7 ms·

Given how much of a huge pain it was to use PGP / gpg back in the days (for email encryption/signatures, to be precise), it's amazing how easy end-to-end encryp

Given how much of a huge pain it was to use PGP / gpg back in the days (for email encryption/signatures, to be precise), it's amazing how easy end-to-end encryption on Signal and Whatsapp is. And how it lacks that drama that somehow always surrounded GPG. Is it really because trust on first use is good enough for most cases? Or is email somehow so much different than chat? Or was PGP the proof-of-concept, and current e2e encrypted platforms are the v1.0? Or all of the above? Did I miss anything important?

OJFord 3y ago
If Gmail had decided to care about it, the experience in email might be nice too (or at least for Gmail users). But instead it wants to be able to read it to suggest calendar events etc. i.e. WhatsApp and Signal care about UX and mainstream adoption. Nothing like that for email has tried to do PGP.
woodruffw 3y ago
PGP as an ecosystem has always suffered from toolbox-itis: when a tool (especially a cryptographic tool) tries to be everything, it ends up doing nothing particularly well. This got ossified in the form of OpenPGP, and has basically remained the status quo for the last ~25 years. More generally, the OpenPGP world is in a bit of a double-bind: they can either fix things by breaking compatibility (at which point someone can reasonably observe that there's no good reason not to ditch OpenPGP entirely), or retain compatibility and accept that OpenPGP will never get much better than RFC 4880 and whatever smattering of drafts the GnuPG maintainers agree to implement. One way essentially results in an entirely different tool/standard that happens to be wearing PGP's skin; the other means keeping around misuse-prone and outright broken cryptographic primitives (and bad formats to boot). (To answer your actual question: email is just a bad substrate for attempting E2EE messaging. Latacora has a great explainer post on why[1]. TOFU is a mostly adjacent concern; trust/identity negotiation is hard, but the thing that makes WhatsApp, Signal, etc. actually work is that they eliminate manual key management and make cryptographic right choices for the user, rather than expecting the user to hold the tool correctly. In other words: they're misuse-resistant, where PGP as an ecosystem has historically not been.) [1]: https://www.latacora.com/blog/2020/02/19/stop-using-encrypted/ https://www.latacora.com/blog/2020/02/19/stop-using-encrypte...
- tcfhgj 3y ago
  they arent miss-use resistant when it comes to mitm attacks
  - woodruffw 3y ago
    Neither Signal nor WhatsApp is MITM-able. Could you explain why you think they are? (Signal and WhatsApp also have forward secrecy properties that PGP, as an ecosystem, is nowhere close to providing. PGP very much still operates under the "one master key that you must never ever lose or disclose" paradigm.)
    - matheusmoreira 3y ago
      They are trivially MITM-able. Not long ago there was news posted here that telecom employees are selling SIM swaps. There's your MITM vulnerability. People can pay to impersonate others by taking over their phone numbers and consequently their messenger accounts. This attack will be noticeable: there will be a message warning the user that the cryptographic keys have changed on the other end. You know what else generates these warnings? Reinstalling WhatsApp, switching phones... They're basically noise to users by now due to alarm fatigue. How many users even know what that this key stuff means anyway? How many people even use the built-in key verification function which consists of just scanning a QR code? I've yet to meet a single person who cares about any of this stuff.
    - deleted 3y ago
      [deleted]
    - sowbug 3y ago
      My guess is that the term "MITM" is being overfit to include the basic problem of verifying that A's identity really belongs to A rather than M.
      - 7bit 3y ago
        But you can verify the other end. Not wanting so so that ist Not a Problem of the App or protocol.
pvg 3y ago
Email being different from chat is a big factor and another one is that the entire system in Signal is designed and engineered specifically for the purpose, from the protocol on up. Retrofitting privacy, confidentiality, etc onto email is one of those noble 90's cryptography dreams that turned out to be unrealistic and impractical.
- vlovich123 3y ago
  I find it hard to believe that you couldn’t retrofit Signal into an email app. Encrypted comms is quite good at sitting on unencrypted untrusted channels and signal is already asynchronous. The challenge is that there’s no money to be made so you’d need a non profit like Signal to do it to disrupt that industry.
  - pvg 3y ago
    You can make an email-like app out of Signal but nobody would call that email since it won't work with the thing everyone else calls email. You can't just add Signal to actual email and get something with the security and privacy properties of Signal, though.
