7 ms·

That is the single most common misconception around PGP, and it comes up every time: (Open)PGP is first and foremost a flexible packet format (and other specs)

by rendx 6y ago

That is the single most common misconception around PGP, and it comes up every time: (Open)PGP is first and foremost a flexible packet format (and other specs), and GnuPG is more of a CLI "library" to interface with it -- all of it. You can build something that hides metadata, you can have forward secrecy, and encryption always-on by default with PGP (and GnuPG). You can use it for whatever trust model you want, neither OpenPGP (the specs) nor GnuPG prescribe a certain model. It provides building blocks. It just happens that no good client exists and no more high level specs were written that use it, which is highly unfortunate. The client in this case here used to be "Enigmail" (a wrapper around GnuPG), and now is built-in since plugins are not allowed to be as powerful with the new browser architecture that Thunderbird piggybacks on and this was the only way to bring PGP to Thunderbird users. Also, there are some more modern libraries nowadays for standard use cases around PGP. Signal was able to move faster since it did not exist, did not try to build things in an open and collaborative fashion, still refuses to work in any open way. Its founder Moxie even openly argues against standards [x]. I am not saying he does not have "a point", but in the long run this will lead to just more silos and ultimately technical stagnation, and for me goes against the ethos of "a public and open inter-net." (and the learnings behind it. 'Those who cannot remember the past are condemned to repeat it.') That said, I do agree with your comment on a pure end-user level. It still makes me sad to always see this confused and not acknowledged better in places like HN, where people "should know". Technologists can defend and strive for the most promising long-term solution and "proper way to do it", and at the same time recommend "the best of the bad that is currently available". Even if it is confusing sometimes. Just to give an example, there are plenty of high security use cases that require using smartcards. I'm very grateful that the OpenPGP standard and GnuPG exist that (can be made to) work in such cases. Signal does nothing in that space, rightfully so. But you are comparing different fruit to each other, which is kind of unfair. [x] and still calls himself an "anarchist". You would think those know better...

