4 ms·

This critique doesn't really convince me. It mostly says that the original article is wrong, but is mostly silent on why. But the claim that forward secrecy is

This critique doesn't really convince me. It mostly says that the original article is wrong, but is mostly silent on why. But the claim that forward secrecy is unnecessary because STARTTLS protects mail in transist is downright odd. First, it seems self-defeating: if STARTTLS protects me from adverseries, why use PGP? But of course, it doesn't. I can't know if my mail is protected by STARTTLS in advance, and I can't know if one of the mail providers involved is cooperating with the government. Especially someone who fears being targeted by a state-level actor should assume that every mail provider is compromised. Really, that is the reason to encrypt mails in the first place, so when someone criticizes PGP's effectiveness for that purpose you really can't fall back to trusting mail providers.

dale_glass 5y ago
STARTTLS is of little help. It's client to server encryption. If say, alice@ispa.com emails bob@ispb.ru, then the transit between Alice's computer and IspA, IspA and IspB, and IspB and Bob is protected. But only during transit. Both IspA and IspB get a completely cleartext email in their servers, where there well could be monitoring equipment or software installed. If you're concerned about a family member watching the traffic going through your router, this fixes your problem. But if you're concerned about governments, it absolutely does not, because they can easily convince an ISP to install interception infrastructure inside their datacenter, where the mail is in clear text. PGP on the other hand is end-to-end, Alice to Bob, and the data doesn't exist as cleartext anywhere else.
- jcranmer 5y ago
  There are two things you're missing here. The first, and more minor one, is that effective deployment of keys for encryption/signing tends to require cooperation of the email provider anyways, giving them the ability to report trusted keys for your identity that they can use to MITM you. Indeed, a few of the suggestions for key distribution contained in threads on this post have exactly this flaw (I leave it an exercise to the reader to find which ones). More importantly, even PGP doesn't fully protect information: the headers are still sent in full plaintext. This means that your email provider still knows whom you talked to, when you did so, and the subject of your message. I suspect that most of the government's interest in your personal email isn't in the contents of the email, but precisely this metadata that PGP makes no effort to hide whatsoever. If you're a dissident in Venezuela who's worried about the government finding out you're talking to foreign reporters... well, PGP won't help you. This ends up being the conundrum of "secure" email: it's sufficient for the job (assuming that the UX is more well-thought out than it often is) only if you want to hide what you're saying but not whom you're saying it to. And that is not sufficient for what most people who want secure messaging desire.
  - lifeisstillgood 5y ago
    Do other message protocols / apps solve this meta-data problem as well? As I understand it a mobile to mobile protocol will need to send a message between app on phone on cell tower, through ISP, all of which presumably are open to similar government persuasion. I know its not as egregious as email headers, and email is distributed but the basics seem similar.
    - tptacek 5y ago
      Yes, this is a problem Signal was designed to address. It's interesting to note that many other secure messengers don't handle this much better than email does; they store serverside contact lists, so when you sign into your account your buddy list is immediately populated. Which means they're storing a graph of who talks to who, in a centralized location.
  - zelphirkalt 5y ago
    Does the mail provider not have to know these things, in order to send the e-mail to its intended destination?
    - jcranmer 5y ago
      I suspect that, for email, avoiding the metadata loophole is basically impossible.
- throw0101a 5y ago
  > But if you're concerned about governments, it absolutely does not It helps against governments tapping glass and doing wholesale surveillance. Defeating that is a useful service.
upofadown 5y ago
>But the claim that forward secrecy is unnecessary because STARTTLS protects mail in transist is downright odd. I don't see that connection in the article. There are two independent claims made: 1. That forward secrecy is not very likely to be valuable because people tend to keep their old messages around. 2. That SMTP STARTTLS protects things on the wire making it so that world governments no longer get to record from the network. The linked page also suggests that this would prevent the selective recording of encrypted messages.
- tptacek 5y ago
  It is a huge problem that people keep old messages around. It's a strong argument against using any form of encrypted email, for example; email's UX practically demands you keep searchable archives. Far more people have been compromised by stolen message archives than by messages intercepted in flight; like, I think it's not even close, and that stolen archives are the expected M.O. of state actors. That PGP (and its community) lack cryptographic features to support disappearing messages because they've essentially given up on it as a feature is damning.

