23 ms·

A lot of the comments I've been getting are in the genre of "well... but GPG works." Yes, GPG is a powerful tool that makes some encrypted communication possib

by moxie 12y ago

A lot of the comments I've been getting are in the genre of "well... but GPG works." Yes, GPG is a powerful tool that makes some encrypted communication possible. But is it really "working" if it's the tool we've had for the past 20 years, and we still ended up in a world where surveillance is so ubiquitous and privacy is so rare? Having used GPG, it seems more likely to me that there are only ~50k GPG users in the world because of the product, not because of weak desire or need for private communication. I'm not suggesting that there's anything "better," but that it's really sad there isn't. GPG isn't ever going to be anything other than what it is now, and I don't think that's the future we want for ourselves. We could try to slap a GUI on top of it, but I don't believe great products are made that way. Good UX requires thinking about interactions all the way down to the protocol. The good news is that GPG has such a small legacy install base (literally on the order of ~50k users), that there's no reason to maintain compatibility with OpenPGP. When building new products, we can start fresh with modern cryptography, a modern protocol, and a modern design philosophy.

sillysaurus3 12y ago
You know you're one of only a few people in the world who is in a position to do that, right? Anyone else would (rightfully!) get torn to shreds on HN by tptacek or yourself. And I say "rightfully" because it is very likely that other people would screw up some central aspect to the security of any new product that claims security. It's not just that, though. Anyone else with your knowledge but no standing would be scorched for saying what you just said. "Throw away the one thing that has proven to be secure and write our own protocol" doesn't go hand in hand with "serious cryptographers trust what this person is saying." The truth is probably that either you do this or nobody will. You should. The world would be better for it.
- click170 12y ago
  Is there a kick starter page for this cause that I can contribute to? Because I would. I'm not going to back just any crypto project, but with the right people leading the charge I would get behind it.
  - grinich 12y ago
    https://whispersystems.org/blog/bithub/ https://whispersystems.org/blog/bithub/ (Unrelated to GPG, but this goes towards crypto projects by Moxie and other solid people.)
- desijays 12y ago
  Go through my comment history. How many comments do you see? A handful? Yup. The reason there are so few is because, I only reply to comments I wholeheartedly agree with. And this is one of them.
- yellowapple 12y ago
  > You know you're one of only a few people in the world who is in a position to do that, right? Anyone else would (rightfully!) get torn to shreds on HN by tptacek or yourself. And I say "rightfully" because it is very likely that other people would screw up some central aspect to the security of any new product that claims security. This attitude is why GnuPG (and other PGP implementations) are in a position to be criticized by the Moxies of the world. Is there some particular reason why anybody outside of some recognized elite should be discouraged from at least trying to create a better, improved system? Yeah, they'll probably fail in a lot of cases, but if the world really wants a modern, easy-to-use alternative to PGP (a real alternative, not use-case-specific alternatives like RedPhone and TextSecure; encrypted/signed email is still a valid use case that both those things blissfully ignore, by the way), this sort of attitude - that anyone outside of a select few rightfully deserves to be scolded for trying to make better crypto - is lethally toxic to that goal.
  - tptacek 12y ago
    Yes, there is a reason to discourage those people. In between the time that a cryptographically illiterate developer releases their MVP 1.0 version and the time that it's discovered that their cryptography is fundamentally flawed --- a window of time that can stretch on for years --- actual people will rely on the tool for their security, not realizing that serious adversaries are reading their messages. Most new cryptosystems --- a cryptosystem being "anything that uses a cipher, including when the cipher is simply AES --- are terribly broken. Search for [decryptocat] for an extremely good example of what I'm talking about. Developers who are new to cryptography that want to learn more about it and eventually use it in their own systems should start by learning how to exploit broken cryptography. If you can't exploit an RSA padding oracle, you shouldn't be designing systems that use public key cryptography. If you can't exploit a CTR nonce stutter, you shouldn't be using block crypto. Developers who don't want to learn cryptography should work on improving the UX (UI and workflow) of existing cryptosystems. PGP could sure use some help, but even if you don't want to help with PGP, there's a huge green field of work to be done on browser TLS trust and CA user interface. Just as one example.
    - 12y ago
the_af 12y ago
Hey Moxie, it intrigues me that the first thing you mention in your post isn't technical or even about UX (which is what most people in this thread are focusing on). Instead, it's that you're starting to dislike reading emails from the kind of person who would "voluntarily use GPG". I know you said there's no unifying theme to these emails, but can you elaborate? Maybe something about security-obssessed lay people using GPG to send the most trivial of emails? Or something else entirely?
- fensipens 12y ago
  To quote another commenter: "Way to take a dump on people who make an effort."
- napoleond 12y ago
  It's the same as people who voluntarily use Windows. It says something about them, that's all.
  - nothrabannosir 12y ago
    I can guess why you're being downvoted, but your comment is ironically correct. It /does/ say something about them! But what that is depends on who you ask. And that, again, says something about /them/. Which says something about the downvoters. Irony everywhere.
    - napoleond 12y ago
      People are getting offended, but I could have replaced Windows with almost anything. Our choices say things about us. Getting back to the subject at hand, though, I assume 'moxie meant that people who choose to use GPG for casual conversation must be slightly masochistic and therefore slightly less likely to have something interesting to say. ... just like Windows users ;)
      - dasil003 12y ago
        Yes, of course, but I'm very curious about moxie's interpretation of what using GPG says about the people who randomly email him; certainly more curious than constructing my own stereotype.
sarciszewski 12y ago
> When building new products, we can start fresh with modern cryptography, a modern protocol, and a modern design philosophy. Agreed 100%. I just don't have anything to offer in this space :(
derekja 12y ago
Please do this! I'd love to be able to use encrypted communications as a matter of course, but just not enough of the folks I work with are able to get it set up. My world is filled with smart people, but only a small fraction are purely computer folks and to try and get a biologist to understand why it's interesting to have all emails encrypted is a losing task unless it's super easy.
napoleond 12y ago
What do you think that looks like, though? Is it TextSecure on the desktop, with file attachments? Is it Pond? Is it just email, but with a different crypto layer? I feel like a lot of the things GPG aims to do are fundamentally hard. It's not the technology that sucks, it's the problem. I completely agree that the answer will come from thinking about user interactions first, but I'm not sure that the solution will look much different than a better GPG client.
- moxie 12y ago
  I don't have a definite answer. There's the path we're executing on at Open Whisper Systems, but there are a bunch of other projects working in this area as well (Mailpile, LEAP, etc). I think the problems are solvable, but only if we have a different design approach. So when I see projects trying not-PGP, I'm interested. When I see projects building on PGP, I'm less interested.
  - unicornporn 12y ago
    I'll take the opportunity to say that it saddens me that I still can not communicate using TextSecure with iOS users. It's been almost two years[1] since iOS support was "promised". TS is great, but we need to be able to communicate with iOS users. [1] https://whispersystems.org/blog/sure/ https://whispersystems.org/blog/sure/
    - Johnny_Brahms 12y ago
      Signal 2.0 was tagged on github 3 days ago and will bring the textsecure protocol to iOS whenever apple is done reviewing it.
      - unicornporn 12y ago
        If this is true, it's awesome. I've tried making contact between Signal on iOS with TextSecure on Android before, without luck.
    - patcon 12y ago
ryanmarsh 12y ago
Back in the 90's I tried to use GPG, and I tried to pay for digital music. They both went roughly the same way. Arguably it was easier to use GPG back then than it is now. Pine was my MUA and I had an easy to find public key. Now I have an iPhone, don't use Linux on my laptop anymore, and make heavy use of messaging products. Here's what I have now that I didn't have then, 2FA. There's an app on my phone that makes it super easy so I use it. If I had to still carry around a separate RSA code generator I probably wouldn't. Surely we can figure out a way to make encrypted email nearly transparently easy with the major mail providers, and the default mail apps on our laptops and and phones. Surely we can figure out a way to make a trustworthy distributed keystore. Perhaps this will all change because before Snowden we were blissfully unaware and GPG was a cool toy unless your life was in real danger, post Snowden we're residents of a vast internet police state and my Mom knows how Target was hacked. I have a strong suspicion we will figure this out, and soon. I wonder, are VC's are looking into funding easy to use consumer encryption?