skyfaller 6y ago
I understand that PGP doesn't have to be used with email. That is why I haven't commented on PGP, I'm saying that I think encrypted email is a bad idea, regardless of whether you use PGP or something else. We're posting in a thread about Thunderbird, an e-mail client :) I agree that one great weakness of Signal is its centralization, and that decentralization is a great strength of email. For a decentralized encrypted communication channel, Matrix may become a good option now that it is encrypted by default, but I haven't studied carefully the quality of its encryption beyond that yet. Regardless, I really do think a new protocol is required for secure communications and that email won't cut it. If Signal or Matrix can't do the job for some applications, we'll just have to try again. I cannot recommend email for secure communications, and in any situation where security matters, I have to prioritize people's safety. In terms of security, the best that is available in the realm of encrypted email is not and cannot be good enough.
- kd5bjo 6y ago
  For future reference, statements like this: > I used to love [A], but I now think [B] is a bad idea. will lead many people to think that you consider A and B to be essentially the same thing. In the specific case of PGP and encrypted email, this is a category error: you are implying (perhaps unintentionally) that PGP’s only use is for encrypted email.
  - skyfaller 6y ago
    Fair enough, I've updated my top comment with an attempt to clarify.
  - bootcampwhere 6y ago
    Dude, come on...
pvg 6y ago
(Open)PGP is first and foremost a flexible packet format That makes an even better case that PGP is not much of a modern secure system generally, rather than it just being bad for secure email.
- rendx 6y ago
  Because packet formats are bad? I don't understand what you're trying to say here.
  - pvg 6y ago
    Because a flexible 'format' or 'model' or whatever with which you can construct insecure systems or (hypothetically) secure systems, is not really useful, it ends up being inherently insecure.
  - owenmarshall 6y ago
    Flexibility in cryptography is often very bad and opens doors to downgrade attacks or things like JWT’s alg:none issues. https://www.imperialviolet.org/2016/05/16/agility.html https://www.imperialviolet.org/2016/05/16/agility.html “Have one joint, and keep it well oiled.”
    - upofadown 6y ago
      The linked article is all about protecting data in flight like in the TLS case. PGP is all about protecting data at rest. The two applications are fundamentally different.
      - pvg 6y ago
        I think you're misunderstanding the general complaint or maybe not the complaint but how general, rather than specific it is. At the top of the thread someone says 'PGP has all this ancient cruft and also isn't good for email/email is maybe unsecurable anyway'. The PGP-enthusiast response to that is 'No problem! You see, PGP is so flexible, you can build anything out of it, including maybe an actually-secure system of some sort'. This is a fundamentally inadequate response and we've realized it's inadequate and don't really design secure systems like that anymore. In fact, this class of concern has permeated almost all aspects of contemporary software systems design rather than being something narrowly limited to 'crypto algo agility is bad'. Here's an example/illustrative timeline that doesn't have anything to do with 'data at rest'. 1998 Netscape: Behold our cross-platform, cross-language super-toolkit for building super-extensible Enterprise Groupware apps. Also one of them is a web browser! 2015 Mozilla: [belated forehead slap] This is a terrible way to architect a web browser that has any hope of offering end-user security.
Quekid5 6y ago
> GnuPG is more of a CLI "library" to interface with it It abjectly fails at that. It's just awful to interface with.
- rlpb 6y ago
  Who said that it's for a user to interface with directly? mutt interfaces with it perfectly fine, and mutt's PGP UX is also fine.
- rendx 6y ago
  Agreed. It has been long overdue that alternative OpenPGP implementations exist that try to address some of the peculiarities of GnuPG -- most of which are [still] there because its founder wants to preserve compatibility at all costs to support some of its long-term institutional users. And, yes, dealing with these peculiarities should not the responsibility of end users, but of further abstraction layers built on top of it (of which there are only a few, and all of them focused on the email use case). The constant confusion between OpenPGP (the standard) and GnuPG (one implementation) has led many users to look elsewhere, which is unfortunate, but has also led many developers to look elsewhere, which is just sad. Yes, trying to work within the existing standardization bodies can be very painful and disheartening, but the few people who try and survive in that space can use every good soul willing to assist. The OpenPGP community has done hundred times more than Signal for the state of security on the Internet, and I'm sure it will continue to do so. Signal is great, and pushed the limits quite far (and still does), and I'm very grateful that it exists and use it every day.
  - btilly 6y ago
    The OpenPGP community would do more for security if they listened to serious cryptographers and began recommending better solutions. See https://latacora.micro.blog/2019/07/16/the-pgp-problem.html https://latacora.micro.blog/2019/07/16/the-pgp-problem.html for more on that. And it isn't hard to find lots and lots of cryptographers agreeing with the thesis.
    - ifmpx 6y ago
AlexCoventry 6y ago
> Moxie even openly argues against standards [x] and still calls himself an "anarchist". On the face of it, that sounds like exactly the position an anarchist would take...
- rendx 6y ago
  If you believe in abolishing hierarchy and institutions where they have no legitimacy, _all_ you are left with is communication, community, and open standardization as practiced in anarchist bodies such as the IETF.
  - cwyers 6y ago
    > anarchist bodies such as the IETF That's an incredibly... unconventional read on the IETF.
    - bjoli 6y ago
      Not really. I know very little about both anarchy and the IETF, but voluntary organisation (as in opposed to wage slavery) and a democratic governing of the group is very much in line with many anarchistic schools. Edit: language fixes. English is not my language of choice for discussing things like this...
- int_19h 6y ago
  Anarchists would be philosophically opposed to top-down, mandated standards, not standards in general.
tptacek 6y ago
This is a weird argument. By your logic, there's practically no cryptosystem PGP can't be; after all, it's an omnibus standard to which people routinely add extensions for new algorithms. Want a double ratchet? An elliptic curve triple handshake? The "building blocks" are all there, all you have to do is use PGP's "flexible packet format" to carry them.
- ifmpx 6y ago
  This is an interesting interpretation of what he stated. What I got from it is that the strength of PGP is in its flexibility and that it gains that flexibility from being standardized and open. Of course you can extend PGP (or any protocol really) to include cryptographic handshakes, but that's besides the point.

by rendx 6y ago

skyfaller 6y ago

I understand that PGP doesn't have to be used with email. That is why I haven't commented on PGP, I'm saying that I think encrypted email is a bad idea, regardless of whether you use PGP or something else. We're posting in a thread about Thunderbird, an e-mail client :) I agree that one great weakness of Signal is its centralization, and that decentralization is a great strength of email. For a decentralized encrypted communication channel, Matrix may become a good option now that it is encrypted by default, but I haven't studied carefully the quality of its encryption beyond that yet. Regardless, I really do think a new protocol is required for secure communications and that email won't cut it. If Signal or Matrix can't do the job for some applications, we'll just have to try again. I cannot recommend email for secure communications, and in any situation where security matters, I have to prioritize people's safety. In terms of security, the best that is available in the realm of encrypted email is not and cannot be good enough.

kd5bjo 6y ago
For future reference, statements like this: > I used to love [A], but I now think [B] is a bad idea. will lead many people to think that you consider A and B to be essentially the same thing. In the specific case of PGP and encrypted email, this is a category error: you are implying (perhaps unintentionally) that PGP’s only use is for encrypted email.
- skyfaller 6y ago
  Fair enough, I've updated my top comment with an attempt to clarify.
- bootcampwhere 6y ago
  Dude, come on...

pvg 6y ago

(Open)PGP is first and foremost a flexible packet format That makes an even better case that PGP is not much of a modern secure system generally, rather than it just being bad for secure email.

