4 ms·
emphatically: no. the solution to things that are broken and hard is not to abandon them like a petulent child out of frustration. defeatist bullshit from the
by nimbius 5y ago
emphatically: no. the solution to things that are broken and hard is not to abandon them like a petulent child out of frustration.
defeatist bullshit from the article:
>Every long term secret will eventually leak.
is not a valid excuse for abandoning PGP or encrypted email, its wishful thinking at best.
>The standard and best answer here is Signal
Signals github releases are sporadic at best and hard to compile consistently. its also centralized and has a dependency on google services to operate and lacks real transparency about its outages or plans to scale/operate, but at least its not too hard for you.
>Hop-by-hop encryption is a good thing: it makes untargeted dragnet surveillance harder.
the devices that handle this mail are commercial MTAs and are already largely backdoored by three letter agencies. a poison prime here, a weak cipher there, or even an opportune warrantless surveillance national security letter can sidestep this easily. companies will bend to the rule of US law.
>PGP don’t make this kind of surveillance any harder, and a targeted attacker will still get access to mail servers and messages.
this is a tangible, almost white-hot ignorance i cant abide. yes. youll get a PGP message. that message is encrypted with an asymmetric key and with a strong passphrase will have your adversary guessing until the last star falls from the heavens* and the statute of limitations for what was once your proud nation finally expire. PGP was invented to secure things that were transmitted IN PLAINTEXT.
trust was sacrosanct as you were expected to verify and know the person to which you were sending...you had keysigning parties and you used PGP to talk about important things with people you trusted. PGP is still valid and useful to this day.
* quantum computing may make this easier, but if it does, post-quantum ciphers are still an option
- deleted 5y ago[deleted]
- deleted 5y ago[deleted]
- danShumway 5y ago> the solution to things that are broken and hard is not to abandon them like a petulent child out of frustration. Are we trying to enable secure E2E encrypted messages, or are we trying to enable secure E2E email? Because those are two different goals. If we're worried about fixing unencrypted messages, then I think it's completely valid to look at systems like Email and SMS and to say that they're just not suitable for secure conversations, and to advise people to move to other platforms/protocols for secure communication that doesn't have their flaws. Signal is currently a good solution for a lot of people. That doesn't mean it doesn't have problems, but it has great encryption that is almost impossible for an ordinary user to accidentally mis-configure. Matrix is also coming into its own as a good solution, and while I don't necessarily recommend Matrix over Signal if encryption is absolutely important, it is very likely going to be a better solution in the future, and for casual encryption is a pretty good solution today. Both Matrix and Signal are easier to use than PGP for ordinary users. They are both (frankly) more reliable even for advanced users. And with the amount of effort we could put into fixing PGP-encrypted emails, we could also make a platform like Matrix really good and push really hard for its adoption. Getting people to adopt Matrix is going to be easier than getting people to adopt encrypted emails. Incidentally Matrix also improves upon a number of other centralization and protocol problems with email as well, but we're focusing specifically on encryption here. Sometimes working to a specific goal (encrypting plaintext communication) means recognizing when a strategy is bad, and pivoting to another strategy that's more pragmatic but that accomplishes the same goals. For example, I'm not going to waste time trying to "fix" SMS security for 2FA when I can tell people to install an Open Source 2FA app instead -- because the goal isn't to make email safe, and the goal isn't to make SMS safe, the goal is to make people safe. Broadening out our strategies and building cleaner, more fundamentally secure technologies is part of that.
- bscphil 5y agoI think you're both right. Email is subpar as a protocol for sending secure messages (what you said) and should therefore be abandoned as a protocol in favor of something better, and also many of the specific arguments made in the article are quite weak (what they said). E.g. PGP doesn't make dragnet surveillance harder?? Unless you assume that point-to-point encryption makes it entirely impossible (wrong), PGP clearly makes it much harder for anyone to read your message.
- deleted 5y ago[deleted]