    - vlovich123 3y ago
      Why couldn't you have a browser extension for gmail that checked whether the other end was registered & if it was encrypt the email body before it's sent? You get transparent upgrades for your friends who have the extension installed.
      - pvg 3y ago
        The latacora link in the sibling comment covers most of that.
        vlovich123 3y ago
        Nope actually it doesn’t. It makes the case that pgp is a bad implementation but makes the leap to claim that means there’s no way to improve the situation. For example, you could run a proxy server to deliver the messages between parties. So if you’re emailing someone, the browser extension changes the address to be a server you control, sends you the encrypted email that has everything meaningful encrypted, you decrypt the part your able to (ie the intended receiver) and forward that. As far as either email server is concerned, your email server is sending out and receiving encrypted emails but there’s no metadata to connect anyone. The key handling uses your access to the email account to validate access same as signal uses the phone number. That seems like a pretty close system to how Signal works and I don’t see anything meaningfully different. If you do, can you actually elaborate? I don’t feel like the link you pointed me answers why my proposal would be larping security since the security and threat model feels very similar to Signal. Here are some choice quotes I pulled out of that link and why I have problems with the claims made: > Searchable archives are too useful to sacrifice, but for secure messaging, archival is an unreasonable default. Secure messaging systems make arrangements for “disappearing messages”. Signal and most apps except Snapchat (which isn’t e2e afaik) don’t archive by default. But yes, it is true that having encrypted web mail and search are incompatible whereas messaging apps store the data locally and thus can provide search. You’d need a dedicated client that could store all the encrypted messages locally but people aren’t as used to for that. > Some email clients have obscure tools for automatically pruning archives, but there’s no way for me to reliably signal to a counterparty that the message I’m about to send should not be retained for more than 30 minutes. Talk about security LARPing. Once the message is sent you’ve lost all control of it. Your just following social contracts that the app honors the request and the user is using an unmodified app. > No matter how good a job one does securing their own data, their emails are always at the mercy of the least secure person they’ve sent them to. Also true for messaging apps
barfbagginus 3y ago
Signal and WhatsApp are no good against state actors And that is where they get their usability
- tptacek 3y ago
  In what way is Signal "no good against state actors"?
  - mdhb 3y ago
    I could think of a few ranging from just asking Apple for a copy of your iCloud backups, asking you personally for a copy of the messages through to exploiting iOS itself.
    - akerl_ 3y ago
      Given that iCloud backups don't contain Signal messages, and "ask you for a copy" and "exploit the OS" affect any application... can you clarify?
      - mdhb 3y ago
        The context was what are things that those with more or less unlimited resources can do in order to read your signal messages. They are 3 particular paths that aren’t in any way open to most attackers but will work here. Saying it impacts all applications isn’t wrong but it’s also not relevant to what was asked. If whatever the hell you are doing requires a threat model where the NSA is interested in finding out who you are talking with and what you are saying the original comment of signal is inappropriate is 100% accurate.
        tptacek 3y ago
        If your threat model involves NSA finding out who is talking to you, PGP literally doesn't help you at all: it doesn't protect metadata.
aborsy 3y ago
WhatsApp is a phone app for messaging. PGP is a protocol for email and file encryption in any operating system. It’s unclear why you are comparing them. PGP could have a phone app that will do easy encryption, such as protonmail.
LtWorf 3y ago
> it's amazing how easy end-to-end encryption on Signal and Whatsapp is Amazing that you consider a proprietary thing like whatsapp remotely secure. For all we know it's backdoored. And signal… not available on fdroid… thus mostly installed via apple/google… how difficult would it be to push a backdoored update to selected individuals? GPG is more secure
littlestymaar 3y ago
> it's amazing how easy end-to-end encryption on Signal and Whatsapp is They both use a centralized, authority for identification and key sharing, sidestepping the hardest part entirely. Also, they are their own protocol and as such you don't suffer the encrypted/plain-text-only email dichotomy, sidestepping another pain point. When you don't care about the decentralized nature of email and can force everything to be encrypted, then the problem becomes much easier.

