7 ms·

What seems to be the problem with pgp (apart from nobody using it)

by andi999 5y ago

michaelt 5y ago
https://latacora.micro.blog/2019/07/16/the-pgp-problem.html https://latacora.micro.blog/2019/07/16/the-pgp-problem.html
- upofadown 5y ago
  I have a canned response to this hoary old chestnut: * https://articles.59.ca/doku.php?id=pgpfan:tpp https://articles.59.ca/doku.php?id=pgpfan:tpp
  - encryptluks2 5y ago
    I think most people complaining about GPG just don't want to be bothered with figuring anything out. They'd rather input their phone number into some cloud app that says it is secure and feel more secure than actually be bothered with understanding security in the first place.
    - akerl_ 5y ago
      This is pretty wild. I’ve spent a decade working in the industry, most of it unwinding complex infrastructure and codebases. I don’t hate GPG because I can’t be bothered to figure it out. I understand it and it’s bad at handling the problems it claims to solve.
      - encryptluks2 5y ago
        Such as? Can you provide any examples?
        akerl_ 5y ago
        https://latacora.micro.blog/2019/07/16/the-pgp-problem.html https://latacora.micro.blog/2019/07/16/the-pgp-problem.html
        encryptluks2 5y ago
        I really don't have time to go through every item in the biased article, but you can hide recipients, you can use Ed25519. Seriously, if I was influenced by every blog post I read then I would probably be using Windows 7 still and trusting everything Gartner says.
        akerl_ 5y ago
        It seems a bit rude to ask me for examples, have me provide one, and then just shrug it off that you don’t have time to address the items. “You can use ed25519” kindof flies in the face of the point being made in the post, which is that sure, you can use modern crypto, but you’re bounded by the lowest common denominator, and GPG’s lowest common denominator is horrible broken crypto selections.
        encryptluks2 5y ago
        Yet the article is just making baseless accusations and so are you.
  - tptacek 5y ago
    You also have a lot of weird cryptographic beliefs, like "authenticated encryption is a misfeature for tools like PGP, because unauthenticated ciphertext helps with data recovery", or "GPGME definitely doesn't just execute the GPG binary in order to perform PGP operations", or "forward secrecy is overrated because people keep all their old messages around" (also: "people should keep all their old messages around"). People that also believe these weird things will find your canned reply convincing. Cryptography engineers generally will not. The word "hoary" means "grey-haired". "Stop Using Encrypted Email" was published in 2020; even in dog years, it's not "hoary".
md_ 5y ago
I think that’s the biggest problem, but there are others. Off the top of my head: - PGP key discovery is hard to do securely. Do you just trust what’s on the public keyserver? Do you use RFC 7929? S/MIME is relatively better in this respect, but obviously still quite behind the state of the art for e.g. Web PKI. - PGP has so many different potential client configurations that it’s hard to reason about what security you are getting. Someone can (and for S/MIME, this is quite common!) have a PGP or S/MIME gateway that encrypts/decrypts mail to/from MUAs—meaning messages sit unencrypted in mailboxes and end user devices. - PGP doesn’t encrypt metadata. - PGP doesn’t give forward secrecy. I’m sure there are other things I’m not thinking about, but for at least these reasons, PGP is in some ways less secure than SMTP TLS, hard to use correctly, and in general a lot of effort to leave you worse off than if you just chatted over WhatsApp/Signal/Wire/Threema/etc instead. Transport layer security (and enforcing that) is definitely good for email, and we’ve moved the state of the art beyond where it was in the ‘70s, but I think the quest for true e2ee in SMTP-based email is probably not worth the effort. Email should be thought of as having certain tradeoffs (like messages living unencrypted on servers, and relying fully on server to server trust), and for things that need e2ee, you should use something like Signal instead.
- upofadown 5y ago
  >- PGP doesn’t give forward secrecy. Generally, the value of forward secrecy in end to end encrypted messaging is proportional to the chance that the secret key material will be compromised. With an asynchronous, offline capable medium like encrypted email the secret key material can be protected very very well. A message archive accessible to the user for all practical purposes negates the value of forward secrecy. Most people like to keep their old emails around. Most people like to keep any form of messages around so that forward secrecy has little practical value in most forms of E2EE messaging. There is no technical reason that you can't do forward secrecy for PGP. There is simply no real need for it. Encrypted email is more for the people that don't want their encrypted material compromised in the first place... More discussion: https://articles.59.ca/doku.php?id=pgpfan:forward_secrecy https://articles.59.ca/doku.php?id=pgpfan:forward_secrecy
  - danShumway 5y ago
danShumway 5y ago
Not going to rehash what other people are writing about PGP, that could be a much longer conversation. But it's not just PGP that's the problem, PGP just happens to be what people are using to encrypt email. If it was just PGP that was the problem, we'd use something else to encrypt our emails and it would be fine. But the problem is that any system that works like PGP where we're primarily encrypting message contents, where we're not thinking about stuff like forward secrecy -- that's not good for email. Email itself isn't good for that because email doesn't really lend itself to E2EE, regardless of what you use to do the encrypting and key validation. So you could have a version of PGP that was amazing and brilliant, and it still wouldn't really be a good fit for encrypting email, because email is not a good fit for encrypting email. The entire structure of how email works makes it difficult to do encryption in a user-friendly, accessible way. I am also pretty skeptical of PGP (see some of the other comments), but that's not specifically why I mentioned it in my original comment. I only brought it up because most email encryption schemes I see are using PGP, and I don't think that PGP miraculously solves the problem. It's not good enough to paper over the fundamental flaws in email itself.

