6 ms·

Operational PGP (2015)

43 points by gone35 2y ago

jmclnx 2y ago
To bad Thunderbird went with their own setup instead of gnupg :(
anotherhue 2y ago
Can we just write off this whole endeavour already? 20 years of complication, confusion and opportunity for catastrophe. You are far better off mailing something sensitive. Or if you must be digital, asking the recipients for a disposable age key or similar.
- pastage 2y ago
  When set up it works like a charm, I would say better than TLS. If you work at a place with a rigid IT department it sucks.
  - anotherhue 2y ago
    Putting aside all the crypto complications, the number one thing a user needs to know is not to ever put something sensitive in the subject field. You know, that huge box that is literally the second field your email client presents to you. The dissonance is catastrophic. As far as I can tell the number one real world use case for PGP mail is computer people cosplaying as spooks. It is the user interface that is insecure, and there's no fixing that.
    - tptacek 2y ago
      I actually think the Subject header is only the third-worst thing about attempting to secure email; the first is that there's no mechanism in SMTP to force encryption (everybody who has ever done a long-term encrypted email system has seen this happen; in fact, if someone told me they hadn't seen an accidentally-unencrypted reply, it would be a "tell" to me that they'd never seriously used encrypted email), and my second concern would be that everyone's email applications include "search", implying archives of plaintext email. In fourth place: from a theory perspective, PGP's keying/identity system guarantees eventual compromise, which is why no modern messaging system works that way.
- palata 2y ago
  I know that it is fashionable to criticize PGP, but... - I feel knowledgeable enough to use PGP correctly w.r.t. my threat model. - Whenever someone claims that "every single use-case has a better alternative", I look at the alternative. Many (most of the?) times the alternative is just not mature enough. So my question is the following: if PGP is so complicated and confusing, and alternatives are so much better, why is it that so many people keep using PGP? Give me viable alternatives, and I will use them. But as long as PGP is the most convenient (yes, I mean convenient) I find, I will use PGP.
  - anotherhue 2y ago
    We have more choices than store and forward now. Look at systems like Croc or magic wormhole to exchange files. Look at systems like the axolotl prekey ratchet if you definitely need async connectivity. The actual use cases for PGP are few and far between. Signing public releases, and attempting to send unsolicited secure mail to someone you don't know.
    - tptacek 2y ago
      Minisign and Sigstore are two purpose-build cryptosystems for proving the authenticity of public software releases.
      - palata 2y ago
        How much can I trust Minisign and Sigstore? I mean PGP is everywhere, everybody knows what it is and it has been maintained for decades. If I sign a file with Minisign, how likely is it that the person who will want to check the signature will know what Minisign is, will be on a system that has a trustworthy implementation of it, and how likely is it that this implementation will be maintained for at least some years? And does Minisign work with hardware keys? I looked at the Sigstore website, and to be very honest I don't really understand what it does. They seem to have a tool for signing containers (not my use-case) and other things I don't think I do. Do they have a tool to sign a file? Then should I use Minisign or Sigstore, or both? And expect other people to know both? What if they use 2 other systems they like, should I now use 4? With PGP this all seems pretty obvious, and PGP signatures don't seem to be bad, right?
tptacek 2y ago
I don't think you could make a better case for not attempting to securely email people than this document --- it's good! It's very well done.
frizlab 2y ago
I’m so sad there aren’t free certificates for emails address anymore. S/MIME is so easy to use and makes so much sense…
- tptacek 2y ago
  It makes sense if end-to-end security isn't a requirement; otherwise: it chains up to certificate authorities. From a security engineering perspective, CAs are what you use when you have constant introductions between mutually untrusted parties. That's not how email conversations work!
  - dogma1138 2y ago
    S/MIME is still end to end encrypted. The fact that it relies on certificates means that it doesn’t protects against spoofing and one can argue that the certificate chain makes spoofing “easier” by creating an implicit chain of trust. However pretty much every E2EE protocol doesn’t addresses spoofing without a side channel exchange of some sort which would allow you to pin the key of the party you wish to communicate with.
- frizlab 2y ago
  Maybe there is actually; I’ll try that. https://github.com/polhenarejos/acme_email https://github.com/polhenarejos/acme_email EDIT: Mostly useless; have to trust a root CA (CASTLE).
  - frizlab 2y ago
    Actalis does do free S/MIME certificates for private use, but they do not allow using your own CSR. They generate the private key for you and allow you to download it, but the key stays on the server forever AFAICT.
teddyh 2y ago
My understanding is that p≡p <https://pep.software/about/ https://pep.software/about/> was designed to automate all the modern best practices of using e-mail with PGP.
deleted 2y ago
[deleted]
deleted 2y ago
[deleted]

