19 ms·

Stop Using Encrypted Email (2020)

174 points by cf100clunk 5y ago

deadalus 5y ago
We need additional research, funding and development into the Darkmail (DMTP/DMAP) protocols. https://darkmail.info/ https://darkmail.info/
- lend000 5y ago
  And frankly a new name, if you want it to go anywhere. A lot easier for politicians to ban "Darkmail" than SecureMail/AdvancedMail or something of that sort.
  - dylan604 5y ago
    SmartMail vs regular mail being DumbMail. Much easier to get people onbaord
    - deleted 5y ago
      [deleted]
- R0b0t1 5y ago
  Unsure that is a sound direction. https://www.mixminion.net/ https://www.mixminion.net/ is defunct but it and its predecessor paid close attention to metadata removal. It's basically Tor but with variable, high latency. It never took off, you need people to buy in and run nodes.
- gerikson 5y ago
  There doesn't seem to have been any activity around that space since ~2015 at least according to Wikipedia: https://en.wikipedia.org/wiki/Dark_Mail_Alliance https://en.wikipedia.org/wiki/Dark_Mail_Alliance
- theamk 5y ago
  I don't think better email will help with the problems described in this essay. Two of the big problems the essay claims are forever archives and ease of forwarding to regular, non-encrypted email. From what I know of darkmail, it is not going to help with either of those.
zamadatix 5y ago
Text Secure/The Signal Protocol the author praises was basically the SMS equivalent of PGP/what they spend the first half of the article bashing from all sides. Even in 2021 while it has switched from SMS transport for the encrypted streams (mostly because it's just a shit transport that cost users more money than data at that point anyways) it still allows comingling and sending messages as plain SMS instead of over the encrypted channel. If used properly Signal solves one or two of the main points listed but is just as guilty in the other half. It's also been found to be imperfect over time even though it hasn't been around as long as PGP.
- bitexploder 5y ago
  Pretty sure I have never seen this behavior in Signal or any of my group chats in Signal. At least the way me and my peer groups use Signal this simply isn’t possible as far as I can tell.
  - klyrs 5y ago
    On Android, Signal has an option to become your default SMS app. Last I looked, it gave big warnings about the insecurity of using that option.
    - bitexploder 5y ago
      Yeah… this argument feels like a bit of a strawman. Very few people use Signal like that and Signal automated the hard parts of E2E comms.
      - zamadatix 5y ago
        "Very few people use signal like that" makes me think you first tried Signal within the last ~year. Why do you think it was originally "TextSecure" and why do you think it, to this day, uses phone numbers as the identity mechanism instead of usernames? It's because it allows it to automatically know when it can upgrade from sending SMS to that contact to sending encrypted messages. And as I originally explained just around the time the mentioned award for the protocol was given (2017) it was still sending the encrypted messages over SMS instead of data. Plenty of people still use it this way on Android though. I'd say about half my Signal contacts do. I don't but that's because I use Google Voice a lot for texting (mostly as an easy way to receive 2 factor codes for work not actual messaging with anyone) and Signal only replaces the local SMS app.
Lammy 5y ago
> Every long term secret will eventually leak. https://www.youtube.com/watch?v=FUPstXCqyus https://www.youtube.com/watch?v=FUPstXCqyus "You can’t hide secrets from the future with math. You can try, but I bet that in the future they laugh at the half-assed schemes and algorithms amassed to enforce cryptographs in the past"
opan 5y ago
I was hoping this was recommending against protonmail and tutanota rather than recommending against PGP.
- intothemild 5y ago
  Same. I thought it was going to be a “don’t use some commercial encrypted email. Roll your own” kind of arguments.
  - snotrockets 5y ago
    I think it also argues against commercial encrypted email. But any complex enough system, you want it to run by folks with some expertise. Greater chance to have providers hire capable people than you being one (simply matter of size)
lucideer 5y ago
This is a great article and I agree with the overall premise and ~90% of the individual points made. But. > If messages can be sent in plaintext, they will be sent in plaintext. This format is such a common line of attack in critiques of technology that I think it needs a new logical fallacy coined to describe it. I've seen it used as the primary basis for entire "x considered harmful" essays (thankfully not the case here as the rest of the bullet points more than hold up without it). The idea that many people will use technology wrong is not an argument in itself against that technology. It's essentially an argument against UX, which is important (especially in the case of security) but while a false sense of security is much worse than no security, that doesn't justify advocating against correct application of that technology (or against efforts to improve the UX of said tech). As mentioned the point here is moot given encrypted email's other larger failings, but without them this point simply wouldn't stand.
- JumpCrisscross 5y ago
  > that many people will use technology wrong is not an argument in itself against that technology Author makes this argument best when they say PGP leaves emails "at the mercy of the least secure person they’ve sent them to." You can have the best UX gating your PGP emails. But if you send them to me, and I have the option of replying on plaintext, there is a non-zero chance that I will eventually respond in plaintext. The blast radius of that compromise is the entire message thread. If what you're communicating about requires actual security, that is an unacceptable risk. If what you're communicating about doesn't, it's fine. Herego, it's a bad solution for secure messaging.
- ufmace 5y ago
  I think the serious issue around this would be not so much that a person in a secure email conversation can easily send a plaintext email, but that a person who does that could also easily include a plaintext copy of the entire rest of the formerly-secure conversation through automatic quotation.
- AussieWog93 5y ago
  >The idea that many people will use technology wrong is not an argument in itself against that technology. It absolutely is. Look at the shitshow that is Bluetooth. A good standard should be easy to implement properly.
baybal2 5y ago
This is a stealth Signal promotion, and self-promotion of Latacora in a style of Lennart Poettering. It's a bad advise, don't listen.
threshold 5y ago
I’m increasingly confident there’s a campaign in progress to persuade abandoning standards the NSA can’t crack and migrate us into projects using algorithms with built in backdoors. RSA is not cracked and PGP works fine.
- baybal2 5y ago
  It's been 8 years, and Eric Rescorla hasn't yet come clear how EC DRBG came his way, and why he kept changing his explanations about that.
  - cs2733 5y ago
    Never heard of it, thanks https://blog.cryptographyengineering.com/2017/12/19/the-strange-story-of-extended-random/ https://blog.cryptographyengineering.com/2017/12/19/the-stra...
- serf 5y ago
  PGP has been the target of everyone's ire for years and years, yet since we're still talking about it, I guess it works. Every thread that mentions PGP will eventually devolve into a discussion about how it's a foot gun and mere mortals will blow themselves up with it... ... but it works. Seriously though, I remember discussions in the mid to late 90s about UI/UX difficulties and about how every single person that doesn't understand the operation perfectly IS going to be black-bagged by their local black-ops group; the same discussions that pop up in every PGP thread. It's like one of the oldest running jokes in CS at this point -- not that PGP is broken and failed but that it attracts tons of individuals to congregate and be upset en masse about the UX.
  - bscphil 5y ago
    An interesting point of comparison here is git, which is also widely claimed to have subpar UX.
    - mLuby 5y ago
kitkat_new 5y ago
I think it would make more sense to point to the Matrix protocol instead of Signal. Matrix is actually decentralized like Email, allows any service provider as well as app provider - free to choose as a user. It supports Perfect Forward Secrecy (based on the Signal Protocol), arbitrary many devices and "one verification for each individual". Well, you might argue Matrix stores meta data server side (the ones chosen), while Signal at least doesn't have to. But do you really want to give up all that freedom trusting a single service provider in that really no data is kept? Maybe you can wait until Matrix allows you to avoid signing up on a server using P2P[0], then you have got it all, and don't have to commit to an alternative that has advantages, but also big draw backs. [0] https://news.ycombinator.com/item?id=27077660 https://news.ycombinator.com/item?id=27077660
