8 ms·
While this is awesome work, it seems pointless since the protocol and ecosystem around it is so hopelessly convoluted, misunderstood, and in a varying state of
by jitl 5y ago
While this is awesome work, it seems pointless since the protocol and ecosystem around it is so hopelessly convoluted, misunderstood, and in a varying state of abandonment. All my friends in the security steer well clear of it.
- young_unixer 5y agoWhat do they use instead?
- doomrobo 5y agoStandard replacements: For signing: signify/minisign For encryption: age For file transfer: magic wormhole For encrypted messaging: Signal (or your choice of e2e encrypted messaging platform)
- ekianjo 5y agoSignal is centralized and in no way can replace emails.
- tptacek 5y agoEmail is default plaintext, can't force encryption on groups, leaks --- in fact, gleefully publishes --- the most important dragnet surveillance metadata (even when ostensibly encrypted), creates long term archives of secrets, is built on long term secrets, and, to boot, is in the real world itself effectively centralized. It's hard to even imagine a secure messaging system less safe than email. Recommending encrypted email is simply malpractice.
- ekianjo 5y agoRecommending signal fails to realize that it can be compromised in many ways precisely because it is centralized. A false sense of security.
- 0xCMP 5y agoEmail clients and server instances are just as centralized in practice. Yet email servers almost always know everything about you in contrast to Signal. And you can prove this by reading their code and by the fact that they respond to subpoenas with as little info as they do. How would signal be compromised that email could not and which signal is not better prepared for?
- ekianjo 5y ago> Email clients and server instances are just as centralized in practice. I don't follow. Not everyone uses Gmail or the big email providers.
- kasey_junk 5y agoIf anyone on the communication thread uses GMail or the other big providers then the entire conversation is subject to the weaknesses of the protocol. Right now that sits at about a 1 in 5 chance for Gmail alone.
- georgyo 5y agoI'm still think that OpenPGP is the best solution for the first two. But the two tools at the top have the same problems as pgp. How do you trust some key material. The WoT is a complete failure, but modern solutions like WKD are amazing and make PGP just plain work. The one nice thing about age is the ability to encrypt to a GitHub users key. However, even that is possible with OpenPGP. Here is a tool that I made ~7 years ago that does something similar: https://github.com/georgyo/sshcrypt https://github.com/georgyo/sshcrypt Another thing minisign/age don't have is a method to say that a key is compromised. I don't think the solution to the problems with OpenPGP is too just ignore the problems and switch to using bare keys like new tools are doing.
- aborsy 5y agoI wouldn’t hastily recommend unproven tools in the area security. Here is an example of a cool tool with modern cryptography, forward secret etc, often recommended in HN as an alternative to Wormhole: https://redrocket.club/posts/croc/ https://redrocket.club/posts/croc/ It turned out that plaintext could easily be recovered! One mistake and 100% broken. There are benefits to an industry standard protocol.
- cpach 5y agoSignify and Age are not unproven.
- throwaway45209 5y agocroc wasn't recommended by people on HN who knew something about cryptography, and they actually warned against it. They recommended Brian Warner's magic-wormhole, Signal, Tarsnap, age, Signify, Minisign, libsodium.
- upofadown 5y agoAge is not even close to being some sort of GPG replacement: * https://articles.59.ca/doku.php?id=pgpfan:agevspgp https://articles.59.ca/doku.php?id=pgpfan:agevspgp
- imiric 5y agoI don't think that's a fair comparison. Age was never meant to fully replace GPG, so complaining about missing features it was never meant to have doesn't make sense. The only valid criticism is about its handling of corrupted data, but for that too you can use an external tool like PAR2 to generate recovery data. I do this with my GPG backups and other data as well. I like that age follows the Unix "do one thing well" philosophy, and that I can use other similarly scoped tools for other features. There are still some things I'm missing, but these are slowly being worked on[1,2]. [1]: https://github.com/FiloSottile/age/issues/137 https://github.com/FiloSottile/age/issues/137 [2]: https://github.com/FiloSottile/age/pull/132 https://github.com/FiloSottile/age/pull/132
- upofadown 5y agoI am not sure how PAR2 helps here if your encryption utility refuses to return any data in the first place. I was responding to a comment that said that age was a "standard replacement" for GPG.
- upofadown 5y agoSignal is an instant messenger ... which is fine, but sometimes you really do need the extra security provided by an offline messaging solution like OpenPGP. The Cellebrite thing was a good example of this. Cellebrite doesn't get OpenPGP messages as they can and are usually protected by a passphrase. Cellebrite gets Signal messages.
- throwaway45209 5y agoEnabling 'disappearing messages' will help I think.
- cpach 5y agoIn that case I would recommend Age. It’s a modern and sound replacement for GPG. https://age-encryption.org/ https://age-encryption.org/
- upofadown 5y agoNot really. My opinion in some detail: * https://articles.59.ca/doku.php?id=pgpfan:agevspgp https://articles.59.ca/doku.php?id=pgpfan:agevspgp Age might be such a replacement some day for just the encryption function. But it has a ways to go. Actually defining the format would be a good first step.
- cpach 5y agoFor encrypted backups, I believe that Restic is a better tool https://restic.net/ https://restic.net/
- zikduruqe 5y agoDon’t forget, keys.pub for signing, encrypted messaging, and has wormhole in it
- R0b0t1 5y agoIf you approach it from "run these commands to do these things" it's not bad. Most wrappers are wrappers around a very limited set of functionality. It sticks around because it has some interface that users can use and is scriptable. Everyone saying GPG is bad usually has no general solution to replacing it.
- tptacek 5y agoThe best-known problem with PGP is its poor usability, but that's not its biggest problem. It's biggest problem is an archaic design that literally predates much of modern cryptography; most egregiously, PGP is almost never forward-secret, and almost always relies on long-term keys, which is a deadly combination. A more fundamental design issue is simply that cryptography engineers long ago abandoned the idea of a single toolset or even a single standard design that handles multiple problems. Messaging cryptography is not the same as backup cryptography, which in turn isn't the same as secure transports, or package update security. More here: https://latacora.micro.blog/2019/07/16/the-pgp-problem.html https://latacora.micro.blog/2019/07/16/the-pgp-problem.html
- rodgerd 5y ago> The best-known problem with PGP is its poor usability, but that's not its biggest problem. I don't know - if the design were more sounds from a crypto perspective, but it was still as easy to fuck up as the current interface, would it really be better?
- AlexCoventry 5y agoIs there a way to do forward security in a non-interactive protocol (which seems necessary, if you want to communicate over email?) I guess users could publish partial key exchanges out of band?
- tptacek 5y agoDon't use encrypted email. Encrypted email is deeply problematic, for many reasons having little to do with PGP. https://latacora.micro.blog/2020/02/19/stop-using-encrypted.html https://latacora.micro.blog/2020/02/19/stop-using-encrypted....