43 points by gone35 2y ago

To bad Thunderbird went with their own setup instead of gnupg :(

Can we just write off this whole endeavour already? 20 years of complication, confusion and opportunity for catastrophe. You are far better off mailing something sensitive. Or if you must be digital, asking the recipients for a disposable age key or similar.

pastage 2y ago
When set up it works like a charm, I would say better than TLS. If you work at a place with a rigid IT department it sucks.
- anotherhue 2y ago
  Putting aside all the crypto complications, the number one thing a user needs to know is not to ever put something sensitive in the subject field. You know, that huge box that is literally the second field your email client presents to you. The dissonance is catastrophic. As far as I can tell the number one real world use case for PGP mail is computer people cosplaying as spooks. It is the user interface that is insecure, and there's no fixing that.
  - tptacek 2y ago
    I actually think the Subject header is only the third-worst thing about attempting to secure email; the first is that there's no mechanism in SMTP to force encryption (everybody who has ever done a long-term encrypted email system has seen this happen; in fact, if someone told me they hadn't seen an accidentally-unencrypted reply, it would be a "tell" to me that they'd never seriously used encrypted email), and my second concern would be that everyone's email applications include "search", implying archives of plaintext email. In fourth place: from a theory perspective, PGP's keying/identity system guarantees eventual compromise, which is why no modern messaging system works that way.
palata 2y ago
I know that it is fashionable to criticize PGP, but... - I feel knowledgeable enough to use PGP correctly w.r.t. my threat model. - Whenever someone claims that "every single use-case has a better alternative", I look at the alternative. Many (most of the?) times the alternative is just not mature enough. So my question is the following: if PGP is so complicated and confusing, and alternatives are so much better, why is it that so many people keep using PGP? Give me viable alternatives, and I will use them. But as long as PGP is the most convenient (yes, I mean convenient) I find, I will use PGP.
- anotherhue 2y ago
  We have more choices than store and forward now. Look at systems like Croc or magic wormhole to exchange files. Look at systems like the axolotl prekey ratchet if you definitely need async connectivity. The actual use cases for PGP are few and far between. Signing public releases, and attempting to send unsolicited secure mail to someone you don't know.
  - tptacek 2y ago
    Minisign and Sigstore are two purpose-build cryptosystems for proving the authenticity of public software releases.
    - palata 2y ago
      How much can I trust Minisign and Sigstore? I mean PGP is everywhere, everybody knows what it is and it has been maintained for decades. If I sign a file with Minisign, how likely is it that the person who will want to check the signature will know what Minisign is, will be on a system that has a trustworthy implementation of it, and how likely is it that this implementation will be maintained for at least some years? And does Minisign work with hardware keys? I looked at the Sigstore website, and to be very honest I don't really understand what it does. They seem to have a tool for signing containers (not my use-case) and other things I don't think I do. Do they have a tool to sign a file? Then should I use Minisign or Sigstore, or both? And expect other people to know both? What if they use 2 other systems they like, should I now use 4? With PGP this all seems pretty obvious, and PGP signatures don't seem to be bad, right?

tptacek 2y ago

I don't think you could make a better case for not attempting to securely email people than this document --- it's good! It's very well done.

frizlab 2y ago

I’m so sad there aren’t free certificates for emails address anymore. S/MIME is so easy to use and makes so much sense…

tptacek 2y ago
It makes sense if end-to-end security isn't a requirement; otherwise: it chains up to certificate authorities. From a security engineering perspective, CAs are what you use when you have constant introductions between mutually untrusted parties. That's not how email conversations work!
- dogma1138 2y ago
  S/MIME is still end to end encrypted. The fact that it relies on certificates means that it doesn’t protects against spoofing and one can argue that the certificate chain makes spoofing “easier” by creating an implicit chain of trust. However pretty much every E2EE protocol doesn’t addresses spoofing without a side channel exchange of some sort which would allow you to pin the key of the party you wish to communicate with.
frizlab 2y ago
Maybe there is actually; I’ll try that. https://github.com/polhenarejos/acme_email https://github.com/polhenarejos/acme_email EDIT: Mostly useless; have to trust a root CA (CASTLE).
- frizlab 2y ago
  Actalis does do free S/MIME certificates for private use, but they do not allow using your own CSR. They generate the private key for you and allow you to download it, but the key stays on the server forever AFAICT.

teddyh 2y ago

My understanding is that p≡p <https://pep.software/about/ https://pep.software/about/> was designed to automate all the modern best practices of using e-mail with PGP.

deleted 2y ago

[deleted]

deleted 2y ago

[deleted]