- daneel_w 5y ago
  Or XMPP/Jabber.
  - approxim8ion 5y ago
    XMPP is good, great even, but it has the same issue as email where you could interface with someone not using OMEMO or whatever your encryption scheme is and it would fall back to plaintext.
    - MattJ100 5y ago
      The story is not quite the same for XMPP. For example, with XMPP you can determine ahead of time whether or not a contact has OMEMO. And clients configured to only use OMEMO won't "fall back".
      - approxim8ion 5y ago
        Apologies, clearly my understanding of XMPP is not the best. However, both points you mentioned are client dependent, right?
        5y ago
nimbius 5y ago
emphatically: no. the solution to things that are broken and hard is not to abandon them like a petulent child out of frustration. defeatist bullshit from the article: >Every long term secret will eventually leak. is not a valid excuse for abandoning PGP or encrypted email, its wishful thinking at best. >The standard and best answer here is Signal Signals github releases are sporadic at best and hard to compile consistently. its also centralized and has a dependency on google services to operate and lacks real transparency about its outages or plans to scale/operate, but at least its not too hard for you. >Hop-by-hop encryption is a good thing: it makes untargeted dragnet surveillance harder. the devices that handle this mail are commercial MTAs and are already largely backdoored by three letter agencies. a poison prime here, a weak cipher there, or even an opportune warrantless surveillance national security letter can sidestep this easily. companies will bend to the rule of US law. >PGP don’t make this kind of surveillance any harder, and a targeted attacker will still get access to mail servers and messages. this is a tangible, almost white-hot ignorance i cant abide. yes. youll get a PGP message. that message is encrypted with an asymmetric key and with a strong passphrase will have your adversary guessing until the last star falls from the heavens* and the statute of limitations for what was once your proud nation finally expire. PGP was invented to secure things that were transmitted IN PLAINTEXT. trust was sacrosanct as you were expected to verify and know the person to which you were sending...you had keysigning parties and you used PGP to talk about important things with people you trusted. PGP is still valid and useful to this day. * quantum computing may make this easier, but if it does, post-quantum ciphers are still an option
- deleted 5y ago
  [deleted]
  - deleted 5y ago
    [deleted]
- danShumway 5y ago
  > the solution to things that are broken and hard is not to abandon them like a petulent child out of frustration. Are we trying to enable secure E2E encrypted messages, or are we trying to enable secure E2E email? Because those are two different goals. If we're worried about fixing unencrypted messages, then I think it's completely valid to look at systems like Email and SMS and to say that they're just not suitable for secure conversations, and to advise people to move to other platforms/protocols for secure communication that doesn't have their flaws. Signal is currently a good solution for a lot of people. That doesn't mean it doesn't have problems, but it has great encryption that is almost impossible for an ordinary user to accidentally mis-configure. Matrix is also coming into its own as a good solution, and while I don't necessarily recommend Matrix over Signal if encryption is absolutely important, it is very likely going to be a better solution in the future, and for casual encryption is a pretty good solution today. Both Matrix and Signal are easier to use than PGP for ordinary users. They are both (frankly) more reliable even for advanced users. And with the amount of effort we could put into fixing PGP-encrypted emails, we could also make a platform like Matrix really good and push really hard for its adoption. Getting people to adopt Matrix is going to be easier than getting people to adopt encrypted emails. Incidentally Matrix also improves upon a number of other centralization and protocol problems with email as well, but we're focusing specifically on encryption here. Sometimes working to a specific goal (encrypting plaintext communication) means recognizing when a strategy is bad, and pivoting to another strategy that's more pragmatic but that accomplishes the same goals. For example, I'm not going to waste time trying to "fix" SMS security for 2FA when I can tell people to install an Open Source 2FA app instead -- because the goal isn't to make email safe, and the goal isn't to make SMS safe, the goal is to make people safe. Broadening out our strategies and building cleaner, more fundamentally secure technologies is part of that.
daneel_w 5y ago
Browsers also expect plain-text. Is https by the same logic also pointless, and should no longer be used? (I get what the author is trying to say, I'm just reacting to the strange way the argument is phrased. I don't think they thought their wording and reasoning in that passage through enough.)
- baybal2 5y ago
  > Browsers also expect plain-text. Is https by the same logic also pointless, and should no longer be used? > I'm just reacting to the strange way the argument is phrased. It's made so in a manner to provoke a lot of loud noises to make it to spread, and resonate across the blogosphere more than the original lacking substance message ever could. A publicity stunt. It's a self-promotion tactic - saying something outrageous often earns more notoriety for somebody unable to earn fame through virtue.
- Macha 5y ago
  And HTTP has solved this with a hodgepodge of solutions like HSTS + preloading for producers and HTTPs everywhere/new browser settings for users but it has taken years. I think email could do this, but it require some dominant players (probably Google + Microsoft as providers for home + business users, or maybe Google/Apple/MS as dominant client producers) to participate actively.
- pvg 5y ago
  That's not the same logic because http is not a messaging protocol and it took many years to get to something resembling 'https by default'. Still, not being a messaging protocol https and browsers alone are not much better at exchanging end-to-end encrypted messages than plaintext since an https server sees plaintext content.
- IncRnd 5y ago
  > Browsers also expect plain-text. Is https by the same logic also pointless, and should no longer be used? > (I get what the author is trying to say, I'm just reacting to the strange way the argument is phrased. I don't think they thought their wording and reasoning in that passage through enough.) Your question explicitely ignores the argument that was made and pretends a point to point protocol operates similarly to a store and forward protocol.
a-dub 5y ago
one big difference between email and the systems that the author suggests is that email is a standard and a protocol, where the systems referenced by the author are pretty much single implementation systems maintained by a single authority. some of these authorities have all sorts of structure to prevent corruption. passionate people, nonprofit or open governance. however, they are still single points of failure, or targets, or whatever you'd like to call them. it seems that after years of pain with poor effectiveness of specification or poor verification tools for implementations, it has become en vogue for modern cryptosystems to insist on tight centralized control of reference implementations to ensure correctness. (otherwise known as the apple computer model). while this does seem to work in terms of ensuring high quality and problem free implementations, it does open up the single point of failure issue. i'd argue that email's replacement must retain email's greatest quality: it's an open specification, not a system or implementation owned or controlled by a single entity and that the true challenge in bringing it to fruition won't be clever protocol and cryptographic design (although these will be crucial) but also substantial advances in protocol definition and implementation verification such that any competent developer can implement compatible components and plug them in.
- SV_BubbleTime 5y ago
  I agree entirely. Now help me understand something… why have signal and telegram and everyone made proprietary formats and centralized implementations instead of an open email2.0 that they also support immediately? This isn’t my field, so maybe someone has?
  - remirk 5y ago
    Signal says it's harder to innovate in a federated system. [1] [1] https://signal.org/blog/the-ecosystem-is-moving/ https://signal.org/blog/the-ecosystem-is-moving/
    - tptacek 5y ago
      It clearly is harder to innovate in a federated system. Look at what happened with Matrix, and how much time passed between them standardizing E2E encryption and getting E2E encryption universally deployed (I think that switch just flipped last year?). Not everything Moxie Marlinspike writes is correct, but he's been pretty well vindicated on that. Use whichever secure messenger you like, though.