- MichaelGG 12y ago
  >Perhaps this will all change because before Snowden we were blissfully unaware Every time I see this in regards to email, I'm puzzled. Carnivore was known about in the 90s. Then there was the AT&T Room 641A in the 200s. So I don't know how people were unaware that state level actors could tap connections and record email. Second, for this threat model, just forcing and validating TLS on SMTP gets you pretty far, does it not? You're then mostly trusting your email provider. And without trusting them, we get into user-unfriendly stuff like not being able to forget your password. (Barring some sort of breakthrough ideas.) Seriously, has there been any good proposals that provide strong privacy (say, no one but the user can read the message) but aren't complicated or require users to do things they aren't gonna do: validate keys? PGPFone and ZRTP are great because you already have an "out-of-band" key auth mechanism in place, and it's fairly straightforward to check.
  - ghshephard 12y ago
    Re: "You're then mostly trusting your email provider. And without trusting them, we get into user-unfriendly stuff like not being able to forget your password." Nobody should trust their email provider if they are concerned about the privacy of their email. The Job To Be Done, by an email provider such as gmail/yahoo/hotmail is to act as a mail store, and mta. A user should be able to rely on a local MUA for confidentiality. Admittedly, that shifts the level of trust from the Email Provider to the provider of the MUA software and the Local Hardware, which is why things like OpenBSD/Linux and (hopefully not firmware-tweaked) commodity hardware is so important.
rubyfan 12y ago
Don't you think the time is right to build such a system? Public awareness of privacy especially wrt mass government surveillance, identity theft and high profile corporate breaches seems that such an thing is ripe. I am naively optimistic given the right implementation a consortium of stakeholders could do something meaningful.
yellowapple 12y ago
Do you have any specific criticisms of GPG other than "it's old and it's not popular"? What's your ideal vision of what end-to-end encryption for the common (wo)man should look like other than "not GPG"? Two questions whose answers are nonexistent in your article.
- scintill76 12y ago
  Specific criticisms of GPG: > the working hypothesis for privacy enhancing technology was simple: we’d develop really flexible power tools for ourselves, and then teach everyone to be like us... Instead of developing opinionated software with a simple interface, GPG was written to be as powerful and flexible as possible. It’s up to the user whether the underlying cipher is SERPENT or IDEA or TwoFish I think it's self-explanatory why it's not good that users need to know about SERPENT, IDEA, and TwoFish. > the fundamental architecture of PGP also leaves no room for now critical concepts like forward secrecy. > a ballooning penumbra of OpenPGP specifications and notes so prolific that the entire picture is almost impossible to grasp... Mailpile had to write 1400 lines of python code just to interface with a native GnuPG installation for basic operations, and it still isn’t rock solid. > journalists who depend on it struggle with it and often mess up (“I send you the private key to communicate privately, right?”) UX failure leads to user uncertainty or insecure behavior. What a better replacement looks like (from the comment here): > Good UX requires thinking about interactions all the way down to the protocol. > we can start fresh with modern cryptography, a modern protocol, and a modern design philosophy
  - niels_olson 12y ago
    > UX failure leads to user uncertainty or insecure behavior. I'd say user uncertainty and insecure behavior are, each, sufficient criteria to declare a UX a failure.
  - lmm 12y ago
    You list plenty of specific problems with GPG the UI and GPG the "API" (though frankly the fact that mailpile would write 1400 lines of python that wrap GPG rather than taking one of the independent library implementations of RFC4880 and bringing it up to production quality makes them part of the problem). But none of those specific problems are problems with OpenPGP the protocol.
zobzu 12y ago
The issue is that it seems like you want to replace GnuPG by something that does the same - but is made better, and that has your brand name on it. That's very marketingish of you. Why not fix GnuPG instead? There's more than slapping GUIs to things! Also, where is your 50K user base number from? According to my SKS keyserver traffic, it's much greater, even if i were to assume 50% of the traffic is non-human.. what the fuck happened to you man? Also, if it's well done - I'm not against something different from GnuPG. I just disagree with the argument. Which leads to this question: which product are you going to announce in 6mo that would be so much better?
mirimir 12y ago
OK, GPG is crufty and hard to use, and the email protocol exposes metadata. So perhaps it is best to start fresh. What do you think of the Dark Mail effort? And of Pond?
jimktrains2 12y ago
One of the biggest problems with GPG is keyex. Sure, we have key servers, but that's not really a secure way of doing things. Secure communication is as much a cultural change as a technological one.
- whyever 12y ago
  GPG at least has the web of trust, with all its privacy problems. Most technologies just use "trust on first use".
  - jimktrains2 12y ago
    That doesn't actually solve the problem though. It helps in theory, but it requires the user to understand what they're doing to a level most won't. There is also the cultural issue of just exchanging fingerprints. Only techies put them on business cards, and even then only some. It needs to be common action.
    - whyever 12y ago
      Well, at least they try to solve it. Another approach for verification is employed by Threema [1]: The server verifies email addresses and phone numbers, so if the address or number is in your contacts you can have more confidence, represented by an orange dot next to the contact. If you verify the fingerprint by scanning QR codes, you get a green dot. About fingerprints for the masses: I really like the visual fingerprints Peerio is using (basically bigger Github-style generated avatar icons). [1] https://threema.ch/en/faq https://threema.ch/en/faq
ghshephard 12y ago
GPG is way, way, way to complex for all but the 0.01% of people who are GPG experts. It's too complex for me - and I've read (and enjoyed) Applied Cryptography. But, not having used it for a few years, I went to take a look again - list some keys, maybe SMS some friends to exchange fingerprints and sign their keys, etc... - I'm trying to recall what the relationship between PUB, SUB, UID, Key Fingerprints are. And how do I indicate that I trust a key and upload it back up to pgp.mit.edu? And I consider myself a member of the 0.1% who at least understand the principals behind PGP/Public Keys/Private Keys/Web of Trust, etc... So - if I'm having trouble understanding this without a couple hours of study, their is Zero chance that the other 99% of the population will ever be able to wrap their heads around the intricacies of PGP. Something else is going to have to replace it. [EDIT - as an aside, I've spent the last hour trying to do a "gen-key" on my ubuntu host, and been prevented by lack of entropy - and yes, I've tried running tcpdump, tried egrepping every file on the system for a string, etc... Ended up on https://bugs.launchpad.net/ubuntu/+source/gnupg/+bug/706011 https://bugs.launchpad.net/ubuntu/+source/gnupg/+bug/706011 and the answer seems to be, "Find a machine that does have entropy, or install a hardware random number generator in your computer." Please add this to the reasons why normal people never use GPG Edit-2: It took about 25 minutes, but apparently between find / -type f | xargs grep wontfindme and sudo tcpdump -nnn not port 22, I managed to collect enough entropy to keep gpg moving forward. ]
- alrs 12y ago
  apt-get install haveged
  - pstrateman 12y ago
    I'm not sure why you're being down voted. haveged is an absolute essential for all servers http://www.issihosts.com/haveged/ http://www.issihosts.com/haveged/
    - Saavedro 12y ago
      It's snake oil -- entropy isn't "depleted" in any meaningful way; once your kernel PRNG has accumulated enough entropy that you'd be comfortable using it to generate a crypto key it is not going to cease being suitable for that just because you continue asking it for random numbers.
tracker1 12y ago
What would be needed for adoption and ease of use would be for a registry to store public keys and salts... for webmail, a section of the message could be labelled as something like... [[SECURE_CONTENT abc@ez.im -> foo@bar.com BASE64-CONTENT ===== BASE64-SIGNATURE ]] The a browser or email plugin can then retrieve the public key for abc@ez.im and confirm the body was sent by who it says it was. Then if the user has already connected via the plugin, their private key is used. For simplicity the registry will do email validation of its' users, it should issue a SALT so that PBKDFx(SALT + email + passphrase) is used to generate the private key... the public key is stored in the registry. For more control, a given service entry in dns for peer-crypt registry for the given domain can be set as an authority. A distributed system could be used for confirming tokens combined with DNSSEC as a control system for greater availability. There are flaws with this idea, but it could be something that can be made insanely easy to use, as well as adding a lot of security to email transmission without creating an all new infrastructure, only adding services on top of what exists. For power users, they could set the public key without salt in the registries, if they wanted to manage their own, instead of relying on the generation mechanism, or to use/keep the same key across different addresses/providers.
