6 ms·

Wow. This blog post is appalling. I completely disagree with it. Consider this excerpt from the blog post: > But DKIM authenticity is great! Don’t we want to

Wow. This blog post is appalling. I completely disagree with it. Consider this excerpt from the blog post: > But DKIM authenticity is great! Don’t we want to be able to authenticate politicians’ leaked emails? > Modern DKIM deployments are problematic because they incentivize a specific kind of crime: theft of private emails for use in public blackmail and extortion campaigns. An accident of the past few years is that this feature has been used primarily by political actors working in a manner that many people find agreeable — either because it suits a partisan preference, or because the people who got “caught” sort of deserved it. > But bad things happen to good people too. If you build a mechanism that incentivizes crime, sooner or later you will get crimed on. The author seems to be arguing that if after a certain point it becomes impossible to verify whether an email was genuine or not, that would somehow be a good thing. This reasoning seems harmful to me. It's incredible that the author treats this moral argument as self evident. Let me state my objections clearly. 1. The truthfulness and reliability of the historical record is important. The fact that politicians are protected from blackmail when they write incriminating emails is utterly insignificant by comparison. Is the principle being defended that protecting politicians from blackmail is stronger than a public interest in having a historical record? 2. Making historical emails impossible to authenticate after a certain period of time makes it more difficult to prosecute crimes. It helps criminals, the very thing the author claims to be trying to avoid. If a politician, or anyone for that matter, sends an incriminating email which is evidence of the intent to commit a crime, why on earth would you want to make it easier to cover your tracks? Seriously, can someone present a moral argument for why this should be adopted? It seems only harmful to me.

