4 ms·

Can we just write off this whole endeavour already? 20 years of complication, confusion and opportunity for catastrophe. You are far better off mailing somethi

Can we just write off this whole endeavour already? 20 years of complication, confusion and opportunity for catastrophe. You are far better off mailing something sensitive. Or if you must be digital, asking the recipients for a disposable age key or similar.

pastage 2y ago
When set up it works like a charm, I would say better than TLS. If you work at a place with a rigid IT department it sucks.
- anotherhue 2y ago
  Putting aside all the crypto complications, the number one thing a user needs to know is not to ever put something sensitive in the subject field. You know, that huge box that is literally the second field your email client presents to you. The dissonance is catastrophic. As far as I can tell the number one real world use case for PGP mail is computer people cosplaying as spooks. It is the user interface that is insecure, and there's no fixing that.
  - tptacek 2y ago
    I actually think the Subject header is only the third-worst thing about attempting to secure email; the first is that there's no mechanism in SMTP to force encryption (everybody who has ever done a long-term encrypted email system has seen this happen; in fact, if someone told me they hadn't seen an accidentally-unencrypted reply, it would be a "tell" to me that they'd never seriously used encrypted email), and my second concern would be that everyone's email applications include "search", implying archives of plaintext email. In fourth place: from a theory perspective, PGP's keying/identity system guarantees eventual compromise, which is why no modern messaging system works that way.
palata 2y ago
I know that it is fashionable to criticize PGP, but... - I feel knowledgeable enough to use PGP correctly w.r.t. my threat model. - Whenever someone claims that "every single use-case has a better alternative", I look at the alternative. Many (most of the?) times the alternative is just not mature enough. So my question is the following: if PGP is so complicated and confusing, and alternatives are so much better, why is it that so many people keep using PGP? Give me viable alternatives, and I will use them. But as long as PGP is the most convenient (yes, I mean convenient) I find, I will use PGP.
- anotherhue 2y ago
  We have more choices than store and forward now. Look at systems like Croc or magic wormhole to exchange files. Look at systems like the axolotl prekey ratchet if you definitely need async connectivity. The actual use cases for PGP are few and far between. Signing public releases, and attempting to send unsolicited secure mail to someone you don't know.
  - tptacek 2y ago
    Minisign and Sigstore are two purpose-build cryptosystems for proving the authenticity of public software releases.
    - palata 2y ago
      How much can I trust Minisign and Sigstore? I mean PGP is everywhere, everybody knows what it is and it has been maintained for decades. If I sign a file with Minisign, how likely is it that the person who will want to check the signature will know what Minisign is, will be on a system that has a trustworthy implementation of it, and how likely is it that this implementation will be maintained for at least some years? And does Minisign work with hardware keys? I looked at the Sigstore website, and to be very honest I don't really understand what it does. They seem to have a tool for signing containers (not my use-case) and other things I don't think I do. Do they have a tool to sign a file? Then should I use Minisign or Sigstore, or both? And expect other people to know both? What if they use 2 other systems they like, should I now use 4? With PGP this all seems pretty obvious, and PGP signatures don't seem to be bad, right?
      - palata 2y ago
        [flagged]
        tptacek 2y ago
        If you want to publish a PGP signature of your own random files, go ahead and do it; nobody is going to dunk on you for it. If you're managing a major platform, use something better than PGP, which wasn't designed for this problem. See Python's experience with PGP signatures --- and, especially, with reliably verifying them --- for reasons why. Also: if you're "genuinely" asking questions, you might want to be careful about back-loading them with assertions that suggest you already believe you know the answer, and aren't so much asking as hoping to bait something you can rebut.

pastage 2y ago

When set up it works like a charm, I would say better than TLS. If you work at a place with a rigid IT department it sucks.

anotherhue 2y ago
Putting aside all the crypto complications, the number one thing a user needs to know is not to ever put something sensitive in the subject field. You know, that huge box that is literally the second field your email client presents to you. The dissonance is catastrophic. As far as I can tell the number one real world use case for PGP mail is computer people cosplaying as spooks. It is the user interface that is insecure, and there's no fixing that.
- tptacek 2y ago
  I actually think the Subject header is only the third-worst thing about attempting to secure email; the first is that there's no mechanism in SMTP to force encryption (everybody who has ever done a long-term encrypted email system has seen this happen; in fact, if someone told me they hadn't seen an accidentally-unencrypted reply, it would be a "tell" to me that they'd never seriously used encrypted email), and my second concern would be that everyone's email applications include "search", implying archives of plaintext email. In fourth place: from a theory perspective, PGP's keying/identity system guarantees eventual compromise, which is why no modern messaging system works that way.

palata 2y ago

I know that it is fashionable to criticize PGP, but... - I feel knowledgeable enough to use PGP correctly w.r.t. my threat model. - Whenever someone claims that "every single use-case has a better alternative", I look at the alternative. Many (most of the?) times the alternative is just not mature enough. So my question is the following: if PGP is so complicated and confusing, and alternatives are so much better, why is it that so many people keep using PGP? Give me viable alternatives, and I will use them. But as long as PGP is the most convenient (yes, I mean convenient) I find, I will use PGP.

anotherhue 2y ago
We have more choices than store and forward now. Look at systems like Croc or magic wormhole to exchange files. Look at systems like the axolotl prekey ratchet if you definitely need async connectivity. The actual use cases for PGP are few and far between. Signing public releases, and attempting to send unsolicited secure mail to someone you don't know.
- tptacek 2y ago
  Minisign and Sigstore are two purpose-build cryptosystems for proving the authenticity of public software releases.
  - palata 2y ago
    How much can I trust Minisign and Sigstore? I mean PGP is everywhere, everybody knows what it is and it has been maintained for decades. If I sign a file with Minisign, how likely is it that the person who will want to check the signature will know what Minisign is, will be on a system that has a trustworthy implementation of it, and how likely is it that this implementation will be maintained for at least some years? And does Minisign work with hardware keys? I looked at the Sigstore website, and to be very honest I don't really understand what it does. They seem to have a tool for signing containers (not my use-case) and other things I don't think I do. Do they have a tool to sign a file? Then should I use Minisign or Sigstore, or both? And expect other people to know both? What if they use 2 other systems they like, should I now use 4? With PGP this all seems pretty obvious, and PGP signatures don't seem to be bad, right?
    - palata 2y ago
      [flagged]
      - tptacek 2y ago
        If you want to publish a PGP signature of your own random files, go ahead and do it; nobody is going to dunk on you for it. If you're managing a major platform, use something better than PGP, which wasn't designed for this problem. See Python's experience with PGP signatures --- and, especially, with reliably verifying them --- for reasons why. Also: if you're "genuinely" asking questions, you might want to be careful about back-loading them with assertions that suggest you already believe you know the answer, and aren't so much asking as hoping to bait something you can rebut.