- grymoire1 12y ago
  >The a browser or email plugin can then retrieve the public key for abc@ez.im and confirm the body was sent by who it says it was. Well, that's the issue, right? How does it do this?
TheCondor 12y ago
If it's not weak desire or need for privacy then why hasn't the market successfully solved this? Moreover, where is the outrage at the lack of privacy.
pdkl95 12y ago
Consider a separating the goals. OTR is much more successful because it allows ad-hoc connections instead of trying to make authenticity guarantees. It encourages authentication, but the decision of when to invest that extra effort is left with the user. Fundamentally, OTR just offers privacy from eavesdroppers, and it does that well. Every other feature is extra. Even better, these new features (e.g. authentication) don't have to start from nothing. A big benefit of separating features is that is added later can leverage the existing infrastructure. I personally believe the "killer crypto app" that will actually be adopted is a tool that is the opposite of OTR. It should only promise ad-hoc authenticates and do it in an generic style. I mean something that is somewhere between "gpg --clearsign" and 2channel/4chan style tripcodes[1]. In an ideal world, this needs to have a clearsign-style mode, so it can be used on existing forums. If the browser simply offers a "sign this" button next to textareas (no password, auto-gen they key and stuff it on a keyserver, just make it happen), it will be used. On the decode side, any blocks of text the browser sees that look like a signature get check, with the key pinned. That's it. Any features that allow nicer integration with email, forum software, etc, are nice but optional. This provides a minimum, anonymous level authentication (forgery prevention), and the only UX the user should have to see is the "sign this" button and a loud "possible forgery" warning if a signature doesn't match the pinned key. It even works regardless of who is transporting the message (different websites, email, gopher, avian carriers) without needing an "identify provider". Upgrading this infrastructure of pinned keys into something more interesting can happen later on, if desired. Would this work? I believe it's worth trying. It is clear that trying to solve all of the security needs in a single tool has not worked, and the one tool that got any adoption at all (OTR) has a much more narrow set of goals. [1] http://en.wikipedia.org/wiki/Imageboard#Tripcodes http://en.wikipedia.org/wiki/Imageboard#Tripcodes
GigabyteCoin 12y ago
>We could try to slap a GUI on top of it, but I don't believe great products are made that way. I'm right there with you on that one. So is most of HN I imagine. But the Apple ][ really brought the PC home for so many more people than it's competitors purely because of it's relatively simple GUI. Command prompts scare the average user.
- alrs 12y ago
  The Apple ][ booted to the commandline, as did the ][+, //e, and //c.
  - tmzt 12y ago
    At least the //e could boot to a disk without any interaction with the command line. I guess that's why I will always be a C=> fan.
ChecusIban 12y ago
It's one thing to recognize the limitations of GPG. I think we all do. It's another to declare it an abject failure and continue to use it and complain. Go generate a revocation certificate and push it to the global pool. You'll stop getting those disappointing emails. But seriously, go build something better. I fucking dare you. We'd all be better off for it if you really did.
- qznc 12y ago
  He does build something: https://whispersystems.org/ https://whispersystems.org/
  - yellowapple 12y ago
    Whether or not that something is better, however, depends very much on the use case. RedPhone and TextSecure are designed for very specific use cases (phone calls and text messages, respectively), whereas GnuPG is designed to be general-purpose and universal regardless of use case. Most jarringly, neither of those programs address email or file encryption/verification, and thus do nothing in GnuPG's primary realms of usage; by comparing them, you're basically comparing apples and crowbars.
justcommenting 12y ago
My mother literally did not know how to turn on a computer until a few years ago, but was able to use Signal on her iPhone after almost no explanation. My mother looked at me funny when I tried to explain GPG to her after the Snowden revelations started. But ever since I installed Signal on my mother's iPhone, I have been able to have private phone conversations with my mother. The significance of these types of distinctions between gpg and Signal are hard to underestimate when you extrapolate them to a societal level. My partner uses TextSecure/RedPhone with ease, and most of my friends use WhatsApp. I've only been able to convert a few of my non-technical friends, in contrast, into gpg users. Another way to think about this in terms of strategy: the means actually are the ends. Almost as important as his crypto expertise, moxie's deep understanding of UX and especially barriers to entry and the network effect have concretely made the world a better place, and not just for people like us...but also (and especially) for people like my mom, my partner, and my (mostly non-programmer) friends. Thank you for understanding that their privacy is important and that their human dignity matters--and especially for meeting them where they are. As a result, now it's not just my colleagues "in tech"--but also essentially all of my friends and family--who are with you!
- gaadd33 12y ago
  Just a question, how do you know it's only your mother you are talking to? Have you verified the key she uses with the one you are talk to?
  - justcommenting 12y ago
    It usually goes something like "mom, what are the two words (short authentication strings) you see on your phone?" Sometimes she even asks me--we make jokes about the combinations. And yeah, it's true that some of the Snowden docs reference ZRTP attacks & spoofing voice so it's not necessarily foolproof (or her phone could be owned etc.), but another one of the things my mother told me when I was a kid was "the key is to begin." And that's what moxie's done...
pnathan 12y ago
I am - roughly - a GPG fan. I've done classes on it, used it at work and at home, etc. GPG is a terrible UX. Accidental use of GPG tends to fail open, and insecurity results. Futzing with different keys, rotating them, retracting them, etc, are grievous. I can't reencrypt old stuff to new stuff (e.g., a pw database) without spending a good deal of time thinking about attacks, file safety, etc. I'm really a distributed encrypted email fan, I guess. I want to securely communicate over email to my friends and family, without having to do the GPG dance.
mkesper 12y ago
You say "cryptography of the 90s" as if the cryptography part of GnuPG was old and therefore unusable. This seems to be quite misleading to me.
na85 12y ago
Blaming "1990s crypto" is, IMHO, missing the point. Until we discover attacks against the ciphers there's no reason to throw them out just due to their age. If you're referring to GPG's shitty interface, then sure. But how much of that is "1990s crypto" and how much is due to the fact that it's one guy working by himself and barely being able to afford it, for years? GPG with Linux-levels of support would be an entirely different beast. edit: oh sorry, are we not allowed to disagree with Big Names™?
- hueving 12y ago
  >edit: oh sorry, are we not allowed to disagree with Big Names™? Not when it comes to cryptography and HN. Moxie, Collin, and tptacek are the only 3 people that can say anything that isn't mainstream pop-crypto. Anyone that dares to disagree with them is clearly wrong and must be punished with downvotes.
  - jnbiche 12y ago
    I agree, and this attitude is one of the things that's holding progress in crypto back. Should random software engineers experimenting with crypto claim that they've created a software package worthy of being used by dissidents and whistleblowers? Absolutely not! But should we be discouraging random software engineers from experimenting with crypto, and starting open source projects that may gain steam...and eventually, after years of use and audits, gain the standing and reputation to be used by dissidents and whistleblowers? Again, absolutely not.
- kS6n6GN8If 12y ago
  As it happens, I was just studying the CT-RSA 2015 conference agenda, I read that there is a conference talking about some form of oracles in OpenPGP and affecting several implementations. That would indicate that the RFC4880 format is fundamentally broken in theory AND practice. http://www.rsaconference.com/events/us15/agenda/sessions/1761/chosen-ciphertext-attacks-in-theory-and-practice http://www.rsaconference.com/events/us15/agenda/sessions/176...
- higherpurpose 12y ago
lmm 12y ago
