problems with the MDC, and the compounding implementation flaw in GPG that released unauthenticated plaintext to callers. That MDC-era PGP remains the global standard, and that GPG continues to release unauthenticated plaintext to callers, just calls out further the impossibly compromised position PGP-based cryptosystems are in. You can try to do things like Sequoia that modernize PGP, but nobody in the installed base will be compatible with you, and the most popular and important "driver" of the protocol (again, GPG) is disinterested in mitigating the flaws of legacy PGP. You can choose not to call GPG the PGP reference implementation, and there's no formal declaration anywhere saying that, but, it obviously is.

steerablesafe 7y ago

Whenever someone criticizes email encryption they fail to provide an actual replacement. Encrypted instant messaging is an alternative, but it's not a replacement.

m-p-3 7y ago
And yet encrypted instant messaging would have the same pitfalls if the platforms where federated like email is. It only works well and seamlessly because it works within a single provider.
- upofadown 7y ago
  What about OMEMO?

laumars 7y ago

PGP is used for more than just email

qqii 7y ago
The writer of the article wrote another one that is linked where he criticises other uses of PGP[0]. [0]: https://latacora.micro.blog/2019/07/16/the-pgp-problem.html https://latacora.micro.blog/2019/07/16/the-pgp-problem.html
- jeltz 7y ago
  Some of those issues are just properties of GPG and could be fixed by an alternative implementation, while others look inherent to the standard.
m-p-3 7y ago
Agreed, can be used for signing git and other stuff. PGP isn't only about encryption, it's also about authentication and integrity.

tptacek 7y ago

I wrote an actual piece about PGP: https://latacora.micro.blog/2019/07/16/the-pgp-problem.html https://latacora.micro.blog/2019/07/16/the-pgp-problem.html I stand by what I wrote in this post as well, but it's not a good first read for people surprised that cryptographers hate PGP.

cpach 7y ago
Perhaps I should have linked to both essays. People should read them both :) The reason I linked to the other one was that encrypted mails is the first use case listed on the Sequoia site.