6 ms·

use S/MIME, leave gpg for special cases. S/MIME works everywhere (Outlook, Mail.app, iOS, Thunderbird, BlackBerry, Windows Phone, Lotus, ... ) out of the box.

by rmoriz 13y ago

use S/MIME, leave gpg for special cases. S/MIME works everywhere (Outlook, Mail.app, iOS, Thunderbird, BlackBerry, Windows Phone, Lotus, ... ) out of the box. No plugins required.

Osmium 13y ago
I hear this, but I have absolutely zero idea how to get s/mime working and I'm faintly aware it might involve having to buy a digital certificate off someone (and doesn't that mean that someone could decrypt my email anyway? if they're the ones who generate the certificate?) What I'm trying to say here is: I'm a bit of a geek, and if I don't understand how it works, there's no way e.g. my parents are. If s/mime is the solution, there's a serious education battle that needs to be fought. I say this as someone who uses GPG (via GPG Tools on OS X) without any bother.
- scoot 13y ago
  No, you generate your own, then have the public key signed by a CA having proven your identity to some greater or lesser degree, depending on the level of certification - but generating your own and having it signed is not a straightforward process in my (limited) experience.
  - ncraike 13y ago
    The problem with that method is the recipient of your mail is still relying on that CA to validate your public key. The CA could (willingly or under duress) sign some other public key and claim it's yours, then use that key to impersonate you, and even trick recipients into using that public key to encrypt emails intended for you. That would form the basis of a man-in-the-middle attack. It's unlikely to work if you've already been communicating using the real public key (depending on how the software handles new keys), but for new recipients in particular, it's possible.
    - rmoriz 13y ago
      that's possible with PGP, too, if you don't verificate key in person. E.g. "hey Alice, I lost my passphrase, please use the attached key or ID xxxx on one of the keyservers" It's even easier to do, because you don't have to trick a CA in creating a duplicate key.
      - ncraike 13y ago
        > It's even easier to do, because you don't have to trick a CA in creating a duplicate key. In some ways it's easier with PGP, yes. But in some ways relying on a possibly-hostile CA is worse: if the software doesn't really give the user any visibility of key changes, then the impersonator won't even need to social-engineer the recipient with "whoops I lost my key". Instead, the duped recipient will just see "Signed by Big Trusted CA" with a shiny green padlock, and will think everything is fine, even though the key under the hood has changed.
    - deleted 13y ago
      [deleted]
jarrett 13y ago
Do you mean we should build a good UX around S/MIME? It seems clear to me that none currently exists. I'd be curious to hear from security specialists about S/MIME. How thoroughly studied is it? How are the libraries? I have hardly ever heard it discussed, so I'm a little hesitant at the moment.
- rmoriz 13y ago
  It's already build in e.g. Mail.app. We need no software. We need public awareness, tutorials and probably some easy to use CA. I bet the adoption rate of S/MIME is way beyond gpg if you check corporations and large enterprises. for example: Germany https://gist.github.com/rmoriz/5945400 https://gist.github.com/rmoriz/5945400
  - jarrett 13y ago
    I've thought some more about S/MIME, and right now my biggest concern is the CAs. I don't like having that central point of trust/failure. Do you know if S/MIME can work on a distributed model? Also, what are the advantages of S/MIME over PGP? I hear what you're saying about enterprise adoption, but I'm more concerned with the thoroughness of peer review than usage rates.
    - rmoriz 13y ago
      CAs are not a single point of failure because your private key should never leave your computer. S/MIME is based on X.509, same thing that powers TLS/SSL.
      - tptacek 13y ago
        CAs are a single point of failure if a government can get a key that your counterpart's UI will claim belongs to you.
        23david 13y ago
        Not necessarily true. There are certainly CAs that are able to keep their private keys out of the hands of most governments. But there is definite uncertainty about who to trust. For the truly cautious, wouldn't it make sense to explore setting up your own CA? Something like OpenCA or TinyCA should do the trick.
unhammer 13y ago
S/MIME suffers from the same problem as SSL/TLS: everyone puts their trust in CA's, and CA's regularly get hacked, tricked, controlled by governments, etc. etc. It does not matter that you created your own private key if someone else can create their own private key too and have that signed by a bad (but trusted-by-everyone) CA. How many regular users do you know who actually edit their list of trusted CA's in their browsers? (I sure don't, though I probably should.) Who would manually remove DigiNotar immediately because they heard on the news they got hacked? No, Big Well-Designed Site is signed by Big Company, user trusts it. On the other hand, if I give you a key that's signed by someone you trust, you can make an informed decision on whether to trust my key. It is a decision on a level where the regular user might feel they have something to say (whereas a regular user is not likely to feel they know more about security than Big Company). Perhaps most users would have very few keys that they trust/verify. But I'd say that's a good thing, because if you haven't gotten real verification, it's just a false sense of security.

by rmoriz 13y ago

use S/MIME, leave gpg for special cases. S/MIME works everywhere (Outlook, Mail.app, iOS, Thunderbird, BlackBerry, Windows Phone, Lotus, ... ) out of the box. No plugins required.