HTTP is '90s tech. TCP/IP is '70s tech. There's nothing inherently wrong with that. 1400 lines of python that tries to pretend that an interactive program is a library is definitely a problem though. How's about this: rather than a protocol-up rewrite, how about just writing a library-up rewrite? Write a ground-up implementation of (maybe a subset of) RFC 4880, with opinionated choices of default ciphers (a bit like NaCl). Make it a portable library that can be used on all the popular mobile platforms and from all the popular languages. That's a plenty big enough job, and would fix the concrete pain points with GPG without throwing out the good part. > We could try to slap a GUI on top of it, but I don't believe great products are made that way. Good UX requires thinking about interactions all the way down to the protocol. What kind of concrete things would have to change at the protocol level? Plenty of good products conform to existing protocol standards, and a crypto protocol that has survived years of use in a hostile environment is worth its weight in gold. The talk of "modern" seems very handwavey as a reason to throw this out. > GPG has such a small legacy install base (literally on the order of ~50k users), that there's no reason to maintain compatibility with OpenPGP. I find it hard to believe there are only 50k users given that OpenPGP is built into the package-management infrastructure that every Debian user uses, and is required on Maven Central which virtually every Java system uses. Yes, these aren't people who actively chose it or are even aware that they're using OpenPGP - but protocols are like that; they're infrastructure. And as for your 50k, that may be a small number but they're the people who really care about privacy. Snowden is among them. If you're trying to spread crypto, those are the last people you want to alienate.
- dnet 12y ago
  > Write a ground-up implementation of (maybe a subset of) RFC 4880, with opinionated choices of default ciphers (a bit like NaCl). That's what PBP does: - Code: https://github.com/stef/pbp https://github.com/stef/pbp - A short (9:03) talk by the author: https://www.youtube.com/watch?v=Kl_gLMef1mI https://www.youtube.com/watch?v=Kl_gLMef1mI
  - Tepix 12y ago
    Thanks for the link, looks like an interesting project.
zvrba 12y ago
Is anybody trying to implement identity-based encryption?
59nadir 12y ago
Perhaps it would be better to leverage your position and your knowledge and come up with something before you write up a post like this? As other commenters have pointed out, you're in a prime position to actually come up with a working concept instead of just writing your opinion about it. I don't open a link to Paul Graham's site to read "Shit's bad, guys, and here are some fairly shallow reasons why I feel I can make that statement". I go there to read something that's been thought out by someone 'in the know'. Same goes for when your name is on a post about crypto. This was just whining. That may be totally acceptable to you, but I don't think I'm alone in expecting more than just an opinion.
- oskarth 12y ago
  In case you didn't know, Moxie is already doing that https://whispersystems.org/ https://whispersystems.org/ In any case, your point still stands, generally speaking.
  - 59nadir 12y ago
    Yes, I was referring to the post itself, which is essentially just complaining in the end. I am surprised it reached the top of HN, considering it really adds nothing.
xorcist 12y ago
Why 50k users? PGP/GnuPG is used to secure a _lot_ more than email. Every Linux distribution signs packages with it. So that's at least 100M users right there. Several APIs regarding domain name and AS registrations is based on it. I know at least two financial systems that signs their messages with it. That's just mentioning a few I can think of right now. I'm sure it secures a lot lot more. It's used all over the place and it seems to do the job fairly well in most cases. Is it suitable for signing email in 2015? I don't know. Things could certainly be improved. I know there are more suitable schemes for IM communciation. But the software and the underlying protocol is not something you can break in a heartbeat. It's important software. Perhaps we need to speak more of the evolving use case in email?
- Guvante 12y ago
  You misunderstand, they are talking specifically about encrypted communication for the new use case. Think of it instead as trying to replace email for unencrypted communication, you need a different use case as the user base is too entrenched. In contrast GPG encrypted messages are a small community. The fact that GPG is used for other things is fine, as it will still exist and can still be used for those things.
mrottenkolber 12y ago
I think you are blaming a slightly arcane program for what is essentially laziness of the population. Every time I read a comment on HN stating how PGP isn't usable I cry a little bit inside. GPG in no harder to use than git or many other tools professionals use. The difference being, its worse to make a mistake using GPG than it is to make a mistake using most other programs. In the end, you are securing confidential information, which will always be hard, unnerving and require concentration and care. And this is just inherent to the task, which is fighting an undefined, super-powerful, ill-meaning enemy. Encryption is violence. The objective is to violently keep an enemy away from your jewels. Instead of using an armed guard at your door, you use mathematical forces which are impossible for your enemy to overcome. Imagine your enemy needs the cleartext to save his own life, how does he feel when he is denied access and unable to gain access? It doesn't matter if its a steel door or a block-cipher. What people are essentially demanding when they want "easy to use crypto" is a self-firing and self-aiming rifle with friendly-fire detection. "Keep all my adversaries away but don't bother me about it." That's not how conflict works. If you attempt to secure your communications from a state actor, you are engaging in a full-blown combat against one of the most deadly forces there can be. That conflict will always be demanding and unpleasant. GPG being "hard to use" will be the least of your problems. But no, we want everything for free. Protecting yourself against the overlords should be easy and painless, almost automatic. The defendant shouldn't have to learn how his defense works or how to properly use it. Seriously? EDIT: And what I find unnerving about your post is, suddenly the people who put in the effort to use GPG are the bad guys? The 0.1% who actually take privacy seriously enough to go through the the trouble? Don't get me wrong, I almost never use GPG, not because it's hard to use (M-x epa-encrypt-region, anyone?), but because I don't want to experience the emotional distress related to struggling with a super-powered state.
felixhammerl 12y ago
I relly disagree that all is lost for PGP. Here's why it's a good idea to not just carelessly toss out the seemingly old and busted: https://blog.whiteout.io/2015/02/25/pgp-theres-life-in-the-old-dog-yet/ https://blog.whiteout.io/2015/02/25/pgp-theres-life-in-the-o...
joshstrange 12y ago
Couldn't agree more. I have public keys available and I understand the concepts at a high to medium level but if it's taken me as long as it has to get a grasp on it (And I still would need to do a number of google searches if I received an encrypted email) how can I expect all of my friends to ever get it? They want something that "Just Works" and so they gladly use (as do I) Facebook, iMessage, SMS, and Email. All unencrypted (Well iMessage is encrypted but I know they could easily view any messages they want). They still have password-reuse issues all over the place (my hands aren't clean either). It's not that I don't care about privacy, I very much do, and my friends care as well (to a slightly lesser extent I would say and I'm willing to accept more to get to that point than they are). It's just that I am completely overwhelmed, only 1-2 of my friends even understand encryption at a high level and none of them expose private keys for communication. Even other developers I worked with got annoyed with OTR with adium/pidgin to the point I had to turn it off. It's not that I want to throw in the towel, I desperately want a solution, but even easy to use (what I'm looking for) "secure" communication tools get torn to shreds here on HN and so I haven't even considered trying to get them all to switch tools (even I thought it was possible, which I don't). I guess what I'm trying to say is I'm not going to stop talking to my friends and my friends more or less refuse (due to complexity) to use encryption so what is the purpose of me even trying? The end result would be what? Maybe 1-2 people with which I can talk securely? Now I have to have 2 workflows and even if I have super-secure unique PW's, FDE (Full Disk Encryption, which I do use), and take steps to secure all MY data all of my friends are essentially leaking my data. So if the NSA/FBI/China/Hacker/etc want my communications they can just go after the weakest link, the people I talk to. It's very disheartening to say the very least. I've considered blogging about this a number of times but didn't want to get destroyed here on HN (if I even posted it here, I probably wouldn't due to backlash) for being defeatist or get told how I am the problem. I am not a cryptographer and therefore am not qualified to even attempt to build secure software (if I even thought I was capable of coding up such a project). Even the tools that are easy to use that DO use tried and true encryption (Like PGP gmail/chrome extension, that's all well and good but what if I'm on mobile? Or on a friends computer? It's just too restrictive) are locked to a an OS/Browser/Device. I really do understand I'm asking for quite a lot (Cross-platform AND cross-device) but without those "features" there is no way I could get my peers to switch. I'd love to have someone reply with how wrong I am how there is X tool/product/service that satisfies my requirements but I've searched high and low so I don't expect such a reply...