fhrow4484 6y ago
> 1. The truthfulness and reliability of the historical record is important. [...] Everybody agrees here, but how does one gets to decide that Google, a private corporation, is the one to decide that a given email is an accurate historical email? An email provider is a defacto certificate authority? Are these dkim keys subject to the same standard of care as private keys that CAs manage? For your regular-person scenario, having a way for a 3rd party private company "certify" an email sent from another private company (example: your online order) may be good enough, but is it good enough in every scenario?
some_furry 6y ago
> Seriously, can someone present a moral argument for why this should be adopted? It seems only harmful to me. Because this isn't just about politicians, or holding politicians accountable. It affects the rest of us too! Instead, imagine what would happen if a hacker accessed the email of a closeted LGBTQIA+ person living in a country where being outed is practically a death sentence, and the DKIM signatures were sufficient proof of guilt.
scarmig 6y ago
In the general case, repudiation is desired by users, and non-repudiation is needed in only very particular cases. Companies serving nontechnical users should make repudiation the default, because if given the choice most users would prefer it to be the default. In the particular case of Google releasing its DKIM keys, I think I would need more context. What kind of repudiation property do users expect when sending emails over GMail? Is non-repudiability currently used by users for legal or business purposes? Probably the way to do it would be to announce a particular date maybe a year into the future that the private keys would be released.
woodruffw 6y ago
I'm not going to present a moral argument (what is a moral argument in this context?), only two direct rebuttals of your objections: 1. DKIM provides neither truthfulness nor objectivity. It's a signature mechanism used between mail servers to reduce spam. For implementation reasons, most DKIM users sign with RSA keys that are either currently crackable or will be crackable in a matter of years. Consequently, "signed" emails that are leaked years after their alleged transmission provide a false sense of non-repudiation. 2. Per 1, these emails are already impossible to authenticate after a period of time. This just makes the expectation more explicit. More generally, however, this just isn't a fruitful (or intended) application of DKIM: if the government wants to obtain evidence of a crime, they're going to subpoena the email provider and retrieve the originals. If the suspected criminal is sufficiently important, they'll use pointier methods. The outcomes of our criminal justice system intentionally doesn't hinge on the validity of a few DNS-published RSA keys.
- landryraccoon 6y ago
  If right now DKIM doesn’t provide truthfulness or objectivity, then the author’s blackmail example already doesn’t apply. DKIM signatures, by your argument, are useless in blackmail, since they don’t verify the message. So why did the author resort to that as an example?
  - woodruffw 6y ago
    First: I don't think Matthew Green "resorted" to anything. I think he chose the blackmail example because it's easy to understand on a personal level: we all use repudiatable protocols in other contexts (like Signal), so why wouldn't we want it on our emails? Second: That's not how blackmail works. It's contingent on what the extorted party thinks, not the cryptographic integrity of the blackmail material. That's why mass blackmail spam campaigns (that DKIM fails to prevent, ironically enough) are remarkably effective. Publishing DKIM secret keys after their expiry doesn't magically prevent blackmail; it just removes one more tool from the blackmailer's toolbelt for instilling fear in the target.
  - detaro 6y ago
    The problem is that it's not clear about it. It looks like it does quite a bit, and the counter-argument boils down to "someone could have cracked the secret key", which everyone always is told is the thing that is impossible. So you get plenty people believing and claiming DKIM can do that. This would be fixed by obviously breaking it.
tptacek 6y ago
The word "appalling" describes something that creates surprising distress or dismay (itself implying surprise). To be surprised at a cryptographer advocating for deniable messaging is to suggest that you're unacquainted with the field of messaging cryptography, in which deniable messaging has been a foundational goal for almost 2 decades, going back to Ian Goldberg and Nikita Borisov, who once yelled at me on Twitter for giving OTR short shrift and thus ensured I'd always associate his name with OTR and thus, I'm sure to his delight, his name being dropped on this thread. I'd again like to point out how clear it is, the epistemic approach being taken in this thread. You can disagree with deniable messaging as a valid goal (it'd set you apart from cryptography engineers, but that's fine). But you can't be appalled by it in 2020, because the idea is old enough to drink in a bar in Canada, and motivated at least two of the most famous protocols in all of cryptography. Instead, what people are doing here is skimming this post, digging no further, and then calling to mind their understanding of current events. Then, from that tiny thread of information and a bunch of axioms invented, I presume, in the span of just a minute or two, they're deriving an entire first-principles explanation of how messaging security is supposed to work. You can do that, but I think it's more than fair to point out that there are people that have dedicated their entire career to studying this subject and publishing on it, and if commenters are going to make it clear that they haven't even tried to engage with that material, it's unclear why they should be taken seriously. Also, Google should publish DKIM keys.
- landryraccoon 6y ago
  In the quote I presented above, the author wasn't making a technical argument, but a moral one. If you or the author are presenting an argument why repudiation is necessary on technical grounds, I will admit ignorance and defer to the experts. But my reading of the blog post was that it is not a technical argument. It's an argument about morality, and specifically the author used political examples. If the author did not want lay people to argue about the moral implications, why did they use non-technical arguments?
  - tptacek 6y ago
    I don't know how fair this is but will just say that the first thought that jumps to my mind here is that being surprised at a cryptographer advocating for deniable messages is a little bit like being surprised at a medical researcher advocating for effective antibiotics. It probably never occurs to either of them to question the legitimacy of their moral stance.
shinigami 6y ago
We could catch a lot of criminals if we every OS had a backdoor that the police could access. So, are you in favor of that?
deleted 6y ago
[deleted]

fhrow4484 6y ago

> 1. The truthfulness and reliability of the historical record is important. [...] Everybody agrees here, but how does one gets to decide that Google, a private corporation, is the one to decide that a given email is an accurate historical email? An email provider is a defacto certificate authority? Are these dkim keys subject to the same standard of care as private keys that CAs manage? For your regular-person scenario, having a way for a 3rd party private company "certify" an email sent from another private company (example: your online order) may be good enough, but is it good enough in every scenario?

some_furry 6y ago

> Seriously, can someone present a moral argument for why this should be adopted? It seems only harmful to me. Because this isn't just about politicians, or holding politicians accountable. It affects the rest of us too! Instead, imagine what would happen if a hacker accessed the email of a closeted LGBTQIA+ person living in a country where being outed is practically a death sentence, and the DKIM signatures were sufficient proof of guilt.

scarmig 6y ago

In the general case, repudiation is desired by users, and non-repudiation is needed in only very particular cases. Companies serving nontechnical users should make repudiation the default, because if given the choice most users would prefer it to be the default. In the particular case of Google releasing its DKIM keys, I think I would need more context. What kind of repudiation property do users expect when sending emails over GMail? Is non-repudiability currently used by users for legal or business purposes? Probably the way to do it would be to announce a particular date maybe a year into the future that the private keys would be released.

