5 ms·

such a great tool. It's not a serious security product unless you support PGP.

schoen 5y ago
I'm a huge fan of Phil and his work, and plan to send him a note of thanks, but I think your second sentiment is out-of-date now. Even if we avoid other controversies like Thomas Ptacek's views about the inappropriateness of the e-mail encryption threat model, PGP doesn't support forward secrecy and so it's at least not suitable for instant messaging or TLS (as well as not being integrated into their protocols!). A serious security product could support encryption that's more relevant to whatever it is that that product does.
- techwizrd 5y ago
  Not all use cases require perfect forward secrecy, so I think PGP can still be useful for some applications (and I tend to enjoy using PGP). I agree however with your point that serious security products do not need to support PGP specifically.
- Avamander 5y ago
  Given that e-mail is not going anywhere in the next few decades, having a way to encrypt it to at least some extent is valuable.
- lmm 5y ago
  I've never seen a realistic threat model where Signal-style forward secrecy actually helps. Suppose a repressive regime captured one dissident can see a bunch of messages between them and other people, but theoretically some crypto nerd might have been able to forge those messages if the dissident has been carefully publishing the material they're supposed to publish and the cryptographer decided to run the forgery toolkit on them and then somehow inject the forged messages onto the arrested guy's device. Do you think that's going to stop the regime from pulling in all the apparent recipients of those messages?
  - schoen 5y ago
    I'm pretty you're thinking of deniability (from OTR) rather than forward secrecy. The forward secrecy in protocols like Signal allows for things like disappearing messages, which are then actually technically credible (the sender's and recipient's devices literally don't contain any information which would help to reconstruct the contents of their old messages). I think the former isn't really helpful in your scenario, but the latter is.
    - lmm 5y ago
      You're absolutely right. Still, I'd ask the same question about forward secrecy: is there a realistic model where they actually help? My impression is that people would generally keep their chat logs for as long as they're relevant, and so a message can only ever become unrecoverable by an attacker once it's irrelevant, in which case it's likely to also be irrelevant to an attacker. I guess maybe there are cases where someone is picked up and it's found they were also involved in some otherwise successful action years before?
- upofadown 5y ago
  Forward secrecy is not of any real value in most instances of instant messaging as people usually keep their old messages around thus negating it. Using OpenPGP in the way that TLS is used would negate the advantage of static encryption and would cause the result to be as insecure as TLS. Probably worse as OpenPGP has not required all the band aids that TLS has ended up with.
  - hiq 5y ago
    > Forward secrecy is not of any real value in most instances of instant messaging as people usually keep their old messages around thus negating it. Both Signal and WhatsApp have disappearing messages as a feature. Signal now allows users to enable this feature by default for new conversations. Most people keep their old messages because they're only aware of some remote dragnet surveillance threat in democratic countries. I'm sure the situation is different in countries where the surveillance is more offensive, and perceived so by the population.
  - pvg 5y ago
    Encryption is not of any real value if the threat you're describing is 'someone simply has access to all your plaintext messages'. This isn't a meaningful argument against forward secrecy.
    - upofadown 5y ago
      The argument is that an attacker that gets your secret key material also gets your saved messages. If you had a more secure way to protect the saved messages then you could of used it to protect the secret key material. It is more or less the same problem.
- GekkePrutser 5y ago
  Perfect Forward Secrecy isn't possible with PGP, as with Email as the underlying mechanism there is no direct communication between peers. Email is more of a "fire and forget" mechanism. You can publish your PGP key and get an email from someone you never communicated with before. That can't be done with PFS.

I'm a huge fan of Phil and his work, and plan to send him a note of thanks, but I think your second sentiment is out-of-date now. Even if we avoid other controversies like Thomas Ptacek's views about the inappropriateness of the e-mail encryption threat model, PGP doesn't support forward secrecy and so it's at least not suitable for instant messaging or TLS (as well as not being integrated into their protocols!). A serious security product could support encryption that's more relevant to whatever it is that that product does.

techwizrd 5y ago
Not all use cases require perfect forward secrecy, so I think PGP can still be useful for some applications (and I tend to enjoy using PGP). I agree however with your point that serious security products do not need to support PGP specifically.
Avamander 5y ago
Given that e-mail is not going anywhere in the next few decades, having a way to encrypt it to at least some extent is valuable.
lmm 5y ago
I've never seen a realistic threat model where Signal-style forward secrecy actually helps. Suppose a repressive regime captured one dissident can see a bunch of messages between them and other people, but theoretically some crypto nerd might have been able to forge those messages if the dissident has been carefully publishing the material they're supposed to publish and the cryptographer decided to run the forgery toolkit on them and then somehow inject the forged messages onto the arrested guy's device. Do you think that's going to stop the regime from pulling in all the apparent recipients of those messages?
- schoen 5y ago
  I'm pretty you're thinking of deniability (from OTR) rather than forward secrecy. The forward secrecy in protocols like Signal allows for things like disappearing messages, which are then actually technically credible (the sender's and recipient's devices literally don't contain any information which would help to reconstruct the contents of their old messages). I think the former isn't really helpful in your scenario, but the latter is.
  - lmm 5y ago
    You're absolutely right. Still, I'd ask the same question about forward secrecy: is there a realistic model where they actually help? My impression is that people would generally keep their chat logs for as long as they're relevant, and so a message can only ever become unrecoverable by an attacker once it's irrelevant, in which case it's likely to also be irrelevant to an attacker. I guess maybe there are cases where someone is picked up and it's found they were also involved in some otherwise successful action years before?
upofadown 5y ago
Forward secrecy is not of any real value in most instances of instant messaging as people usually keep their old messages around thus negating it. Using OpenPGP in the way that TLS is used would negate the advantage of static encryption and would cause the result to be as insecure as TLS. Probably worse as OpenPGP has not required all the band aids that TLS has ended up with.
- hiq 5y ago
  > Forward secrecy is not of any real value in most instances of instant messaging as people usually keep their old messages around thus negating it. Both Signal and WhatsApp have disappearing messages as a feature. Signal now allows users to enable this feature by default for new conversations. Most people keep their old messages because they're only aware of some remote dragnet surveillance threat in democratic countries. I'm sure the situation is different in countries where the surveillance is more offensive, and perceived so by the population.
- pvg 5y ago
  Encryption is not of any real value if the threat you're describing is 'someone simply has access to all your plaintext messages'. This isn't a meaningful argument against forward secrecy.
  - upofadown 5y ago
    The argument is that an attacker that gets your secret key material also gets your saved messages. If you had a more secure way to protect the saved messages then you could of used it to protect the secret key material. It is more or less the same problem.
GekkePrutser 5y ago
Perfect Forward Secrecy isn't possible with PGP, as with Email as the underlying mechanism there is no direct communication between peers. Email is more of a "fire and forget" mechanism. You can publish your PGP key and get an email from someone you never communicated with before. That can't be done with PFS.