OJFord 3y ago

If Gmail had decided to care about it, the experience in email might be nice too (or at least for Gmail users). But instead it wants to be able to read it to suggest calendar events etc. i.e. WhatsApp and Signal care about UX and mainstream adoption. Nothing like that for email has tried to do PGP.

woodruffw 3y ago

PGP as an ecosystem has always suffered from toolbox-itis: when a tool (especially a cryptographic tool) tries to be everything, it ends up doing nothing particularly well. This got ossified in the form of OpenPGP, and has basically remained the status quo for the last ~25 years. More generally, the OpenPGP world is in a bit of a double-bind: they can either fix things by breaking compatibility (at which point someone can reasonably observe that there's no good reason not to ditch OpenPGP entirely), or retain compatibility and accept that OpenPGP will never get much better than RFC 4880 and whatever smattering of drafts the GnuPG maintainers agree to implement. One way essentially results in an entirely different tool/standard that happens to be wearing PGP's skin; the other means keeping around misuse-prone and outright broken cryptographic primitives (and bad formats to boot). (To answer your actual question: email is just a bad substrate for attempting E2EE messaging. Latacora has a great explainer post on why[1]. TOFU is a mostly adjacent concern; trust/identity negotiation is hard, but the thing that makes WhatsApp, Signal, etc. actually work is that they eliminate manual key management and make cryptographic right choices for the user, rather than expecting the user to hold the tool correctly. In other words: they're misuse-resistant, where PGP as an ecosystem has historically not been.) [1]: https://www.latacora.com/blog/2020/02/19/stop-using-encrypted/ https://www.latacora.com/blog/2020/02/19/stop-using-encrypte...

tcfhgj 3y ago
they arent miss-use resistant when it comes to mitm attacks
- woodruffw 3y ago
  Neither Signal nor WhatsApp is MITM-able. Could you explain why you think they are? (Signal and WhatsApp also have forward secrecy properties that PGP, as an ecosystem, is nowhere close to providing. PGP very much still operates under the "one master key that you must never ever lose or disclose" paradigm.)
  - matheusmoreira 3y ago
    They are trivially MITM-able. Not long ago there was news posted here that telecom employees are selling SIM swaps. There's your MITM vulnerability. People can pay to impersonate others by taking over their phone numbers and consequently their messenger accounts. This attack will be noticeable: there will be a message warning the user that the cryptographic keys have changed on the other end. You know what else generates these warnings? Reinstalling WhatsApp, switching phones... They're basically noise to users by now due to alarm fatigue. How many users even know what that this key stuff means anyway? How many people even use the built-in key verification function which consists of just scanning a QR code? I've yet to meet a single person who cares about any of this stuff.
  - deleted 3y ago
    [deleted]
  - sowbug 3y ago
    My guess is that the term "MITM" is being overfit to include the basic problem of verifying that A's identity really belongs to A rather than M.
    - 7bit 3y ago
      But you can verify the other end. Not wanting so so that ist Not a Problem of the App or protocol.

pvg 3y ago

Email being different from chat is a big factor and another one is that the entire system in Signal is designed and engineered specifically for the purpose, from the protocol on up. Retrofitting privacy, confidentiality, etc onto email is one of those noble 90's cryptography dreams that turned out to be unrealistic and impractical.