woodruffw 6y ago

I'm not going to present a moral argument (what is a moral argument in this context?), only two direct rebuttals of your objections: 1. DKIM provides neither truthfulness nor objectivity. It's a signature mechanism used between mail servers to reduce spam. For implementation reasons, most DKIM users sign with RSA keys that are either currently crackable or will be crackable in a matter of years. Consequently, "signed" emails that are leaked years after their alleged transmission provide a false sense of non-repudiation. 2. Per 1, these emails are already impossible to authenticate after a period of time. This just makes the expectation more explicit. More generally, however, this just isn't a fruitful (or intended) application of DKIM: if the government wants to obtain evidence of a crime, they're going to subpoena the email provider and retrieve the originals. If the suspected criminal is sufficiently important, they'll use pointier methods. The outcomes of our criminal justice system intentionally doesn't hinge on the validity of a few DNS-published RSA keys.

landryraccoon 6y ago
If right now DKIM doesn’t provide truthfulness or objectivity, then the author’s blackmail example already doesn’t apply. DKIM signatures, by your argument, are useless in blackmail, since they don’t verify the message. So why did the author resort to that as an example?
- woodruffw 6y ago
  First: I don't think Matthew Green "resorted" to anything. I think he chose the blackmail example because it's easy to understand on a personal level: we all use repudiatable protocols in other contexts (like Signal), so why wouldn't we want it on our emails? Second: That's not how blackmail works. It's contingent on what the extorted party thinks, not the cryptographic integrity of the blackmail material. That's why mass blackmail spam campaigns (that DKIM fails to prevent, ironically enough) are remarkably effective. Publishing DKIM secret keys after their expiry doesn't magically prevent blackmail; it just removes one more tool from the blackmailer's toolbelt for instilling fear in the target.
- detaro 6y ago
  The problem is that it's not clear about it. It looks like it does quite a bit, and the counter-argument boils down to "someone could have cracked the secret key", which everyone always is told is the thing that is impossible. So you get plenty people believing and claiming DKIM can do that. This would be fixed by obviously breaking it.

tptacek 6y ago

The word "appalling" describes something that creates surprising distress or dismay (itself implying surprise). To be surprised at a cryptographer advocating for deniable messaging is to suggest that you're unacquainted with the field of messaging cryptography, in which deniable messaging has been a foundational goal for almost 2 decades, going back to Ian Goldberg and Nikita Borisov, who once yelled at me on Twitter for giving OTR short shrift and thus ensured I'd always associate his name with OTR and thus, I'm sure to his delight, his name being dropped on this thread. I'd again like to point out how clear it is, the epistemic approach being taken in this thread. You can disagree with deniable messaging as a valid goal (it'd set you apart from cryptography engineers, but that's fine). But you can't be appalled by it in 2020, because the idea is old enough to drink in a bar in Canada, and motivated at least two of the most famous protocols in all of cryptography. Instead, what people are doing here is skimming this post, digging no further, and then calling to mind their understanding of current events. Then, from that tiny thread of information and a bunch of axioms invented, I presume, in the span of just a minute or two, they're deriving an entire first-principles explanation of how messaging security is supposed to work. You can do that, but I think it's more than fair to point out that there are people that have dedicated their entire career to studying this subject and publishing on it, and if commenters are going to make it clear that they haven't even tried to engage with that material, it's unclear why they should be taken seriously. Also, Google should publish DKIM keys.

landryraccoon 6y ago
In the quote I presented above, the author wasn't making a technical argument, but a moral one. If you or the author are presenting an argument why repudiation is necessary on technical grounds, I will admit ignorance and defer to the experts. But my reading of the blog post was that it is not a technical argument. It's an argument about morality, and specifically the author used political examples. If the author did not want lay people to argue about the moral implications, why did they use non-technical arguments?
- tptacek 6y ago
  I don't know how fair this is but will just say that the first thought that jumps to my mind here is that being surprised at a cryptographer advocating for deniable messages is a little bit like being surprised at a medical researcher advocating for effective antibiotics. It probably never occurs to either of them to question the legitimacy of their moral stance.

shinigami 6y ago

We could catch a lot of criminals if we every OS had a backdoor that the police could access. So, are you in favor of that?

deleted 6y ago

[deleted]