burrows 5y ago
> Ordinary people don’t exchange email messages that any powerful adversary would bother to read AFAIK Google (via GMail) reads emails from/to “normal people”. Is Google not a “powerful adversary”?
zaik 5y ago
> for example, it recently turned out to be possible for eavesdroppers to decrypt messages without a key Sadly without reference. Does anyone know more about this?
- sbuk 5y ago
  They are referring to https://efail.de/ https://efail.de/ - works on both PGP and S/MIME, which was disclosed just over a year before the article was published. The article references this in a link to another post a few sentences before the one you quoted.
  - megous 5y ago
    Processing PGP messages where correctly signed MAC doesn't match the ciphertext should not be an option at all. Message was tapered with, so MUAs have no business processing it. So unless the attacker can also produce the correct MAC matching the ciphertext, which should not be possible with out knowing a private key, I don't see how this can't be easily fixed just by checking the ciphertext against the MAC.
    - upofadown 5y ago
      Minor quibble, OpenPGP uses an authentication method called the modification detection code (MDC). It's kind of a checksum that is protected by the overlaying encryption. Very simple. It turned out to be more secure than anticipated and as a result is still in use.
approxim8ion 5y ago
The issue with encrypted email a-la PGP even beyond security issues is the laughably bad UX. I'm not going to be able to convince people to adopt the best practices involved in maintaining keys and using them to encrypt and decrypt the mail they send. Whether that is good or bad is immaterial- the cat is out of the bag and people are already used to the convenience of insecure incumbents. For messaging, we need something that is end to end encrypted by default, and is also only available in an e2ee format. Decentralization is an additional bonus, but really as long as the protocols are heavily audited and the clients are reasonably open (reproducible builds etc), it doesn't matter what your choice is and what networks your messages go through/who controls them.
- JohnJamesRambo 5y ago
  Could Signal ever do an email service? I’d switch to it in a second. I realize I’d be sending it to insecure addresses but at least my end wouldn’t spy on me? I just realized how dystopian that sentence is.
  - Anunayj 5y ago
    even if they do, you have to maintain compatibility with "other" popular email providers. Protonmail encrypts all it's emails among it's own users. But at the end me with my gmail can't read them without jumping through hoops.
    - mmerlin 5y ago
      Mailvelope and it's browser plugin is fairly easy for encrypting gmail (and other major email providers) conversations: https://chrome.google.com/webstore/detail/mailvelope/kajibbejlbohfaggdiogboambcijhkke https://chrome.google.com/webstore/detail/mailvelope/kajibbe...
  - approxim8ion 5y ago
    Thing with email is that you'd also have to get everyone you talk to to move to it and ensure they don't fall back to any of the services they have been using for all this time for convenience's sake. At which point, it doesn't even matter if it is email behind the scenes or something else. There's also the issue of SMTP being very metadata heavy and there being no option to mitigate or encrypt any of the metadata. Which is why something like Delta Chat (if you haven't heard of it, it's basically Signal/WhatsApp like IM piggybacking over email) isn't very private.
jabbany 5y ago
Lacking any protocol changes in the near term, is the best (portable and somewhat secure) approach for an average person to just put sensitive stuff in an encrypted zip file or something...?
- approxim8ion 5y ago
  Provided it is AES encryption, yeah it's not bad. For storage, I would recommend Veracrypt though since it's more specifically designed for this purpose.
  - shawnz 5y ago
    What about for communicating with darknet vendors, where PGP is the established standard?
michaelcampbell 5y ago
Keeping your house safe from a dedicated intruder is impossible, so you shouldn't even try.
avodonosov 5y ago
LARP security stads for Live Action Role-Playing security?
- retsibsi 5y ago
  That's how I read it -- the claim being that those people are basically doing it for fun, 'playing the role' of someone with important secrets or powerful adversaries.
  - avodonosov 5y ago
    Like this "activist" https://news.ycombinator.com/item?id=28433601 https://news.ycombinator.com/item?id=28433601 BTW, I am curious, if he used secure messenger instead of email, as the article suggests, would police be able to track him...
tzs 5y ago
> Metadata is as important as content, and email leaks it There are a lot of cases where I don't have any reason to care about metadata leaks. I've written plenty of reports for example where it was no secret that I was writing the report, what it was about, about how long it would be, when it would be finished, and to whom it was to be delivered. As far as I can see delivering those reports as encrypted attachments to email would be fine. > Every archived message will eventually leak My encrypted attachment would be fine with this too. If some receiver archives the email the attachment will be encrypted in the archive.
- imglorp 5y ago
  Yours is a rare usecase. The metadata is bad for two reasons. First, simply knowing who mailed whom and when, the powerful adversary can merely visit all participants and urge them to divulge the key and contents. If the adversary didn't know the participants beforehand, they do after seeing the helpful metadata. Second, even failing to read the mail, the powerful adversary can still apply guilt by association, so merely being on the email is enough to attract their attention.
  - TillE 5y ago
    I use PGP email for business communication. It's absolutely no secret that a business relationship exists between us, merely the content is sensitive. Obviously it's a problem for like, whistleblowers, but that's not most people.
    - imglorp 5y ago
      Sometimes business comms /are/ sensitive to knowing the participants. If the head of M+A of one corp is talking to the CEO of another, that might be interesting. If a bunch of Silicon Valley HR leads are mailing each other, is there another anti-poaching agreement in the works? If some retail competitors' sales VPs are mailing each other, is there some price fixing or collusion going on? There's a lot of signals here revealed by metadata.
  - mLuby 5y ago
supernintendo 5y ago
The author says not to use email encryption but what is the case for sending email in plain text? Is encrypted email detrimental to my privacy in some way that unencrypted email is not? Or if the argument is that encrypted email is useless and no better than unencrypted email (since it is always unencrypted at rest) then what is the point of avoiding it in favor of the alternative? Aren't they equivalent, making the distinction meaningless? This is my problem with the article. It feels like it suffers from a bit of zero-sum fallacy. The statement here is, "it can be broken therefore it's fundamentally broken." I think it's more useful to think in terms of probabilities. If I disable password authentication for SSH and require public key authentication on my web server, an attacker can still get in by stealing my private key. That isn't a reason to take the opposite approach however - botnets commonly employ password-guessing attacks against entire IP ranges so you're not actually safer by avoiding this practice just because it isn't a perfect solution. There is no silver bullet for security, only endless layers of strategies and adaptations to edge cases. I did enjoy some of the points about the limitations of email encryption (the email chain example is a great reminder of how security is often more about human behavior than software). But I think the article could have been more compelling had it presented a less dogmatic thesis - perhaps "Email Encryption Won't Save You" or something like that.
- ameliaquining 5y ago
  The point being made is that, if something is sensitive enough that you would hesitate to send it in the clear, you should send it over Signal or some other system that doesn't have the security flaws that encrypted email has. Given that that option exists, and that encrypted email isn't suitable for many use cases that people are tempted to use it for (and is therefore an attractive nuisance securitywise), there's not much reason to use or support encrypted email at all.
  - sneak 5y ago
    Normal people assume that email is a perfectly safe and secure way to transmit PII and other sensitive information, FWIW. The idea that "email is insecure" is not a widely known one.
greenyoda 5y ago
Original HN discussion from 2020, for those who are interested: https://news.ycombinator.com/item?id=22368888 https://news.ycombinator.com/item?id=22368888
