5 ms·

So if I understand correctly: - Proton uses WKD for keys outside its own domain - OP didn't activate WKD for their own key (there is no CNAME) - But Proton s

by rakoo 3y ago

So if I understand correctly: - Proton uses WKD for keys outside its own domain - OP didn't activate WKD for their own key (there is no CNAME) - But Proton still assumed that it was activated, that their key was on keys.openpgp.org and that it was valid It is hard for me to see how this is not a fault with Proton and Proton only. If the user didn't opt-in, don't opt-in for them !

Avamander 3y ago
Don't upload your key to a public keyserver with an email address you have to verify you don't want to receive encrypted things with. That is the opt-in! Usually the problem is the exact opposite, it's really annoying to find someone's public key even if they have given you the key ID or mentioned they can receive such mail.
- rakoo 3y ago
  That a key exist on a random keyserver means nothing. There is a spec that explicitely says "if you want to use my key here it is" and Proton doesn't respect it. what does it mean that you found the key on some third-party domain ? There are 0 safeguards, I don't know what they're going to do with it, there is no obligation from any side. A key in keys.openpgp.org means nothing.
  - Avamander 3y ago
    It means someone uploaded it there and verified the address in the identity (or subidentity). A keyserver is exactly for "here's my key, use it". Don't publish your keys if you don't want them used. It's not that difficult.
ziddoap 3y ago
>It is hard for me to see how this is not a fault with Proton and Proton only. If the user didn't opt-in, don't opt-in for them ! The counter argument is that they opted-in by publishing an encryption key to a public key server.
- rakoo 3y ago
  No, the opt-in is by actually following the spec, not uploading to a random server op has 0 control over.
  - ziddoap 3y ago
    >not uploading to a random server op has 0 control over. OP has full control over uploading their key, activating their key, and deactivating their key on the "random server". By the way, the "random server" is.... The OpenPGP server.
    - rakoo 3y ago
      Yes, but that's not a protocol. That's uploading a key to a server. The protocol is WKD and Proton doesn't respect it. Me opening an account on GMail doesn't mean I want people to contact me on GMail. If our protocol, ie you asking me what is my email and I don't give you my email then I don't want you to contact via my GMail account.
      - deleted 3y ago
        [deleted]
twiss 3y ago
No, Proton didn't assume WKD was activated, and WKD doesn't have much to do with what's going on. What happened is: - The user, or their software, uploaded a public key to keys.openpgp.org - Proton looked up their email address on keys.openpgp.org, and sent them an encrypted email - They didn't have the private key anymore, and couldn't read the email The fix is to remove the key from keys.openpgp.org, or remove the email address from the key, or remove the encryption subkey. Alternatively, setting up WKD would actually work as well, since then Proton uses that instead. I.e. if there's no key on WKD, we don't send encrypted emails.
- rakoo 3y ago
  Why does proton look up keys.openpgp.org? Is keys.openpgp.org assumed to be The One Directory for everyone ? Who said so ? There is no reason to consider it as the centre of the world if you deon't use it. That's exactly what wkd is about: specifically saying that there is a key to talk to you, and where it is. If I publish a key in my Myspace profile that doesn't mean it's valid. The author never signalled any key to be usable, the key being on that specific directory means nothing. It's not the first time you take liberties with protocols and specs under the premise of "simplification", and again ano again things break because you don't respect anything. How can you be taken as a peer of value if you keep screwing up and accusing users for not holding it right ?
  - twiss 3y ago
    keys.openpgp.org is the semi-canonical key server for OpenPGP. Certainly there are other key servers, but it makes more sense for us to look up keys on a keyserver hosted under openpgp.org than one hosted by Ubuntu or any other single entity. KOO is a community-led and -governed project. It now even has elections and a board (which we joined): https://keys.openpgp.org/about/news#2023-04-28-governance https://keys.openpgp.org/about/news#2023-04-28-governance WKD is great, but can't be used by people with email addresses under domains that don't support it. So KOO fills that gap.
    - rakoo 3y ago
      Yes, KOO is a good intermediary, but it still matters: there are no agreed-upon mechanism saying it should be used in all cases. You took this liberty. Why not even ask the receivers, aka those who know, if they're ok using that key ?