by moxie 12y ago

sillysaurus3 12y ago

You know you're one of only a few people in the world who is in a position to do that, right? Anyone else would (rightfully!) get torn to shreds on HN by tptacek or yourself. And I say "rightfully" because it is very likely that other people would screw up some central aspect to the security of any new product that claims security. It's not just that, though. Anyone else with your knowledge but no standing would be scorched for saying what you just said. "Throw away the one thing that has proven to be secure and write our own protocol" doesn't go hand in hand with "serious cryptographers trust what this person is saying." The truth is probably that either you do this or nobody will. You should. The world would be better for it.

click170 12y ago
Is there a kick starter page for this cause that I can contribute to? Because I would. I'm not going to back just any crypto project, but with the right people leading the charge I would get behind it.
- grinich 12y ago
  https://whispersystems.org/blog/bithub/ https://whispersystems.org/blog/bithub/ (Unrelated to GPG, but this goes towards crypto projects by Moxie and other solid people.)
desijays 12y ago
Go through my comment history. How many comments do you see? A handful? Yup. The reason there are so few is because, I only reply to comments I wholeheartedly agree with. And this is one of them.
yellowapple 12y ago
> You know you're one of only a few people in the world who is in a position to do that, right? Anyone else would (rightfully!) get torn to shreds on HN by tptacek or yourself. And I say "rightfully" because it is very likely that other people would screw up some central aspect to the security of any new product that claims security. This attitude is why GnuPG (and other PGP implementations) are in a position to be criticized by the Moxies of the world. Is there some particular reason why anybody outside of some recognized elite should be discouraged from at least trying to create a better, improved system? Yeah, they'll probably fail in a lot of cases, but if the world really wants a modern, easy-to-use alternative to PGP (a real alternative, not use-case-specific alternatives like RedPhone and TextSecure; encrypted/signed email is still a valid use case that both those things blissfully ignore, by the way), this sort of attitude - that anyone outside of a select few rightfully deserves to be scolded for trying to make better crypto - is lethally toxic to that goal.
- tptacek 12y ago
  Yes, there is a reason to discourage those people. In between the time that a cryptographically illiterate developer releases their MVP 1.0 version and the time that it's discovered that their cryptography is fundamentally flawed --- a window of time that can stretch on for years --- actual people will rely on the tool for their security, not realizing that serious adversaries are reading their messages. Most new cryptosystems --- a cryptosystem being "anything that uses a cipher, including when the cipher is simply AES --- are terribly broken. Search for [decryptocat] for an extremely good example of what I'm talking about. Developers who are new to cryptography that want to learn more about it and eventually use it in their own systems should start by learning how to exploit broken cryptography. If you can't exploit an RSA padding oracle, you shouldn't be designing systems that use public key cryptography. If you can't exploit a CTR nonce stutter, you shouldn't be using block crypto. Developers who don't want to learn cryptography should work on improving the UX (UI and workflow) of existing cryptosystems. PGP could sure use some help, but even if you don't want to help with PGP, there's a huge green field of work to be done on browser TLS trust and CA user interface. Just as one example.
  - 12y ago

the_af 12y ago

Hey Moxie, it intrigues me that the first thing you mention in your post isn't technical or even about UX (which is what most people in this thread are focusing on). Instead, it's that you're starting to dislike reading emails from the kind of person who would "voluntarily use GPG". I know you said there's no unifying theme to these emails, but can you elaborate? Maybe something about security-obssessed lay people using GPG to send the most trivial of emails? Or something else entirely?

fensipens 12y ago
To quote another commenter: "Way to take a dump on people who make an effort."
napoleond 12y ago
It's the same as people who voluntarily use Windows. It says something about them, that's all.
- nothrabannosir 12y ago
  I can guess why you're being downvoted, but your comment is ironically correct. It /does/ say something about them! But what that is depends on who you ask. And that, again, says something about /them/. Which says something about the downvoters. Irony everywhere.
  - napoleond 12y ago
    People are getting offended, but I could have replaced Windows with almost anything. Our choices say things about us. Getting back to the subject at hand, though, I assume 'moxie meant that people who choose to use GPG for casual conversation must be slightly masochistic and therefore slightly less likely to have something interesting to say. ... just like Windows users ;)
    - dasil003 12y ago
      Yes, of course, but I'm very curious about moxie's interpretation of what using GPG says about the people who randomly email him; certainly more curious than constructing my own stereotype.

sarciszewski 12y ago

> When building new products, we can start fresh with modern cryptography, a modern protocol, and a modern design philosophy. Agreed 100%. I just don't have anything to offer in this space :(

derekja 12y ago

Please do this! I'd love to be able to use encrypted communications as a matter of course, but just not enough of the folks I work with are able to get it set up. My world is filled with smart people, but only a small fraction are purely computer folks and to try and get a biologist to understand why it's interesting to have all emails encrypted is a losing task unless it's super easy.

napoleond 12y ago

What do you think that looks like, though? Is it TextSecure on the desktop, with file attachments? Is it Pond? Is it just email, but with a different crypto layer? I feel like a lot of the things GPG aims to do are fundamentally hard. It's not the technology that sucks, it's the problem. I completely agree that the answer will come from thinking about user interactions first, but I'm not sure that the solution will look much different than a better GPG client.

moxie 12y ago
I don't have a definite answer. There's the path we're executing on at Open Whisper Systems, but there are a bunch of other projects working in this area as well (Mailpile, LEAP, etc). I think the problems are solvable, but only if we have a different design approach. So when I see projects trying not-PGP, I'm interested. When I see projects building on PGP, I'm less interested.
- unicornporn 12y ago
  I'll take the opportunity to say that it saddens me that I still can not communicate using TextSecure with iOS users. It's been almost two years[1] since iOS support was "promised". TS is great, but we need to be able to communicate with iOS users. [1] https://whispersystems.org/blog/sure/ https://whispersystems.org/blog/sure/
  - Johnny_Brahms 12y ago
    Signal 2.0 was tagged on github 3 days ago and will bring the textsecure protocol to iOS whenever apple is done reviewing it.
    - unicornporn 12y ago
      If this is true, it's awesome. I've tried making contact between Signal on iOS with TextSecure on Android before, without luck.
  - patcon 12y ago

ryanmarsh 12y ago

Back in the 90's I tried to use GPG, and I tried to pay for digital music. They both went roughly the same way. Arguably it was easier to use GPG back then than it is now. Pine was my MUA and I had an easy to find public key. Now I have an iPhone, don't use Linux on my laptop anymore, and make heavy use of messaging products. Here's what I have now that I didn't have then, 2FA. There's an app on my phone that makes it super easy so I use it. If I had to still carry around a separate RSA code generator I probably wouldn't. Surely we can figure out a way to make encrypted email nearly transparently easy with the major mail providers, and the default mail apps on our laptops and and phones. Surely we can figure out a way to make a trustworthy distributed keystore. Perhaps this will all change because before Snowden we were blissfully unaware and GPG was a cool toy unless your life was in real danger, post Snowden we're residents of a vast internet police state and my Mom knows how Target was hacked. I have a strong suspicion we will figure this out, and soon. I wonder, are VC's are looking into funding easy to use consumer encryption?