clipradiowallet 5y ago
I disagree with this author's take on PGP. Perhaps the people they communicate with reply in plaintext, quoting the author...but that's not my experience. That type of behavior is an opsec failure, not a PGP failure. A tool (like PGP) does not imply a privacy-guaranteed scenario. For an analogy, carrying a handgun does not make you James Bond, and carrying a lockpick does not make you a locksmith. They are just tools, and possessing one of them [like PGP] does not intrinsically include the knowledge and ability to use that tool properly.
quicklime 5y ago
> So, for example, it recently turned out to be possible for eavesdroppers to decrypt messages without a key, simply by tampering with encrypted messages. Most technologists who work with PGP don’t understand it at a low enough level to see what’s wrong with it. This is news to me, but I’ll admit I’m one of those technologists who doesn’t understand it enough. Can anyone point me to more info on this?
- doomrobo 5y ago
  https://efail.de/ https://efail.de/
  - faeyanpiraat 5y ago
    Okay, so PGP is not vulnerable.
- upofadown 5y ago
  It's the EFAIL thing. Which was an actual issue but was wildly misrepresented in the media[1]. [1] https://articles.59.ca/doku.php?id=pgpfan:efail https://articles.59.ca/doku.php?id=pgpfan:efail
  - tptacek 5y ago
    This is such a bizarre article. Efail was, among other things, a peer-reviewed accept at Usenix Security in 2018. It is certainly and obviously not a "hoax". Cryptography engineers have been warning about the pattern of PGP weaknesses that led to it for almost a decade prior.
    - upofadown 5y ago
      You might want to read the article more carefully taking into account context: >The word “Hoax” in the title of this article refers to the attempts to make it seem that EFAIL represented some deficiency in PGP. Which was found after an example of a "hyperbolic headline". Later in the article it explicitly addresses the media distortion. I don't know how anyone could get from that that the article was claiming that the article was some sort of hoax, particularly when the article actually praises the work represented by the paper.
normaler 5y ago
What I like most about PGP is message signing. A signed message can prove to the receiving party that it was really me who send the message. Also it does not require any setup on the receiving end.
- snotrockets 5y ago
  In practice, I found future deniability to be more useful. PGP was never designed for a real security scenario, and it shows.
  - upofadown 5y ago
    If you want deniability you simply don't sign the email in the first place. That actually works, as opposed to something like Signal that attempts to claim deniability through forgability.
unethical_ban 5y ago
The author's tone is really grating; they insult anyone who disagrees with them. I think they're rude and need to learn how to write better. "LARP LARP LARP". How shitty. Essentially, their argument is: Metadata isn't protected, and mail gets archived when perhaps you want messages to disappear. If you're writing messages on any system with the assumption they aren't stored somewhere indefinitely, you're already failing, buckaroo.
dgan 5y ago
funny, it takes only 2 link hopes to find a contradictory statement ("Use PGP!")
kuon 5y ago
Signal is suggested, but it requires a mobile phone, which is not an option for me. That's why I use matrix, but I fear it will not catch on enough, and email will be the only option people will have to contact me. But I somehow agree that encrypting email is not an option as there are too much complications to it.
whartung 5y ago
So, then, what are the issues with S/MIME? Thunderbird supports it. Apple Mail supports it. Gmail does (but not for free accounts). It's the core of the DIRECT Messaging protocol we use in healthcare. There are millions of messages being sent via DIRECT every week. Mind, DIRECT is more than just S/MIME, it's a just a component of it (there's an entire trust system involved as well). I appreciate the issue with leakage, which are very real, mostly due to the UI of the systems. I honestly don't know how well the programs like Apple Mail et al keep you from shooting yourself in the foot with S/MIME encrypted mail (such as "You're about to forward an encrypted email in the clear, are you sure you want to do that?"). The post bags on PGP, so I'm just curious if there are weaknesses inbuilt to S/MIME.
- iggldiggl 5y ago
  As the article already alludes to, I want full-text search, and I also want to use it with my phone or via webmail, so having to download all messages to decrypt and search them locally is out.
slackfan 5y ago
"Email is inherently unsafe, everything will leak, therefore do not use encrypted email". This is about the equivalent of not just throwing out the baby with the bath water, but taking the baby putting it in a rocket and launching it at the moon. Never assume a network is private, never assume anything communicated over anything other than a piece of paper passed between two human beings in a secure room is private, and even then be suspicious. But for gods' sake, use encrypted email.
decebalus1 5y ago
Why is this type of content upvoted on hn? The only interesting thing about this 'article' is that I'm not sure exactly what type of logical fallacy it represents. Is it a false dilemma? What is it? Interesting..
upofadown 5y ago
The contention that some encrypted instant messenger might be better than encrypted email has not aged very well with Cellebrite's cheerful reminder that even low level attacks like forensic boxes get saved Signal messages. Things like Signal depend on a forward secret protocol in concert with a user willing to immediately delete their old messages to prevent such data exposure. It turns out that such users are rare. Encrypted email can be done exclusively in very safe places and the secret key that protects both the transferred and saved messages can be protected very well. This is entirely because of the difference in the mediums. Email can be completely locked up in any sort of dangerous environment because it is inherently offline. Something like instant messaging has to expose the secret stuff all the time to produce all the time access. There might be people who like to LARP their encrypted email and that is a legitimate thing to do. There are people that actually need the level of security that can be provided by an asynchronous messaging system like encrypted email.
- tptacek 5y ago
  Cellebrite relies on compromised endpoints. It has little to do with the discussion being had on this thread.
giantrobot 5y ago
I find the authors arguments about PGP to be really strange because realistically they mostly apply to Signal and other E2EE messaging apps. E2EE only guarantees encryption in transit between two end nodes. Infrastructure between those two nodes can't read or alter the payload. That is the only thing it guarantees. Once an end node receives a message any guarantees of encryption/safety go out the window. There's no guarantee the intended recipient is in possession of the end node or someone isn't shoulder surfing them. There's also no guarantees the end node's local message storage will remain secure in perpetuity. There's also no guarantee that the metadata of messages, even sent through a nominally secure service, will also remain secure in perpetuity. Signal as a service might be very secure and will never leak metadata but there's no guarantee of that especially if state funded malefactors target the service. The security of messages at rest is pretty similar between PGP e-mail and Signal messages. Signal's metadata is more secure than e-mail by default but that may not always be true.
- tptacek 5y ago
  The point isn't what people can do. No matter what transport you use, people can just screenshot their messages if they want to screw you over. It's what they're likely to do. Nobody that has used encrypted email for any length of time with more than a couple of people has failed to see an unencrypted reply. If they're being honest, most people who've used PGP email for a long time would admit generating unencrypted replies.
  - giantrobot 5y ago
    You're describing UX issues with e-mail clients and not PGP. If e-mail clients are your problem complain about their failings rather than attributing them to PGP.
    - tptacek 5y ago
      Note the title of the post.
    - danShumway 5y ago
raven108 5y ago
Nihilistic post. Sure email standard has issues outlined. But given the recent Aussie laws and general political climate using plain text email is asking for trouble. I think Tutanota has done end rub around all these issues. Been using for few months and works well. AES, encryption at rest, plain email and shared passwords too. But given the EU tech law trend towards increased sifting through communication they are being and will be targeted. While Proton gets all the publicity but I feel they have better offering, including clients on all platforms.
deleted 5y ago
[deleted]

