4 ms·
I've recently spent a fair bit of time thinking about where encrypted messaging has been and where it ended up... Yes, PGP sucks. Unfortunately everything else
by upofadown 6y ago
I've recently spent a fair bit of time thinking about where encrypted messaging has been and where it ended up...
Yes, PGP sucks. Unfortunately everything else sucks as well.
Signal Messenger is as good an example as anything. To use it effectively you need to know these concepts:
* What safety numbers are. Why you need to use them to establish an identity for a contact. Why you need to do something when they unexpectedly change. What that something is that you need to do.
* Why you can't keep around old messages if you want forward secrecy. What forward secrecy is and why you might want it.
* What deniability is. What you have to do if you want to attempt to exercise it.
Note that Signal ended up making it significantly easier to ignore the change of safety numbers some years ago. The users simply were bothered with no idea of why it was important.
Public key cryptography is complicated and involves multiple basic concepts that need to be learned if you are going to use it for messaging. Making things more complicated and adding features as in the case of Signal protocol does not help if it adds to the list of concepts. We haven't yet come to terms with the basic stuff.
There seems to be a cycle here. Someone comes out with a cool new thing. Regular people fail to be able to use that thing. No one seems to know why. Repeat. Signal is a good current example of that.
The thing is, the root cause has been known for something like 20 years now. I will leave with a quote from the classic encrypted messaging study, Why Johnny Can't Encrypt:
>... it is clear that there is a need to communicate an accurate conceptual model of the security to the user as quickly as possible. The smaller and simpler that conceptual model is, the more plausible it will be that we can succeed in doing so.
- tptacek 6y agoIt's interesting to see a critique of Signal and defense of PGP premised on how difficult it is to verify safety numbers, given that the dominant APIs for PGP release unverified plaintext to callers, with verification passed out of band.
- lmm 6y agoPGP lacks a good library implementation. The remedy for that is not creating a new protocol with radically different properties, one that's difficult to analyse and gives up important properties. The remedy is writing a good library implementation.
- tptacek 6y agoThat's not true. PGP's problems with message verification are endemic to the protocol; see, for instance, the MDC. This isn't just a known problem with PGP, it's probably the single most notorious design problem in the protocol, so it's surprising to see this response.
- lmm 6y agoFeigned surprise is a cheap rhetorical trick; pretending that your faction has the expert consensus doesn't make it so. And pretending that you were talking about the protocol rather than the libraries a minute ago won't fool anyone when your post saying "APIs" is right there. There is a specific imperfection in the protocol around verification; there is a mitigation in place, and a good library implementation (that didn't simply 1:1 replicate the protocol) would include that. The consensus is largely that the mitigation is adequate, but again, if you disagree with that then the remedy would be a protocol update that addresses that specific issue, not a radically different protocol with very different properties that's missing key protections.
- tptacek 6y agoMy faction has the expert consensus. Feel free to cite the countervailing expert opinion. I think at this point any reputable cryptography engineer would do!
- theamk 6y agoI am not sure how fair is this? You are complaining about "forward secrecy" and "deniability" being hard -- fair enough, but PGP does not provide either of those! So if you want to be "as good as PGP", there is no need to learn those concepts. The "safety numbers" concept does need to be learned, but I think it is way easier to explain than PGP key management. The goal is not to have the perfect system, it is to have something better than PGP. And this is a pretty low bar.
- upofadown 6y ago>So if you want to be "as good as PGP", there is no need to learn those concepts. Sure, but we really have to aspire to be better than PGP. We are obviously missing the point if we are wasting time on new features when no one can use the old features. >The "safety numbers" concept does need to be learned, but I think it is way easier to explain than PGP key management. If the question is "why do I have to care when the safety number changes" then the answer still involves the basic concept of cryptography identity in both cases.