MichaelGG 12y ago
>Perhaps this will all change because before Snowden we were blissfully unaware Every time I see this in regards to email, I'm puzzled. Carnivore was known about in the 90s. Then there was the AT&T Room 641A in the 200s. So I don't know how people were unaware that state level actors could tap connections and record email. Second, for this threat model, just forcing and validating TLS on SMTP gets you pretty far, does it not? You're then mostly trusting your email provider. And without trusting them, we get into user-unfriendly stuff like not being able to forget your password. (Barring some sort of breakthrough ideas.) Seriously, has there been any good proposals that provide strong privacy (say, no one but the user can read the message) but aren't complicated or require users to do things they aren't gonna do: validate keys? PGPFone and ZRTP are great because you already have an "out-of-band" key auth mechanism in place, and it's fairly straightforward to check.
- ghshephard 12y ago
  Re: "You're then mostly trusting your email provider. And without trusting them, we get into user-unfriendly stuff like not being able to forget your password." Nobody should trust their email provider if they are concerned about the privacy of their email. The Job To Be Done, by an email provider such as gmail/yahoo/hotmail is to act as a mail store, and mta. A user should be able to rely on a local MUA for confidentiality. Admittedly, that shifts the level of trust from the Email Provider to the provider of the MUA software and the Local Hardware, which is why things like OpenBSD/Linux and (hopefully not firmware-tweaked) commodity hardware is so important.

rubyfan 12y ago

Don't you think the time is right to build such a system? Public awareness of privacy especially wrt mass government surveillance, identity theft and high profile corporate breaches seems that such an thing is ripe. I am naively optimistic given the right implementation a consortium of stakeholders could do something meaningful.

yellowapple 12y ago

Do you have any specific criticisms of GPG other than "it's old and it's not popular"? What's your ideal vision of what end-to-end encryption for the common (wo)man should look like other than "not GPG"? Two questions whose answers are nonexistent in your article.

scintill76 12y ago
Specific criticisms of GPG: > the working hypothesis for privacy enhancing technology was simple: we’d develop really flexible power tools for ourselves, and then teach everyone to be like us... Instead of developing opinionated software with a simple interface, GPG was written to be as powerful and flexible as possible. It’s up to the user whether the underlying cipher is SERPENT or IDEA or TwoFish I think it's self-explanatory why it's not good that users need to know about SERPENT, IDEA, and TwoFish. > the fundamental architecture of PGP also leaves no room for now critical concepts like forward secrecy. > a ballooning penumbra of OpenPGP specifications and notes so prolific that the entire picture is almost impossible to grasp... Mailpile had to write 1400 lines of python code just to interface with a native GnuPG installation for basic operations, and it still isn’t rock solid. > journalists who depend on it struggle with it and often mess up (“I send you the private key to communicate privately, right?”) UX failure leads to user uncertainty or insecure behavior. What a better replacement looks like (from the comment here): > Good UX requires thinking about interactions all the way down to the protocol. > we can start fresh with modern cryptography, a modern protocol, and a modern design philosophy
- niels_olson 12y ago
  > UX failure leads to user uncertainty or insecure behavior. I'd say user uncertainty and insecure behavior are, each, sufficient criteria to declare a UX a failure.
- lmm 12y ago
  You list plenty of specific problems with GPG the UI and GPG the "API" (though frankly the fact that mailpile would write 1400 lines of python that wrap GPG rather than taking one of the independent library implementations of RFC4880 and bringing it up to production quality makes them part of the problem). But none of those specific problems are problems with OpenPGP the protocol.

zobzu 12y ago

The issue is that it seems like you want to replace GnuPG by something that does the same - but is made better, and that has your brand name on it. That's very marketingish of you. Why not fix GnuPG instead? There's more than slapping GUIs to things! Also, where is your 50K user base number from? According to my SKS keyserver traffic, it's much greater, even if i were to assume 50% of the traffic is non-human.. what the fuck happened to you man? Also, if it's well done - I'm not against something different from GnuPG. I just disagree with the argument. Which leads to this question: which product are you going to announce in 6mo that would be so much better?

mirimir 12y ago

OK, GPG is crufty and hard to use, and the email protocol exposes metadata. So perhaps it is best to start fresh. What do you think of the Dark Mail effort? And of Pond?

jimktrains2 12y ago

One of the biggest problems with GPG is keyex. Sure, we have key servers, but that's not really a secure way of doing things. Secure communication is as much a cultural change as a technological one.

whyever 12y ago
GPG at least has the web of trust, with all its privacy problems. Most technologies just use "trust on first use".
- jimktrains2 12y ago
  That doesn't actually solve the problem though. It helps in theory, but it requires the user to understand what they're doing to a level most won't. There is also the cultural issue of just exchanging fingerprints. Only techies put them on business cards, and even then only some. It needs to be common action.
  - whyever 12y ago
    Well, at least they try to solve it. Another approach for verification is employed by Threema [1]: The server verifies email addresses and phone numbers, so if the address or number is in your contacts you can have more confidence, represented by an orange dot next to the contact. If you verify the fingerprint by scanning QR codes, you get a green dot. About fingerprints for the masses: I really like the visual fingerprints Peerio is using (basically bigger Github-style generated avatar icons). [1] https://threema.ch/en/faq https://threema.ch/en/faq

ghshephard 12y ago

GPG is way, way, way to complex for all but the 0.01% of people who are GPG experts. It's too complex for me - and I've read (and enjoyed) Applied Cryptography. But, not having used it for a few years, I went to take a look again - list some keys, maybe SMS some friends to exchange fingerprints and sign their keys, etc... - I'm trying to recall what the relationship between PUB, SUB, UID, Key Fingerprints are. And how do I indicate that I trust a key and upload it back up to pgp.mit.edu? And I consider myself a member of the 0.1% who at least understand the principals behind PGP/Public Keys/Private Keys/Web of Trust, etc... So - if I'm having trouble understanding this without a couple hours of study, their is Zero chance that the other 99% of the population will ever be able to wrap their heads around the intricacies of PGP. Something else is going to have to replace it. [EDIT - as an aside, I've spent the last hour trying to do a "gen-key" on my ubuntu host, and been prevented by lack of entropy - and yes, I've tried running tcpdump, tried egrepping every file on the system for a string, etc... Ended up on https://bugs.launchpad.net/ubuntu/+source/gnupg/+bug/706011 https://bugs.launchpad.net/ubuntu/+source/gnupg/+bug/706011 and the answer seems to be, "Find a machine that does have entropy, or install a hardware random number generator in your computer." Please add this to the reasons why normal people never use GPG Edit-2: It took about 25 minutes, but apparently between find / -type f | xargs grep wontfindme and sudo tcpdump -nnn not port 22, I managed to collect enough entropy to keep gpg moving forward. ]

alrs 12y ago
apt-get install haveged
- pstrateman 12y ago
  I'm not sure why you're being down voted. haveged is an absolute essential for all servers http://www.issihosts.com/haveged/ http://www.issihosts.com/haveged/
  - Saavedro 12y ago
    It's snake oil -- entropy isn't "depleted" in any meaningful way; once your kernel PRNG has accumulated enough entropy that you'd be comfortable using it to generate a crypto key it is not going to cease being suitable for that just because you continue asking it for random numbers.

tracker1 12y ago

What would be needed for adoption and ease of use would be for a registry to store public keys and salts... for webmail, a section of the message could be labelled as something like... [[SECURE_CONTENT abc@ez.im -> foo@bar.com BASE64-CONTENT ===== BASE64-SIGNATURE ]] The a browser or email plugin can then retrieve the public key for abc@ez.im and confirm the body was sent by who it says it was. Then if the user has already connected via the plugin, their private key is used. For simplicity the registry will do email validation of its' users, it should issue a SALT so that PBKDFx(SALT + email + passphrase) is used to generate the private key... the public key is stored in the registry. For more control, a given service entry in dns for peer-crypt registry for the given domain can be set as an authority. A distributed system could be used for confirming tokens combined with DNSSEC as a control system for greater availability. There are flaws with this idea, but it could be something that can be made insanely easy to use, as well as adding a lot of security to email transmission without creating an all new infrastructure, only adding services on top of what exists. For power users, they could set the public key without salt in the registries, if they wanted to manage their own, instead of relying on the generation mechanism, or to use/keep the same key across different addresses/providers.

grymoire1 12y ago
>The a browser or email plugin can then retrieve the public key for abc@ez.im and confirm the body was sent by who it says it was. Well, that's the issue, right? How does it do this?