174 points by cf100clunk 5y ago

We need additional research, funding and development into the Darkmail (DMTP/DMAP) protocols. https://darkmail.info/ https://darkmail.info/

lend000 5y ago
And frankly a new name, if you want it to go anywhere. A lot easier for politicians to ban "Darkmail" than SecureMail/AdvancedMail or something of that sort.
- dylan604 5y ago
  SmartMail vs regular mail being DumbMail. Much easier to get people onbaord
  - deleted 5y ago
    [deleted]
R0b0t1 5y ago
Unsure that is a sound direction. https://www.mixminion.net/ https://www.mixminion.net/ is defunct but it and its predecessor paid close attention to metadata removal. It's basically Tor but with variable, high latency. It never took off, you need people to buy in and run nodes.
gerikson 5y ago
There doesn't seem to have been any activity around that space since ~2015 at least according to Wikipedia: https://en.wikipedia.org/wiki/Dark_Mail_Alliance https://en.wikipedia.org/wiki/Dark_Mail_Alliance
theamk 5y ago
I don't think better email will help with the problems described in this essay. Two of the big problems the essay claims are forever archives and ease of forwarding to regular, non-encrypted email. From what I know of darkmail, it is not going to help with either of those.

zamadatix 5y ago

Text Secure/The Signal Protocol the author praises was basically the SMS equivalent of PGP/what they spend the first half of the article bashing from all sides. Even in 2021 while it has switched from SMS transport for the encrypted streams (mostly because it's just a shit transport that cost users more money than data at that point anyways) it still allows comingling and sending messages as plain SMS instead of over the encrypted channel. If used properly Signal solves one or two of the main points listed but is just as guilty in the other half. It's also been found to be imperfect over time even though it hasn't been around as long as PGP.

bitexploder 5y ago
Pretty sure I have never seen this behavior in Signal or any of my group chats in Signal. At least the way me and my peer groups use Signal this simply isn’t possible as far as I can tell.
- klyrs 5y ago
  On Android, Signal has an option to become your default SMS app. Last I looked, it gave big warnings about the insecurity of using that option.
  - bitexploder 5y ago
    Yeah… this argument feels like a bit of a strawman. Very few people use Signal like that and Signal automated the hard parts of E2E comms.
    - zamadatix 5y ago
      "Very few people use signal like that" makes me think you first tried Signal within the last ~year. Why do you think it was originally "TextSecure" and why do you think it, to this day, uses phone numbers as the identity mechanism instead of usernames? It's because it allows it to automatically know when it can upgrade from sending SMS to that contact to sending encrypted messages. And as I originally explained just around the time the mentioned award for the protocol was given (2017) it was still sending the encrypted messages over SMS instead of data. Plenty of people still use it this way on Android though. I'd say about half my Signal contacts do. I don't but that's because I use Google Voice a lot for texting (mostly as an easy way to receive 2 factor codes for work not actual messaging with anyone) and Signal only replaces the local SMS app.

Lammy 5y ago

> Every long term secret will eventually leak. https://www.youtube.com/watch?v=FUPstXCqyus https://www.youtube.com/watch?v=FUPstXCqyus "You can’t hide secrets from the future with math. You can try, but I bet that in the future they laugh at the half-assed schemes and algorithms amassed to enforce cryptographs in the past"

opan 5y ago

I was hoping this was recommending against protonmail and tutanota rather than recommending against PGP.

intothemild 5y ago
Same. I thought it was going to be a “don’t use some commercial encrypted email. Roll your own” kind of arguments.
- snotrockets 5y ago
  I think it also argues against commercial encrypted email. But any complex enough system, you want it to run by folks with some expertise. Greater chance to have providers hire capable people than you being one (simply matter of size)

lucideer 5y ago

This is a great article and I agree with the overall premise and ~90% of the individual points made. But. > If messages can be sent in plaintext, they will be sent in plaintext. This format is such a common line of attack in critiques of technology that I think it needs a new logical fallacy coined to describe it. I've seen it used as the primary basis for entire "x considered harmful" essays (thankfully not the case here as the rest of the bullet points more than hold up without it). The idea that many people will use technology wrong is not an argument in itself against that technology. It's essentially an argument against UX, which is important (especially in the case of security) but while a false sense of security is much worse than no security, that doesn't justify advocating against correct application of that technology (or against efforts to improve the UX of said tech). As mentioned the point here is moot given encrypted email's other larger failings, but without them this point simply wouldn't stand.

JumpCrisscross 5y ago
> that many people will use technology wrong is not an argument in itself against that technology Author makes this argument best when they say PGP leaves emails "at the mercy of the least secure person they’ve sent them to." You can have the best UX gating your PGP emails. But if you send them to me, and I have the option of replying on plaintext, there is a non-zero chance that I will eventually respond in plaintext. The blast radius of that compromise is the entire message thread. If what you're communicating about requires actual security, that is an unacceptable risk. If what you're communicating about doesn't, it's fine. Herego, it's a bad solution for secure messaging.
ufmace 5y ago
I think the serious issue around this would be not so much that a person in a secure email conversation can easily send a plaintext email, but that a person who does that could also easily include a plaintext copy of the entire rest of the formerly-secure conversation through automatic quotation.
AussieWog93 5y ago
>The idea that many people will use technology wrong is not an argument in itself against that technology. It absolutely is. Look at the shitshow that is Bluetooth. A good standard should be easy to implement properly.

baybal2 5y ago

This is a stealth Signal promotion, and self-promotion of Latacora in a style of Lennart Poettering. It's a bad advise, don't listen.

threshold 5y ago

I’m increasingly confident there’s a campaign in progress to persuade abandoning standards the NSA can’t crack and migrate us into projects using algorithms with built in backdoors. RSA is not cracked and PGP works fine.

baybal2 5y ago
It's been 8 years, and Eric Rescorla hasn't yet come clear how EC DRBG came his way, and why he kept changing his explanations about that.
- cs2733 5y ago
  Never heard of it, thanks https://blog.cryptographyengineering.com/2017/12/19/the-strange-story-of-extended-random/ https://blog.cryptographyengineering.com/2017/12/19/the-stra...
serf 5y ago
PGP has been the target of everyone's ire for years and years, yet since we're still talking about it, I guess it works. Every thread that mentions PGP will eventually devolve into a discussion about how it's a foot gun and mere mortals will blow themselves up with it... ... but it works. Seriously though, I remember discussions in the mid to late 90s about UI/UX difficulties and about how every single person that doesn't understand the operation perfectly IS going to be black-bagged by their local black-ops group; the same discussions that pop up in every PGP thread. It's like one of the oldest running jokes in CS at this point -- not that PGP is broken and failed but that it attracts tons of individuals to congregate and be upset en masse about the UX.
- bscphil 5y ago
  An interesting point of comparison here is git, which is also widely claimed to have subpar UX.
  - mLuby 5y ago

kitkat_new 5y ago

I think it would make more sense to point to the Matrix protocol instead of Signal. Matrix is actually decentralized like Email, allows any service provider as well as app provider - free to choose as a user. It supports Perfect Forward Secrecy (based on the Signal Protocol), arbitrary many devices and "one verification for each individual". Well, you might argue Matrix stores meta data server side (the ones chosen), while Signal at least doesn't have to. But do you really want to give up all that freedom trusting a single service provider in that really no data is kept? Maybe you can wait until Matrix allows you to avoid signing up on a server using P2P[0], then you have got it all, and don't have to commit to an alternative that has advantages, but also big draw backs. [0] https://news.ycombinator.com/item?id=27077660 https://news.ycombinator.com/item?id=27077660