Osmium 13y ago

I hear this, but I have absolutely zero idea how to get s/mime working and I'm faintly aware it might involve having to buy a digital certificate off someone (and doesn't that mean that someone could decrypt my email anyway? if they're the ones who generate the certificate?) What I'm trying to say here is: I'm a bit of a geek, and if I don't understand how it works, there's no way e.g. my parents are. If s/mime is the solution, there's a serious education battle that needs to be fought. I say this as someone who uses GPG (via GPG Tools on OS X) without any bother.

scoot 13y ago
No, you generate your own, then have the public key signed by a CA having proven your identity to some greater or lesser degree, depending on the level of certification - but generating your own and having it signed is not a straightforward process in my (limited) experience.
- ncraike 13y ago
  The problem with that method is the recipient of your mail is still relying on that CA to validate your public key. The CA could (willingly or under duress) sign some other public key and claim it's yours, then use that key to impersonate you, and even trick recipients into using that public key to encrypt emails intended for you. That would form the basis of a man-in-the-middle attack. It's unlikely to work if you've already been communicating using the real public key (depending on how the software handles new keys), but for new recipients in particular, it's possible.
  - rmoriz 13y ago
    that's possible with PGP, too, if you don't verificate key in person. E.g. "hey Alice, I lost my passphrase, please use the attached key or ID xxxx on one of the keyservers" It's even easier to do, because you don't have to trick a CA in creating a duplicate key.
    - ncraike 13y ago
      > It's even easier to do, because you don't have to trick a CA in creating a duplicate key. In some ways it's easier with PGP, yes. But in some ways relying on a possibly-hostile CA is worse: if the software doesn't really give the user any visibility of key changes, then the impersonator won't even need to social-engineer the recipient with "whoops I lost my key". Instead, the duped recipient will just see "Signed by Big Trusted CA" with a shiny green padlock, and will think everything is fine, even though the key under the hood has changed.
  - deleted 13y ago
    [deleted]

jarrett 13y ago

Do you mean we should build a good UX around S/MIME? It seems clear to me that none currently exists. I'd be curious to hear from security specialists about S/MIME. How thoroughly studied is it? How are the libraries? I have hardly ever heard it discussed, so I'm a little hesitant at the moment.

rmoriz 13y ago
It's already build in e.g. Mail.app. We need no software. We need public awareness, tutorials and probably some easy to use CA. I bet the adoption rate of S/MIME is way beyond gpg if you check corporations and large enterprises. for example: Germany https://gist.github.com/rmoriz/5945400 https://gist.github.com/rmoriz/5945400
- jarrett 13y ago
  I've thought some more about S/MIME, and right now my biggest concern is the CAs. I don't like having that central point of trust/failure. Do you know if S/MIME can work on a distributed model? Also, what are the advantages of S/MIME over PGP? I hear what you're saying about enterprise adoption, but I'm more concerned with the thoroughness of peer review than usage rates.
  - rmoriz 13y ago
    CAs are not a single point of failure because your private key should never leave your computer. S/MIME is based on X.509, same thing that powers TLS/SSL.
    - tptacek 13y ago
      CAs are a single point of failure if a government can get a key that your counterpart's UI will claim belongs to you.
      - 23david 13y ago
        Not necessarily true. There are certainly CAs that are able to keep their private keys out of the hands of most governments. But there is definite uncertainty about who to trust. For the truly cautious, wouldn't it make sense to explore setting up your own CA? Something like OpenCA or TinyCA should do the trick.

unhammer 13y ago

S/MIME suffers from the same problem as SSL/TLS: everyone puts their trust in CA's, and CA's regularly get hacked, tricked, controlled by governments, etc. etc. It does not matter that you created your own private key if someone else can create their own private key too and have that signed by a bad (but trusted-by-everyone) CA. How many regular users do you know who actually edit their list of trusted CA's in their browsers? (I sure don't, though I probably should.) Who would manually remove DigiNotar immediately because they heard on the news they got hacked? No, Big Well-Designed Site is signed by Big Company, user trusts it. On the other hand, if I give you a key that's signed by someone you trust, you can make an informed decision on whether to trust my key. It is a decision on a level where the regular user might feel they have something to say (whereas a regular user is not likely to feel they know more about security than Big Company). Perhaps most users would have very few keys that they trust/verify. But I'd say that's a good thing, because if you haven't gotten real verification, it's just a false sense of security.