vlovich123 3y ago
I find it hard to believe that you couldn’t retrofit Signal into an email app. Encrypted comms is quite good at sitting on unencrypted untrusted channels and signal is already asynchronous. The challenge is that there’s no money to be made so you’d need a non profit like Signal to do it to disrupt that industry.
- pvg 3y ago
  You can make an email-like app out of Signal but nobody would call that email since it won't work with the thing everyone else calls email. You can't just add Signal to actual email and get something with the security and privacy properties of Signal, though.
  - vlovich123 3y ago
    Why couldn't you have a browser extension for gmail that checked whether the other end was registered & if it was encrypt the email body before it's sent? You get transparent upgrades for your friends who have the extension installed.
    - pvg 3y ago
      The latacora link in the sibling comment covers most of that.
      - vlovich123 3y ago
        Nope actually it doesn’t. It makes the case that pgp is a bad implementation but makes the leap to claim that means there’s no way to improve the situation. For example, you could run a proxy server to deliver the messages between parties. So if you’re emailing someone, the browser extension changes the address to be a server you control, sends you the encrypted email that has everything meaningful encrypted, you decrypt the part your able to (ie the intended receiver) and forward that. As far as either email server is concerned, your email server is sending out and receiving encrypted emails but there’s no metadata to connect anyone. The key handling uses your access to the email account to validate access same as signal uses the phone number. That seems like a pretty close system to how Signal works and I don’t see anything meaningfully different. If you do, can you actually elaborate? I don’t feel like the link you pointed me answers why my proposal would be larping security since the security and threat model feels very similar to Signal. Here are some choice quotes I pulled out of that link and why I have problems with the claims made: > Searchable archives are too useful to sacrifice, but for secure messaging, archival is an unreasonable default. Secure messaging systems make arrangements for “disappearing messages”. Signal and most apps except Snapchat (which isn’t e2e afaik) don’t archive by default. But yes, it is true that having encrypted web mail and search are incompatible whereas messaging apps store the data locally and thus can provide search. You’d need a dedicated client that could store all the encrypted messages locally but people aren’t as used to for that. > Some email clients have obscure tools for automatically pruning archives, but there’s no way for me to reliably signal to a counterparty that the message I’m about to send should not be retained for more than 30 minutes. Talk about security LARPing. Once the message is sent you’ve lost all control of it. Your just following social contracts that the app honors the request and the user is using an unmodified app. > No matter how good a job one does securing their own data, their emails are always at the mercy of the least secure person they’ve sent them to. Also true for messaging apps

barfbagginus 3y ago

Signal and WhatsApp are no good against state actors And that is where they get their usability

tptacek 3y ago
In what way is Signal "no good against state actors"?
- mdhb 3y ago
  I could think of a few ranging from just asking Apple for a copy of your iCloud backups, asking you personally for a copy of the messages through to exploiting iOS itself.
  - akerl_ 3y ago
    Given that iCloud backups don't contain Signal messages, and "ask you for a copy" and "exploit the OS" affect any application... can you clarify?
    - mdhb 3y ago
      The context was what are things that those with more or less unlimited resources can do in order to read your signal messages. They are 3 particular paths that aren’t in any way open to most attackers but will work here. Saying it impacts all applications isn’t wrong but it’s also not relevant to what was asked. If whatever the hell you are doing requires a threat model where the NSA is interested in finding out who you are talking with and what you are saying the original comment of signal is inappropriate is 100% accurate.
      - tptacek 3y ago
        If your threat model involves NSA finding out who is talking to you, PGP literally doesn't help you at all: it doesn't protect metadata.

aborsy 3y ago

WhatsApp is a phone app for messaging. PGP is a protocol for email and file encryption in any operating system. It’s unclear why you are comparing them. PGP could have a phone app that will do easy encryption, such as protonmail.

LtWorf 3y ago

> it's amazing how easy end-to-end encryption on Signal and Whatsapp is Amazing that you consider a proprietary thing like whatsapp remotely secure. For all we know it's backdoored. And signal… not available on fdroid… thus mostly installed via apple/google… how difficult would it be to push a backdoored update to selected individuals? GPG is more secure

littlestymaar 3y ago

> it's amazing how easy end-to-end encryption on Signal and Whatsapp is They both use a centralized, authority for identification and key sharing, sidestepping the hardest part entirely. Also, they are their own protocol and as such you don't suffer the encrypted/plain-text-only email dichotomy, sidestepping another pain point. When you don't care about the decentralized nature of email and can force everything to be encrypted, then the problem becomes much easier.