daneel_w 5y ago
Or XMPP/Jabber.
- approxim8ion 5y ago
  XMPP is good, great even, but it has the same issue as email where you could interface with someone not using OMEMO or whatever your encryption scheme is and it would fall back to plaintext.
  - MattJ100 5y ago
    The story is not quite the same for XMPP. For example, with XMPP you can determine ahead of time whether or not a contact has OMEMO. And clients configured to only use OMEMO won't "fall back".
    - approxim8ion 5y ago
      Apologies, clearly my understanding of XMPP is not the best. However, both points you mentioned are client dependent, right?
      - 5y ago

nimbius 5y ago

emphatically: no. the solution to things that are broken and hard is not to abandon them like a petulent child out of frustration. defeatist bullshit from the article: >Every long term secret will eventually leak. is not a valid excuse for abandoning PGP or encrypted email, its wishful thinking at best. >The standard and best answer here is Signal Signals github releases are sporadic at best and hard to compile consistently. its also centralized and has a dependency on google services to operate and lacks real transparency about its outages or plans to scale/operate, but at least its not too hard for you. >Hop-by-hop encryption is a good thing: it makes untargeted dragnet surveillance harder. the devices that handle this mail are commercial MTAs and are already largely backdoored by three letter agencies. a poison prime here, a weak cipher there, or even an opportune warrantless surveillance national security letter can sidestep this easily. companies will bend to the rule of US law. >PGP don’t make this kind of surveillance any harder, and a targeted attacker will still get access to mail servers and messages. this is a tangible, almost white-hot ignorance i cant abide. yes. youll get a PGP message. that message is encrypted with an asymmetric key and with a strong passphrase will have your adversary guessing until the last star falls from the heavens* and the statute of limitations for what was once your proud nation finally expire. PGP was invented to secure things that were transmitted IN PLAINTEXT. trust was sacrosanct as you were expected to verify and know the person to which you were sending...you had keysigning parties and you used PGP to talk about important things with people you trusted. PGP is still valid and useful to this day. * quantum computing may make this easier, but if it does, post-quantum ciphers are still an option

deleted 5y ago
[deleted]
- deleted 5y ago
  [deleted]
danShumway 5y ago
> the solution to things that are broken and hard is not to abandon them like a petulent child out of frustration. Are we trying to enable secure E2E encrypted messages, or are we trying to enable secure E2E email? Because those are two different goals. If we're worried about fixing unencrypted messages, then I think it's completely valid to look at systems like Email and SMS and to say that they're just not suitable for secure conversations, and to advise people to move to other platforms/protocols for secure communication that doesn't have their flaws. Signal is currently a good solution for a lot of people. That doesn't mean it doesn't have problems, but it has great encryption that is almost impossible for an ordinary user to accidentally mis-configure. Matrix is also coming into its own as a good solution, and while I don't necessarily recommend Matrix over Signal if encryption is absolutely important, it is very likely going to be a better solution in the future, and for casual encryption is a pretty good solution today. Both Matrix and Signal are easier to use than PGP for ordinary users. They are both (frankly) more reliable even for advanced users. And with the amount of effort we could put into fixing PGP-encrypted emails, we could also make a platform like Matrix really good and push really hard for its adoption. Getting people to adopt Matrix is going to be easier than getting people to adopt encrypted emails. Incidentally Matrix also improves upon a number of other centralization and protocol problems with email as well, but we're focusing specifically on encryption here. Sometimes working to a specific goal (encrypting plaintext communication) means recognizing when a strategy is bad, and pivoting to another strategy that's more pragmatic but that accomplishes the same goals. For example, I'm not going to waste time trying to "fix" SMS security for 2FA when I can tell people to install an Open Source 2FA app instead -- because the goal isn't to make email safe, and the goal isn't to make SMS safe, the goal is to make people safe. Broadening out our strategies and building cleaner, more fundamentally secure technologies is part of that.

daneel_w 5y ago

Browsers also expect plain-text. Is https by the same logic also pointless, and should no longer be used? (I get what the author is trying to say, I'm just reacting to the strange way the argument is phrased. I don't think they thought their wording and reasoning in that passage through enough.)

baybal2 5y ago
> Browsers also expect plain-text. Is https by the same logic also pointless, and should no longer be used? > I'm just reacting to the strange way the argument is phrased. It's made so in a manner to provoke a lot of loud noises to make it to spread, and resonate across the blogosphere more than the original lacking substance message ever could. A publicity stunt. It's a self-promotion tactic - saying something outrageous often earns more notoriety for somebody unable to earn fame through virtue.
Macha 5y ago
And HTTP has solved this with a hodgepodge of solutions like HSTS + preloading for producers and HTTPs everywhere/new browser settings for users but it has taken years. I think email could do this, but it require some dominant players (probably Google + Microsoft as providers for home + business users, or maybe Google/Apple/MS as dominant client producers) to participate actively.
pvg 5y ago
That's not the same logic because http is not a messaging protocol and it took many years to get to something resembling 'https by default'. Still, not being a messaging protocol https and browsers alone are not much better at exchanging end-to-end encrypted messages than plaintext since an https server sees plaintext content.
IncRnd 5y ago
> Browsers also expect plain-text. Is https by the same logic also pointless, and should no longer be used? > (I get what the author is trying to say, I'm just reacting to the strange way the argument is phrased. I don't think they thought their wording and reasoning in that passage through enough.) Your question explicitely ignores the argument that was made and pretends a point to point protocol operates similarly to a store and forward protocol.

a-dub 5y ago

one big difference between email and the systems that the author suggests is that email is a standard and a protocol, where the systems referenced by the author are pretty much single implementation systems maintained by a single authority. some of these authorities have all sorts of structure to prevent corruption. passionate people, nonprofit or open governance. however, they are still single points of failure, or targets, or whatever you'd like to call them. it seems that after years of pain with poor effectiveness of specification or poor verification tools for implementations, it has become en vogue for modern cryptosystems to insist on tight centralized control of reference implementations to ensure correctness. (otherwise known as the apple computer model). while this does seem to work in terms of ensuring high quality and problem free implementations, it does open up the single point of failure issue. i'd argue that email's replacement must retain email's greatest quality: it's an open specification, not a system or implementation owned or controlled by a single entity and that the true challenge in bringing it to fruition won't be clever protocol and cryptographic design (although these will be crucial) but also substantial advances in protocol definition and implementation verification such that any competent developer can implement compatible components and plug them in.