TheCondor 12y ago

If it's not weak desire or need for privacy then why hasn't the market successfully solved this? Moreover, where is the outrage at the lack of privacy.

pdkl95 12y ago

Consider a separating the goals. OTR is much more successful because it allows ad-hoc connections instead of trying to make authenticity guarantees. It encourages authentication, but the decision of when to invest that extra effort is left with the user. Fundamentally, OTR just offers privacy from eavesdroppers, and it does that well. Every other feature is extra. Even better, these new features (e.g. authentication) don't have to start from nothing. A big benefit of separating features is that is added later can leverage the existing infrastructure. I personally believe the "killer crypto app" that will actually be adopted is a tool that is the opposite of OTR. It should only promise ad-hoc authenticates and do it in an generic style. I mean something that is somewhere between "gpg --clearsign" and 2channel/4chan style tripcodes[1]. In an ideal world, this needs to have a clearsign-style mode, so it can be used on existing forums. If the browser simply offers a "sign this" button next to textareas (no password, auto-gen they key and stuff it on a keyserver, just make it happen), it will be used. On the decode side, any blocks of text the browser sees that look like a signature get check, with the key pinned. That's it. Any features that allow nicer integration with email, forum software, etc, are nice but optional. This provides a minimum, anonymous level authentication (forgery prevention), and the only UX the user should have to see is the "sign this" button and a loud "possible forgery" warning if a signature doesn't match the pinned key. It even works regardless of who is transporting the message (different websites, email, gopher, avian carriers) without needing an "identify provider". Upgrading this infrastructure of pinned keys into something more interesting can happen later on, if desired. Would this work? I believe it's worth trying. It is clear that trying to solve all of the security needs in a single tool has not worked, and the one tool that got any adoption at all (OTR) has a much more narrow set of goals. [1] http://en.wikipedia.org/wiki/Imageboard#Tripcodes http://en.wikipedia.org/wiki/Imageboard#Tripcodes

GigabyteCoin 12y ago

>We could try to slap a GUI on top of it, but I don't believe great products are made that way. I'm right there with you on that one. So is most of HN I imagine. But the Apple ][ really brought the PC home for so many more people than it's competitors purely because of it's relatively simple GUI. Command prompts scare the average user.

alrs 12y ago
The Apple ][ booted to the commandline, as did the ][+, //e, and //c.
- tmzt 12y ago
  At least the //e could boot to a disk without any interaction with the command line. I guess that's why I will always be a C=> fan.

ChecusIban 12y ago

It's one thing to recognize the limitations of GPG. I think we all do. It's another to declare it an abject failure and continue to use it and complain. Go generate a revocation certificate and push it to the global pool. You'll stop getting those disappointing emails. But seriously, go build something better. I fucking dare you. We'd all be better off for it if you really did.

qznc 12y ago
He does build something: https://whispersystems.org/ https://whispersystems.org/
- yellowapple 12y ago
  Whether or not that something is better, however, depends very much on the use case. RedPhone and TextSecure are designed for very specific use cases (phone calls and text messages, respectively), whereas GnuPG is designed to be general-purpose and universal regardless of use case. Most jarringly, neither of those programs address email or file encryption/verification, and thus do nothing in GnuPG's primary realms of usage; by comparing them, you're basically comparing apples and crowbars.

justcommenting 12y ago

My mother literally did not know how to turn on a computer until a few years ago, but was able to use Signal on her iPhone after almost no explanation. My mother looked at me funny when I tried to explain GPG to her after the Snowden revelations started. But ever since I installed Signal on my mother's iPhone, I have been able to have private phone conversations with my mother. The significance of these types of distinctions between gpg and Signal are hard to underestimate when you extrapolate them to a societal level. My partner uses TextSecure/RedPhone with ease, and most of my friends use WhatsApp. I've only been able to convert a few of my non-technical friends, in contrast, into gpg users. Another way to think about this in terms of strategy: the means actually are the ends. Almost as important as his crypto expertise, moxie's deep understanding of UX and especially barriers to entry and the network effect have concretely made the world a better place, and not just for people like us...but also (and especially) for people like my mom, my partner, and my (mostly non-programmer) friends. Thank you for understanding that their privacy is important and that their human dignity matters--and especially for meeting them where they are. As a result, now it's not just my colleagues "in tech"--but also essentially all of my friends and family--who are with you!

gaadd33 12y ago
Just a question, how do you know it's only your mother you are talking to? Have you verified the key she uses with the one you are talk to?
- justcommenting 12y ago
  It usually goes something like "mom, what are the two words (short authentication strings) you see on your phone?" Sometimes she even asks me--we make jokes about the combinations. And yeah, it's true that some of the Snowden docs reference ZRTP attacks & spoofing voice so it's not necessarily foolproof (or her phone could be owned etc.), but another one of the things my mother told me when I was a kid was "the key is to begin." And that's what moxie's done...

pnathan 12y ago

I am - roughly - a GPG fan. I've done classes on it, used it at work and at home, etc. GPG is a terrible UX. Accidental use of GPG tends to fail open, and insecurity results. Futzing with different keys, rotating them, retracting them, etc, are grievous. I can't reencrypt old stuff to new stuff (e.g., a pw database) without spending a good deal of time thinking about attacks, file safety, etc. I'm really a distributed encrypted email fan, I guess. I want to securely communicate over email to my friends and family, without having to do the GPG dance.

mkesper 12y ago

You say "cryptography of the 90s" as if the cryptography part of GnuPG was old and therefore unusable. This seems to be quite misleading to me.

na85 12y ago

Blaming "1990s crypto" is, IMHO, missing the point. Until we discover attacks against the ciphers there's no reason to throw them out just due to their age. If you're referring to GPG's shitty interface, then sure. But how much of that is "1990s crypto" and how much is due to the fact that it's one guy working by himself and barely being able to afford it, for years? GPG with Linux-levels of support would be an entirely different beast. edit: oh sorry, are we not allowed to disagree with Big Names™?

hueving 12y ago
>edit: oh sorry, are we not allowed to disagree with Big Names™? Not when it comes to cryptography and HN. Moxie, Collin, and tptacek are the only 3 people that can say anything that isn't mainstream pop-crypto. Anyone that dares to disagree with them is clearly wrong and must be punished with downvotes.
- jnbiche 12y ago
  I agree, and this attitude is one of the things that's holding progress in crypto back. Should random software engineers experimenting with crypto claim that they've created a software package worthy of being used by dissidents and whistleblowers? Absolutely not! But should we be discouraging random software engineers from experimenting with crypto, and starting open source projects that may gain steam...and eventually, after years of use and audits, gain the standing and reputation to be used by dissidents and whistleblowers? Again, absolutely not.
kS6n6GN8If 12y ago
As it happens, I was just studying the CT-RSA 2015 conference agenda, I read that there is a conference talking about some form of oracles in OpenPGP and affecting several implementations. That would indicate that the RFC4880 format is fundamentally broken in theory AND practice. http://www.rsaconference.com/events/us15/agenda/sessions/1761/chosen-ciphertext-attacks-in-theory-and-practice http://www.rsaconference.com/events/us15/agenda/sessions/176...
higherpurpose 12y ago

lmm 12y ago

HTTP is '90s tech. TCP/IP is '70s tech. There's nothing inherently wrong with that. 1400 lines of python that tries to pretend that an interactive program is a library is definitely a problem though. How's about this: rather than a protocol-up rewrite, how about just writing a library-up rewrite? Write a ground-up implementation of (maybe a subset of) RFC 4880, with opinionated choices of default ciphers (a bit like NaCl). Make it a portable library that can be used on all the popular mobile platforms and from all the popular languages. That's a plenty big enough job, and would fix the concrete pain points with GPG without throwing out the good part. > We could try to slap a GUI on top of it, but I don't believe great products are made that way. Good UX requires thinking about interactions all the way down to the protocol. What kind of concrete things would have to change at the protocol level? Plenty of good products conform to existing protocol standards, and a crypto protocol that has survived years of use in a hostile environment is worth its weight in gold. The talk of "modern" seems very handwavey as a reason to throw this out. > GPG has such a small legacy install base (literally on the order of ~50k users), that there's no reason to maintain compatibility with OpenPGP. I find it hard to believe there are only 50k users given that OpenPGP is built into the package-management infrastructure that every Debian user uses, and is required on Maven Central which virtually every Java system uses. Yes, these aren't people who actively chose it or are even aware that they're using OpenPGP - but protocols are like that; they're infrastructure. And as for your 50k, that may be a small number but they're the people who really care about privacy. Snowden is among them. If you're trying to spread crypto, those are the last people you want to alienate.

