2 ms·

If I as a security researcher want to send a super sensitive disclosure to an organization like "I have reason to believe your devices are compromised", I want

by lrvick 1y ago

If I as a security researcher want to send a super sensitive disclosure to an organization like "I have reason to believe your devices are compromised", I want to be damn sure it goes to a PGP key held on smartcards that decrypt reports on airgapped operating systems. I also may want to do this anonymously. Signal is the wrong tool on both counts. Fine to have as an option but I would never have that as the only option.

tptacek 1y ago
That is very silly. I founded and ran what was at the time the 2nd or 3rd largest software security consultancies in North America, then acquired and rolled up into what was the largest software security consultancy in North America (NCC Group US), our client list was a phone book of every major tech firm and every major manufacturer and infrastructure company with a significant code footprint, our firm at its peak was generating many game-over findings per day across a wide range of companies, and most of our clients would have gotten angry at us if we told them to install PGP. More of them required password-protected ZIPs than PGP, so much so that we had a whole complicated document to ensure we were using the versions of ZIP file programs that used AES and not Bass-o-matic. Apple and Google routinely get findings worth 6-7 figures that aren't PGP encrypted. PGP-encrypting bug bounty submitters are mostly LARPing. I will take the Pepsi Challenge with you on experience with bounty programs if you'd like. But here's another question: have you ever been on a major-vendor embargo list before? Was it your experience that those embargo lists were uniformly PGP-encrypted? (I can spoil this one for you if you like). Tell me more about how major vulnerability disclosures depend on PGP, please.
- lrvick 1y ago
  > That is very silly. I founded and ran what was at the time... This just seems to be an appeal to authority. I will just say your credentials do not impress me. Lets just stick to two security engineers on different sides of the same industry having a technical merits discussion. In any event I did not once claim PGP encrypted reports are common, but I can say of the dozens I have received, most were very high quality from actual security researchers, and some have made me very happy I insisted such reports be decrypted offline on a machine I absolutely trust. It is good to give people options, and especially at least one that can be used anonymously with a fully open source operating system using a decentralized very widely used and established standard. I for one have made more than a few very sensitive security reports and do not own a Google or Apple controlled device or a Signal account.
  - tptacek 1y ago
    I don't care if my credentials impress you. That wasn't my point. You just conceded the point I was actually making.

by lrvick 1y ago

tptacek 1y ago

That is very silly. I founded and ran what was at the time the 2nd or 3rd largest software security consultancies in North America, then acquired and rolled up into what was the largest software security consultancy in North America (NCC Group US), our client list was a phone book of every major tech firm and every major manufacturer and infrastructure company with a significant code footprint, our firm at its peak was generating many game-over findings per day across a wide range of companies, and most of our clients would have gotten angry at us if we told them to install PGP. More of them required password-protected ZIPs than PGP, so much so that we had a whole complicated document to ensure we were using the versions of ZIP file programs that used AES and not Bass-o-matic. Apple and Google routinely get findings worth 6-7 figures that aren't PGP encrypted. PGP-encrypting bug bounty submitters are mostly LARPing. I will take the Pepsi Challenge with you on experience with bounty programs if you'd like. But here's another question: have you ever been on a major-vendor embargo list before? Was it your experience that those embargo lists were uniformly PGP-encrypted? (I can spoil this one for you if you like). Tell me more about how major vulnerability disclosures depend on PGP, please.

lrvick 1y ago
> That is very silly. I founded and ran what was at the time... This just seems to be an appeal to authority. I will just say your credentials do not impress me. Lets just stick to two security engineers on different sides of the same industry having a technical merits discussion. In any event I did not once claim PGP encrypted reports are common, but I can say of the dozens I have received, most were very high quality from actual security researchers, and some have made me very happy I insisted such reports be decrypted offline on a machine I absolutely trust. It is good to give people options, and especially at least one that can be used anonymously with a fully open source operating system using a decentralized very widely used and established standard. I for one have made more than a few very sensitive security reports and do not own a Google or Apple controlled device or a Signal account.
- tptacek 1y ago
  I don't care if my credentials impress you. That wasn't my point. You just conceded the point I was actually making.