SV_BubbleTime 5y ago
I agree entirely. Now help me understand something… why have signal and telegram and everyone made proprietary formats and centralized implementations instead of an open email2.0 that they also support immediately? This isn’t my field, so maybe someone has?
- remirk 5y ago
  Signal says it's harder to innovate in a federated system. [1] [1] https://signal.org/blog/the-ecosystem-is-moving/ https://signal.org/blog/the-ecosystem-is-moving/
  - tptacek 5y ago
    It clearly is harder to innovate in a federated system. Look at what happened with Matrix, and how much time passed between them standardizing E2E encryption and getting E2E encryption universally deployed (I think that switch just flipped last year?). Not everything Moxie Marlinspike writes is correct, but he's been pretty well vindicated on that. Use whichever secure messenger you like, though.

burrows 5y ago

> Ordinary people don’t exchange email messages that any powerful adversary would bother to read AFAIK Google (via GMail) reads emails from/to “normal people”. Is Google not a “powerful adversary”?

zaik 5y ago

> for example, it recently turned out to be possible for eavesdroppers to decrypt messages without a key Sadly without reference. Does anyone know more about this?

sbuk 5y ago
They are referring to https://efail.de/ https://efail.de/ - works on both PGP and S/MIME, which was disclosed just over a year before the article was published. The article references this in a link to another post a few sentences before the one you quoted.
- megous 5y ago
  Processing PGP messages where correctly signed MAC doesn't match the ciphertext should not be an option at all. Message was tapered with, so MUAs have no business processing it. So unless the attacker can also produce the correct MAC matching the ciphertext, which should not be possible with out knowing a private key, I don't see how this can't be easily fixed just by checking the ciphertext against the MAC.
  - upofadown 5y ago
    Minor quibble, OpenPGP uses an authentication method called the modification detection code (MDC). It's kind of a checksum that is protected by the overlaying encryption. Very simple. It turned out to be more secure than anticipated and as a result is still in use.

approxim8ion 5y ago

The issue with encrypted email a-la PGP even beyond security issues is the laughably bad UX. I'm not going to be able to convince people to adopt the best practices involved in maintaining keys and using them to encrypt and decrypt the mail they send. Whether that is good or bad is immaterial- the cat is out of the bag and people are already used to the convenience of insecure incumbents. For messaging, we need something that is end to end encrypted by default, and is also only available in an e2ee format. Decentralization is an additional bonus, but really as long as the protocols are heavily audited and the clients are reasonably open (reproducible builds etc), it doesn't matter what your choice is and what networks your messages go through/who controls them.

JohnJamesRambo 5y ago
Could Signal ever do an email service? I’d switch to it in a second. I realize I’d be sending it to insecure addresses but at least my end wouldn’t spy on me? I just realized how dystopian that sentence is.
- Anunayj 5y ago
  even if they do, you have to maintain compatibility with "other" popular email providers. Protonmail encrypts all it's emails among it's own users. But at the end me with my gmail can't read them without jumping through hoops.
  - mmerlin 5y ago
    Mailvelope and it's browser plugin is fairly easy for encrypting gmail (and other major email providers) conversations: https://chrome.google.com/webstore/detail/mailvelope/kajibbejlbohfaggdiogboambcijhkke https://chrome.google.com/webstore/detail/mailvelope/kajibbe...
- approxim8ion 5y ago
  Thing with email is that you'd also have to get everyone you talk to to move to it and ensure they don't fall back to any of the services they have been using for all this time for convenience's sake. At which point, it doesn't even matter if it is email behind the scenes or something else. There's also the issue of SMTP being very metadata heavy and there being no option to mitigate or encrypt any of the metadata. Which is why something like Delta Chat (if you haven't heard of it, it's basically Signal/WhatsApp like IM piggybacking over email) isn't very private.

jabbany 5y ago

Lacking any protocol changes in the near term, is the best (portable and somewhat secure) approach for an average person to just put sensitive stuff in an encrypted zip file or something...?

approxim8ion 5y ago
Provided it is AES encryption, yeah it's not bad. For storage, I would recommend Veracrypt though since it's more specifically designed for this purpose.
- shawnz 5y ago
  What about for communicating with darknet vendors, where PGP is the established standard?

michaelcampbell 5y ago

Keeping your house safe from a dedicated intruder is impossible, so you shouldn't even try.

avodonosov 5y ago

LARP security stads for Live Action Role-Playing security?

retsibsi 5y ago
That's how I read it -- the claim being that those people are basically doing it for fun, 'playing the role' of someone with important secrets or powerful adversaries.
- avodonosov 5y ago
  Like this "activist" https://news.ycombinator.com/item?id=28433601 https://news.ycombinator.com/item?id=28433601 BTW, I am curious, if he used secure messenger instead of email, as the article suggests, would police be able to track him...

tzs 5y ago

> Metadata is as important as content, and email leaks it There are a lot of cases where I don't have any reason to care about metadata leaks. I've written plenty of reports for example where it was no secret that I was writing the report, what it was about, about how long it would be, when it would be finished, and to whom it was to be delivered. As far as I can see delivering those reports as encrypted attachments to email would be fine. > Every archived message will eventually leak My encrypted attachment would be fine with this too. If some receiver archives the email the attachment will be encrypted in the archive.

imglorp 5y ago
Yours is a rare usecase. The metadata is bad for two reasons. First, simply knowing who mailed whom and when, the powerful adversary can merely visit all participants and urge them to divulge the key and contents. If the adversary didn't know the participants beforehand, they do after seeing the helpful metadata. Second, even failing to read the mail, the powerful adversary can still apply guilt by association, so merely being on the email is enough to attract their attention.
- TillE 5y ago
  I use PGP email for business communication. It's absolutely no secret that a business relationship exists between us, merely the content is sensitive. Obviously it's a problem for like, whistleblowers, but that's not most people.
  - imglorp 5y ago
    Sometimes business comms /are/ sensitive to knowing the participants. If the head of M+A of one corp is talking to the CEO of another, that might be interesting. If a bunch of Silicon Valley HR leads are mailing each other, is there another anti-poaching agreement in the works? If some retail competitors' sales VPs are mailing each other, is there some price fixing or collusion going on? There's a lot of signals here revealed by metadata.
- mLuby 5y ago

supernintendo 5y ago

The author says not to use email encryption but what is the case for sending email in plain text? Is encrypted email detrimental to my privacy in some way that unencrypted email is not? Or if the argument is that encrypted email is useless and no better than unencrypted email (since it is always unencrypted at rest) then what is the point of avoiding it in favor of the alternative? Aren't they equivalent, making the distinction meaningless? This is my problem with the article. It feels like it suffers from a bit of zero-sum fallacy. The statement here is, "it can be broken therefore it's fundamentally broken." I think it's more useful to think in terms of probabilities. If I disable password authentication for SSH and require public key authentication on my web server, an attacker can still get in by stealing my private key. That isn't a reason to take the opposite approach however - botnets commonly employ password-guessing attacks against entire IP ranges so you're not actually safer by avoiding this practice just because it isn't a perfect solution. There is no silver bullet for security, only endless layers of strategies and adaptations to edge cases. I did enjoy some of the points about the limitations of email encryption (the email chain example is a great reminder of how security is often more about human behavior than software). But I think the article could have been more compelling had it presented a less dogmatic thesis - perhaps "Email Encryption Won't Save You" or something like that.

ameliaquining 5y ago
The point being made is that, if something is sensitive enough that you would hesitate to send it in the clear, you should send it over Signal or some other system that doesn't have the security flaws that encrypted email has. Given that that option exists, and that encrypted email isn't suitable for many use cases that people are tempted to use it for (and is therefore an attractive nuisance securitywise), there's not much reason to use or support encrypted email at all.
- sneak 5y ago
  Normal people assume that email is a perfectly safe and secure way to transmit PII and other sensitive information, FWIW. The idea that "email is insecure" is not a widely known one.