What seems to be the problem with pgp (apart from nobody using it)

michaelt 5y ago

https://latacora.micro.blog/2019/07/16/the-pgp-problem.html https://latacora.micro.blog/2019/07/16/the-pgp-problem.html

upofadown 5y ago
I have a canned response to this hoary old chestnut: * https://articles.59.ca/doku.php?id=pgpfan:tpp https://articles.59.ca/doku.php?id=pgpfan:tpp
- encryptluks2 5y ago
  I think most people complaining about GPG just don't want to be bothered with figuring anything out. They'd rather input their phone number into some cloud app that says it is secure and feel more secure than actually be bothered with understanding security in the first place.
  - akerl_ 5y ago
    This is pretty wild. I’ve spent a decade working in the industry, most of it unwinding complex infrastructure and codebases. I don’t hate GPG because I can’t be bothered to figure it out. I understand it and it’s bad at handling the problems it claims to solve.
    - encryptluks2 5y ago
      Such as? Can you provide any examples?
      - akerl_ 5y ago
        https://latacora.micro.blog/2019/07/16/the-pgp-problem.html https://latacora.micro.blog/2019/07/16/the-pgp-problem.html
        encryptluks2 5y ago
        I really don't have time to go through every item in the biased article, but you can hide recipients, you can use Ed25519. Seriously, if I was influenced by every blog post I read then I would probably be using Windows 7 still and trusting everything Gartner says.
        akerl_ 5y ago
        It seems a bit rude to ask me for examples, have me provide one, and then just shrug it off that you don’t have time to address the items. “You can use ed25519” kindof flies in the face of the point being made in the post, which is that sure, you can use modern crypto, but you’re bounded by the lowest common denominator, and GPG’s lowest common denominator is horrible broken crypto selections.
        encryptluks2 5y ago
        Yet the article is just making baseless accusations and so are you.
- tptacek 5y ago
  You also have a lot of weird cryptographic beliefs, like "authenticated encryption is a misfeature for tools like PGP, because unauthenticated ciphertext helps with data recovery", or "GPGME definitely doesn't just execute the GPG binary in order to perform PGP operations", or "forward secrecy is overrated because people keep all their old messages around" (also: "people should keep all their old messages around"). People that also believe these weird things will find your canned reply convincing. Cryptography engineers generally will not. The word "hoary" means "grey-haired". "Stop Using Encrypted Email" was published in 2020; even in dog years, it's not "hoary".

md_ 5y ago

I think that’s the biggest problem, but there are others. Off the top of my head: - PGP key discovery is hard to do securely. Do you just trust what’s on the public keyserver? Do you use RFC 7929? S/MIME is relatively better in this respect, but obviously still quite behind the state of the art for e.g. Web PKI. - PGP has so many different potential client configurations that it’s hard to reason about what security you are getting. Someone can (and for S/MIME, this is quite common!) have a PGP or S/MIME gateway that encrypts/decrypts mail to/from MUAs—meaning messages sit unencrypted in mailboxes and end user devices. - PGP doesn’t encrypt metadata. - PGP doesn’t give forward secrecy. I’m sure there are other things I’m not thinking about, but for at least these reasons, PGP is in some ways less secure than SMTP TLS, hard to use correctly, and in general a lot of effort to leave you worse off than if you just chatted over WhatsApp/Signal/Wire/Threema/etc instead. Transport layer security (and enforcing that) is definitely good for email, and we’ve moved the state of the art beyond where it was in the ‘70s, but I think the quest for true e2ee in SMTP-based email is probably not worth the effort. Email should be thought of as having certain tradeoffs (like messages living unencrypted on servers, and relying fully on server to server trust), and for things that need e2ee, you should use something like Signal instead.

upofadown 5y ago
>- PGP doesn’t give forward secrecy. Generally, the value of forward secrecy in end to end encrypted messaging is proportional to the chance that the secret key material will be compromised. With an asynchronous, offline capable medium like encrypted email the secret key material can be protected very very well. A message archive accessible to the user for all practical purposes negates the value of forward secrecy. Most people like to keep their old emails around. Most people like to keep any form of messages around so that forward secrecy has little practical value in most forms of E2EE messaging. There is no technical reason that you can't do forward secrecy for PGP. There is simply no real need for it. Encrypted email is more for the people that don't want their encrypted material compromised in the first place... More discussion: https://articles.59.ca/doku.php?id=pgpfan:forward_secrecy https://articles.59.ca/doku.php?id=pgpfan:forward_secrecy
- danShumway 5y ago

danShumway 5y ago

Not going to rehash what other people are writing about PGP, that could be a much longer conversation. But it's not just PGP that's the problem, PGP just happens to be what people are using to encrypt email. If it was just PGP that was the problem, we'd use something else to encrypt our emails and it would be fine. But the problem is that any system that works like PGP where we're primarily encrypting message contents, where we're not thinking about stuff like forward secrecy -- that's not good for email. Email itself isn't good for that because email doesn't really lend itself to E2EE, regardless of what you use to do the encrypting and key validation. So you could have a version of PGP that was amazing and brilliant, and it still wouldn't really be a good fit for encrypting email, because email is not a good fit for encrypting email. The entire structure of how email works makes it difficult to do encryption in a user-friendly, accessible way. I am also pretty skeptical of PGP (see some of the other comments), but that's not specifically why I mentioned it in my original comment. I only brought it up because most email encryption schemes I see are using PGP, and I don't think that PGP miraculously solves the problem. It's not good enough to paper over the fundamental flaws in email itself.