dale_glass 5y ago

STARTTLS is of little help. It's client to server encryption. If say, alice@ispa.com emails bob@ispb.ru, then the transit between Alice's computer and IspA, IspA and IspB, and IspB and Bob is protected. But only during transit. Both IspA and IspB get a completely cleartext email in their servers, where there well could be monitoring equipment or software installed. If you're concerned about a family member watching the traffic going through your router, this fixes your problem. But if you're concerned about governments, it absolutely does not, because they can easily convince an ISP to install interception infrastructure inside their datacenter, where the mail is in clear text. PGP on the other hand is end-to-end, Alice to Bob, and the data doesn't exist as cleartext anywhere else.

jcranmer 5y ago
There are two things you're missing here. The first, and more minor one, is that effective deployment of keys for encryption/signing tends to require cooperation of the email provider anyways, giving them the ability to report trusted keys for your identity that they can use to MITM you. Indeed, a few of the suggestions for key distribution contained in threads on this post have exactly this flaw (I leave it an exercise to the reader to find which ones). More importantly, even PGP doesn't fully protect information: the headers are still sent in full plaintext. This means that your email provider still knows whom you talked to, when you did so, and the subject of your message. I suspect that most of the government's interest in your personal email isn't in the contents of the email, but precisely this metadata that PGP makes no effort to hide whatsoever. If you're a dissident in Venezuela who's worried about the government finding out you're talking to foreign reporters... well, PGP won't help you. This ends up being the conundrum of "secure" email: it's sufficient for the job (assuming that the UX is more well-thought out than it often is) only if you want to hide what you're saying but not whom you're saying it to. And that is not sufficient for what most people who want secure messaging desire.
- lifeisstillgood 5y ago
  Do other message protocols / apps solve this meta-data problem as well? As I understand it a mobile to mobile protocol will need to send a message between app on phone on cell tower, through ISP, all of which presumably are open to similar government persuasion. I know its not as egregious as email headers, and email is distributed but the basics seem similar.
  - tptacek 5y ago
    Yes, this is a problem Signal was designed to address. It's interesting to note that many other secure messengers don't handle this much better than email does; they store serverside contact lists, so when you sign into your account your buddy list is immediately populated. Which means they're storing a graph of who talks to who, in a centralized location.
- zelphirkalt 5y ago
  Does the mail provider not have to know these things, in order to send the e-mail to its intended destination?
  - jcranmer 5y ago
    I suspect that, for email, avoiding the metadata loophole is basically impossible.
throw0101a 5y ago
> But if you're concerned about governments, it absolutely does not It helps against governments tapping glass and doing wholesale surveillance. Defeating that is a useful service.

upofadown 5y ago

>But the claim that forward secrecy is unnecessary because STARTTLS protects mail in transist is downright odd. I don't see that connection in the article. There are two independent claims made: 1. That forward secrecy is not very likely to be valuable because people tend to keep their old messages around. 2. That SMTP STARTTLS protects things on the wire making it so that world governments no longer get to record from the network. The linked page also suggests that this would prevent the selective recording of encrypted messages.

tptacek 5y ago
It is a huge problem that people keep old messages around. It's a strong argument against using any form of encrypted email, for example; email's UX practically demands you keep searchable archives. Far more people have been compromised by stolen message archives than by messages intercepted in flight; like, I think it's not even close, and that stolen archives are the expected M.O. of state actors. That PGP (and its community) lack cryptographic features to support disappearing messages because they've essentially given up on it as a feature is damning.