greenyoda 5y ago

Original HN discussion from 2020, for those who are interested: https://news.ycombinator.com/item?id=22368888 https://news.ycombinator.com/item?id=22368888

clipradiowallet 5y ago

I disagree with this author's take on PGP. Perhaps the people they communicate with reply in plaintext, quoting the author...but that's not my experience. That type of behavior is an opsec failure, not a PGP failure. A tool (like PGP) does not imply a privacy-guaranteed scenario. For an analogy, carrying a handgun does not make you James Bond, and carrying a lockpick does not make you a locksmith. They are just tools, and possessing one of them [like PGP] does not intrinsically include the knowledge and ability to use that tool properly.

quicklime 5y ago

> So, for example, it recently turned out to be possible for eavesdroppers to decrypt messages without a key, simply by tampering with encrypted messages. Most technologists who work with PGP don’t understand it at a low enough level to see what’s wrong with it. This is news to me, but I’ll admit I’m one of those technologists who doesn’t understand it enough. Can anyone point me to more info on this?

doomrobo 5y ago
https://efail.de/ https://efail.de/
- faeyanpiraat 5y ago
  Okay, so PGP is not vulnerable.
upofadown 5y ago
It's the EFAIL thing. Which was an actual issue but was wildly misrepresented in the media[1]. [1] https://articles.59.ca/doku.php?id=pgpfan:efail https://articles.59.ca/doku.php?id=pgpfan:efail
- tptacek 5y ago
  This is such a bizarre article. Efail was, among other things, a peer-reviewed accept at Usenix Security in 2018. It is certainly and obviously not a "hoax". Cryptography engineers have been warning about the pattern of PGP weaknesses that led to it for almost a decade prior.
  - upofadown 5y ago
    You might want to read the article more carefully taking into account context: >The word “Hoax” in the title of this article refers to the attempts to make it seem that EFAIL represented some deficiency in PGP. Which was found after an example of a "hyperbolic headline". Later in the article it explicitly addresses the media distortion. I don't know how anyone could get from that that the article was claiming that the article was some sort of hoax, particularly when the article actually praises the work represented by the paper.

normaler 5y ago

What I like most about PGP is message signing. A signed message can prove to the receiving party that it was really me who send the message. Also it does not require any setup on the receiving end.

snotrockets 5y ago
In practice, I found future deniability to be more useful. PGP was never designed for a real security scenario, and it shows.
- upofadown 5y ago
  If you want deniability you simply don't sign the email in the first place. That actually works, as opposed to something like Signal that attempts to claim deniability through forgability.

unethical_ban 5y ago

The author's tone is really grating; they insult anyone who disagrees with them. I think they're rude and need to learn how to write better. "LARP LARP LARP". How shitty. Essentially, their argument is: Metadata isn't protected, and mail gets archived when perhaps you want messages to disappear. If you're writing messages on any system with the assumption they aren't stored somewhere indefinitely, you're already failing, buckaroo.

dgan 5y ago

funny, it takes only 2 link hopes to find a contradictory statement ("Use PGP!")

kuon 5y ago

Signal is suggested, but it requires a mobile phone, which is not an option for me. That's why I use matrix, but I fear it will not catch on enough, and email will be the only option people will have to contact me. But I somehow agree that encrypting email is not an option as there are too much complications to it.

whartung 5y ago

So, then, what are the issues with S/MIME? Thunderbird supports it. Apple Mail supports it. Gmail does (but not for free accounts). It's the core of the DIRECT Messaging protocol we use in healthcare. There are millions of messages being sent via DIRECT every week. Mind, DIRECT is more than just S/MIME, it's a just a component of it (there's an entire trust system involved as well). I appreciate the issue with leakage, which are very real, mostly due to the UI of the systems. I honestly don't know how well the programs like Apple Mail et al keep you from shooting yourself in the foot with S/MIME encrypted mail (such as "You're about to forward an encrypted email in the clear, are you sure you want to do that?"). The post bags on PGP, so I'm just curious if there are weaknesses inbuilt to S/MIME.

iggldiggl 5y ago
As the article already alludes to, I want full-text search, and I also want to use it with my phone or via webmail, so having to download all messages to decrypt and search them locally is out.

slackfan 5y ago

"Email is inherently unsafe, everything will leak, therefore do not use encrypted email". This is about the equivalent of not just throwing out the baby with the bath water, but taking the baby putting it in a rocket and launching it at the moon. Never assume a network is private, never assume anything communicated over anything other than a piece of paper passed between two human beings in a secure room is private, and even then be suspicious. But for gods' sake, use encrypted email.

decebalus1 5y ago

Why is this type of content upvoted on hn? The only interesting thing about this 'article' is that I'm not sure exactly what type of logical fallacy it represents. Is it a false dilemma? What is it? Interesting..

upofadown 5y ago

The contention that some encrypted instant messenger might be better than encrypted email has not aged very well with Cellebrite's cheerful reminder that even low level attacks like forensic boxes get saved Signal messages. Things like Signal depend on a forward secret protocol in concert with a user willing to immediately delete their old messages to prevent such data exposure. It turns out that such users are rare. Encrypted email can be done exclusively in very safe places and the secret key that protects both the transferred and saved messages can be protected very well. This is entirely because of the difference in the mediums. Email can be completely locked up in any sort of dangerous environment because it is inherently offline. Something like instant messaging has to expose the secret stuff all the time to produce all the time access. There might be people who like to LARP their encrypted email and that is a legitimate thing to do. There are people that actually need the level of security that can be provided by an asynchronous messaging system like encrypted email.

tptacek 5y ago
Cellebrite relies on compromised endpoints. It has little to do with the discussion being had on this thread.

giantrobot 5y ago

I find the authors arguments about PGP to be really strange because realistically they mostly apply to Signal and other E2EE messaging apps. E2EE only guarantees encryption in transit between two end nodes. Infrastructure between those two nodes can't read or alter the payload. That is the only thing it guarantees. Once an end node receives a message any guarantees of encryption/safety go out the window. There's no guarantee the intended recipient is in possession of the end node or someone isn't shoulder surfing them. There's also no guarantees the end node's local message storage will remain secure in perpetuity. There's also no guarantee that the metadata of messages, even sent through a nominally secure service, will also remain secure in perpetuity. Signal as a service might be very secure and will never leak metadata but there's no guarantee of that especially if state funded malefactors target the service. The security of messages at rest is pretty similar between PGP e-mail and Signal messages. Signal's metadata is more secure than e-mail by default but that may not always be true.

tptacek 5y ago
The point isn't what people can do. No matter what transport you use, people can just screenshot their messages if they want to screw you over. It's what they're likely to do. Nobody that has used encrypted email for any length of time with more than a couple of people has failed to see an unencrypted reply. If they're being honest, most people who've used PGP email for a long time would admit generating unencrypted replies.
- giantrobot 5y ago
  You're describing UX issues with e-mail clients and not PGP. If e-mail clients are your problem complain about their failings rather than attributing them to PGP.
  - tptacek 5y ago
    Note the title of the post.
  - danShumway 5y ago

raven108 5y ago

Nihilistic post. Sure email standard has issues outlined. But given the recent Aussie laws and general political climate using plain text email is asking for trouble. I think Tutanota has done end rub around all these issues. Been using for few months and works well. AES, encryption at rest, plain email and shared passwords too. But given the EU tech law trend towards increased sifting through communication they are being and will be targeted. While Proton gets all the publicity but I feel they have better offering, including clients on all platforms.

deleted 5y ago

[deleted]