rendx 6y ago
Because packet formats are bad? I don't understand what you're trying to say here.
- pvg 6y ago
  Because a flexible 'format' or 'model' or whatever with which you can construct insecure systems or (hypothetically) secure systems, is not really useful, it ends up being inherently insecure.
- owenmarshall 6y ago
  Flexibility in cryptography is often very bad and opens doors to downgrade attacks or things like JWT’s alg:none issues. https://www.imperialviolet.org/2016/05/16/agility.html https://www.imperialviolet.org/2016/05/16/agility.html “Have one joint, and keep it well oiled.”
  - upofadown 6y ago
    The linked article is all about protecting data in flight like in the TLS case. PGP is all about protecting data at rest. The two applications are fundamentally different.
    - pvg 6y ago
      I think you're misunderstanding the general complaint or maybe not the complaint but how general, rather than specific it is. At the top of the thread someone says 'PGP has all this ancient cruft and also isn't good for email/email is maybe unsecurable anyway'. The PGP-enthusiast response to that is 'No problem! You see, PGP is so flexible, you can build anything out of it, including maybe an actually-secure system of some sort'. This is a fundamentally inadequate response and we've realized it's inadequate and don't really design secure systems like that anymore. In fact, this class of concern has permeated almost all aspects of contemporary software systems design rather than being something narrowly limited to 'crypto algo agility is bad'. Here's an example/illustrative timeline that doesn't have anything to do with 'data at rest'. 1998 Netscape: Behold our cross-platform, cross-language super-toolkit for building super-extensible Enterprise Groupware apps. Also one of them is a web browser! 2015 Mozilla: [belated forehead slap] This is a terrible way to architect a web browser that has any hope of offering end-user security.

Quekid5 6y ago

> GnuPG is more of a CLI "library" to interface with it It abjectly fails at that. It's just awful to interface with.

rlpb 6y ago
Who said that it's for a user to interface with directly? mutt interfaces with it perfectly fine, and mutt's PGP UX is also fine.
rendx 6y ago
Agreed. It has been long overdue that alternative OpenPGP implementations exist that try to address some of the peculiarities of GnuPG -- most of which are [still] there because its founder wants to preserve compatibility at all costs to support some of its long-term institutional users. And, yes, dealing with these peculiarities should not the responsibility of end users, but of further abstraction layers built on top of it (of which there are only a few, and all of them focused on the email use case). The constant confusion between OpenPGP (the standard) and GnuPG (one implementation) has led many users to look elsewhere, which is unfortunate, but has also led many developers to look elsewhere, which is just sad. Yes, trying to work within the existing standardization bodies can be very painful and disheartening, but the few people who try and survive in that space can use every good soul willing to assist. The OpenPGP community has done hundred times more than Signal for the state of security on the Internet, and I'm sure it will continue to do so. Signal is great, and pushed the limits quite far (and still does), and I'm very grateful that it exists and use it every day.
- btilly 6y ago
  The OpenPGP community would do more for security if they listened to serious cryptographers and began recommending better solutions. See https://latacora.micro.blog/2019/07/16/the-pgp-problem.html https://latacora.micro.blog/2019/07/16/the-pgp-problem.html for more on that. And it isn't hard to find lots and lots of cryptographers agreeing with the thesis.
  - ifmpx 6y ago

AlexCoventry 6y ago

> Moxie even openly argues against standards [x] and still calls himself an "anarchist". On the face of it, that sounds like exactly the position an anarchist would take...

rendx 6y ago
If you believe in abolishing hierarchy and institutions where they have no legitimacy, _all_ you are left with is communication, community, and open standardization as practiced in anarchist bodies such as the IETF.
- cwyers 6y ago
  > anarchist bodies such as the IETF That's an incredibly... unconventional read on the IETF.
  - bjoli 6y ago
    Not really. I know very little about both anarchy and the IETF, but voluntary organisation (as in opposed to wage slavery) and a democratic governing of the group is very much in line with many anarchistic schools. Edit: language fixes. English is not my language of choice for discussing things like this...
int_19h 6y ago
Anarchists would be philosophically opposed to top-down, mandated standards, not standards in general.

tptacek 6y ago

This is a weird argument. By your logic, there's practically no cryptosystem PGP can't be; after all, it's an omnibus standard to which people routinely add extensions for new algorithms. Want a double ratchet? An elliptic curve triple handshake? The "building blocks" are all there, all you have to do is use PGP's "flexible packet format" to carry them.

ifmpx 6y ago
This is an interesting interpretation of what he stated. What I got from it is that the strength of PGP is in its flexibility and that it gains that flexibility from being standardized and open. Of course you can extend PGP (or any protocol really) to include cryptographic handshakes, but that's besides the point.