dnet 12y ago
> Write a ground-up implementation of (maybe a subset of) RFC 4880, with opinionated choices of default ciphers (a bit like NaCl). That's what PBP does: - Code: https://github.com/stef/pbp https://github.com/stef/pbp - A short (9:03) talk by the author: https://www.youtube.com/watch?v=Kl_gLMef1mI https://www.youtube.com/watch?v=Kl_gLMef1mI
- Tepix 12y ago
  Thanks for the link, looks like an interesting project.

zvrba 12y ago

Is anybody trying to implement identity-based encryption?

59nadir 12y ago

Perhaps it would be better to leverage your position and your knowledge and come up with something before you write up a post like this? As other commenters have pointed out, you're in a prime position to actually come up with a working concept instead of just writing your opinion about it. I don't open a link to Paul Graham's site to read "Shit's bad, guys, and here are some fairly shallow reasons why I feel I can make that statement". I go there to read something that's been thought out by someone 'in the know'. Same goes for when your name is on a post about crypto. This was just whining. That may be totally acceptable to you, but I don't think I'm alone in expecting more than just an opinion.

oskarth 12y ago
In case you didn't know, Moxie is already doing that https://whispersystems.org/ https://whispersystems.org/ In any case, your point still stands, generally speaking.
- 59nadir 12y ago
  Yes, I was referring to the post itself, which is essentially just complaining in the end. I am surprised it reached the top of HN, considering it really adds nothing.

xorcist 12y ago

Why 50k users? PGP/GnuPG is used to secure a _lot_ more than email. Every Linux distribution signs packages with it. So that's at least 100M users right there. Several APIs regarding domain name and AS registrations is based on it. I know at least two financial systems that signs their messages with it. That's just mentioning a few I can think of right now. I'm sure it secures a lot lot more. It's used all over the place and it seems to do the job fairly well in most cases. Is it suitable for signing email in 2015? I don't know. Things could certainly be improved. I know there are more suitable schemes for IM communciation. But the software and the underlying protocol is not something you can break in a heartbeat. It's important software. Perhaps we need to speak more of the evolving use case in email?

Guvante 12y ago
You misunderstand, they are talking specifically about encrypted communication for the new use case. Think of it instead as trying to replace email for unencrypted communication, you need a different use case as the user base is too entrenched. In contrast GPG encrypted messages are a small community. The fact that GPG is used for other things is fine, as it will still exist and can still be used for those things.

mrottenkolber 12y ago

I think you are blaming a slightly arcane program for what is essentially laziness of the population. Every time I read a comment on HN stating how PGP isn't usable I cry a little bit inside. GPG in no harder to use than git or many other tools professionals use. The difference being, its worse to make a mistake using GPG than it is to make a mistake using most other programs. In the end, you are securing confidential information, which will always be hard, unnerving and require concentration and care. And this is just inherent to the task, which is fighting an undefined, super-powerful, ill-meaning enemy. Encryption is violence. The objective is to violently keep an enemy away from your jewels. Instead of using an armed guard at your door, you use mathematical forces which are impossible for your enemy to overcome. Imagine your enemy needs the cleartext to save his own life, how does he feel when he is denied access and unable to gain access? It doesn't matter if its a steel door or a block-cipher. What people are essentially demanding when they want "easy to use crypto" is a self-firing and self-aiming rifle with friendly-fire detection. "Keep all my adversaries away but don't bother me about it." That's not how conflict works. If you attempt to secure your communications from a state actor, you are engaging in a full-blown combat against one of the most deadly forces there can be. That conflict will always be demanding and unpleasant. GPG being "hard to use" will be the least of your problems. But no, we want everything for free. Protecting yourself against the overlords should be easy and painless, almost automatic. The defendant shouldn't have to learn how his defense works or how to properly use it. Seriously? EDIT: And what I find unnerving about your post is, suddenly the people who put in the effort to use GPG are the bad guys? The 0.1% who actually take privacy seriously enough to go through the the trouble? Don't get me wrong, I almost never use GPG, not because it's hard to use (M-x epa-encrypt-region, anyone?), but because I don't want to experience the emotional distress related to struggling with a super-powered state.

felixhammerl 12y ago

I relly disagree that all is lost for PGP. Here's why it's a good idea to not just carelessly toss out the seemingly old and busted: https://blog.whiteout.io/2015/02/25/pgp-theres-life-in-the-old-dog-yet/ https://blog.whiteout.io/2015/02/25/pgp-theres-life-in-the-o...

joshstrange 12y ago

Couldn't agree more. I have public keys available and I understand the concepts at a high to medium level but if it's taken me as long as it has to get a grasp on it (And I still would need to do a number of google searches if I received an encrypted email) how can I expect all of my friends to ever get it? They want something that "Just Works" and so they gladly use (as do I) Facebook, iMessage, SMS, and Email. All unencrypted (Well iMessage is encrypted but I know they could easily view any messages they want). They still have password-reuse issues all over the place (my hands aren't clean either). It's not that I don't care about privacy, I very much do, and my friends care as well (to a slightly lesser extent I would say and I'm willing to accept more to get to that point than they are). It's just that I am completely overwhelmed, only 1-2 of my friends even understand encryption at a high level and none of them expose private keys for communication. Even other developers I worked with got annoyed with OTR with adium/pidgin to the point I had to turn it off. It's not that I want to throw in the towel, I desperately want a solution, but even easy to use (what I'm looking for) "secure" communication tools get torn to shreds here on HN and so I haven't even considered trying to get them all to switch tools (even I thought it was possible, which I don't). I guess what I'm trying to say is I'm not going to stop talking to my friends and my friends more or less refuse (due to complexity) to use encryption so what is the purpose of me even trying? The end result would be what? Maybe 1-2 people with which I can talk securely? Now I have to have 2 workflows and even if I have super-secure unique PW's, FDE (Full Disk Encryption, which I do use), and take steps to secure all MY data all of my friends are essentially leaking my data. So if the NSA/FBI/China/Hacker/etc want my communications they can just go after the weakest link, the people I talk to. It's very disheartening to say the very least. I've considered blogging about this a number of times but didn't want to get destroyed here on HN (if I even posted it here, I probably wouldn't due to backlash) for being defeatist or get told how I am the problem. I am not a cryptographer and therefore am not qualified to even attempt to build secure software (if I even thought I was capable of coding up such a project). Even the tools that are easy to use that DO use tried and true encryption (Like PGP gmail/chrome extension, that's all well and good but what if I'm on mobile? Or on a friends computer? It's just too restrictive) are locked to a an OS/Browser/Device. I really do understand I'm asking for quite a lot (Cross-platform AND cross-device) but without those "features" there is no way I could get my peers to switch. I'd love to have someone reply with how wrong I am how there is X tool/product/service that satisfies my requirements but I've searched high and low so I don't expect such a reply...