by rakoo 3y ago

Avamander 3y ago

Don't upload your key to a public keyserver with an email address you have to verify you don't want to receive encrypted things with. That is the opt-in! Usually the problem is the exact opposite, it's really annoying to find someone's public key even if they have given you the key ID or mentioned they can receive such mail.

rakoo 3y ago
That a key exist on a random keyserver means nothing. There is a spec that explicitely says "if you want to use my key here it is" and Proton doesn't respect it. what does it mean that you found the key on some third-party domain ? There are 0 safeguards, I don't know what they're going to do with it, there is no obligation from any side. A key in keys.openpgp.org means nothing.
- Avamander 3y ago
  It means someone uploaded it there and verified the address in the identity (or subidentity). A keyserver is exactly for "here's my key, use it". Don't publish your keys if you don't want them used. It's not that difficult.

ziddoap 3y ago

>It is hard for me to see how this is not a fault with Proton and Proton only. If the user didn't opt-in, don't opt-in for them ! The counter argument is that they opted-in by publishing an encryption key to a public key server.

rakoo 3y ago
No, the opt-in is by actually following the spec, not uploading to a random server op has 0 control over.
- ziddoap 3y ago
  >not uploading to a random server op has 0 control over. OP has full control over uploading their key, activating their key, and deactivating their key on the "random server". By the way, the "random server" is.... The OpenPGP server.
  - rakoo 3y ago
    Yes, but that's not a protocol. That's uploading a key to a server. The protocol is WKD and Proton doesn't respect it. Me opening an account on GMail doesn't mean I want people to contact me on GMail. If our protocol, ie you asking me what is my email and I don't give you my email then I don't want you to contact via my GMail account.
    - deleted 3y ago
      [deleted]

twiss 3y ago

No, Proton didn't assume WKD was activated, and WKD doesn't have much to do with what's going on. What happened is: - The user, or their software, uploaded a public key to keys.openpgp.org - Proton looked up their email address on keys.openpgp.org, and sent them an encrypted email - They didn't have the private key anymore, and couldn't read the email The fix is to remove the key from keys.openpgp.org, or remove the email address from the key, or remove the encryption subkey. Alternatively, setting up WKD would actually work as well, since then Proton uses that instead. I.e. if there's no key on WKD, we don't send encrypted emails.

rakoo 3y ago
Why does proton look up keys.openpgp.org? Is keys.openpgp.org assumed to be The One Directory for everyone ? Who said so ? There is no reason to consider it as the centre of the world if you deon't use it. That's exactly what wkd is about: specifically saying that there is a key to talk to you, and where it is. If I publish a key in my Myspace profile that doesn't mean it's valid. The author never signalled any key to be usable, the key being on that specific directory means nothing. It's not the first time you take liberties with protocols and specs under the premise of "simplification", and again ano again things break because you don't respect anything. How can you be taken as a peer of value if you keep screwing up and accusing users for not holding it right ?
- twiss 3y ago
  keys.openpgp.org is the semi-canonical key server for OpenPGP. Certainly there are other key servers, but it makes more sense for us to look up keys on a keyserver hosted under openpgp.org than one hosted by Ubuntu or any other single entity. KOO is a community-led and -governed project. It now even has elections and a board (which we joined): https://keys.openpgp.org/about/news#2023-04-28-governance https://keys.openpgp.org/about/news#2023-04-28-governance WKD is great, but can't be used by people with email addresses under domains that don't support it. So KOO fills that gap.
  - rakoo 3y ago
    Yes, KOO is a good intermediary, but it still matters: there are no agreed-upon mechanism saying it should be used in all cases. You took this liberty. Why not even ask the receivers, aka those who know, if they're ok using that key ?