PGP needs to be retired in honor

https://www.ctrlc.hu/~stef/blog/posts/on_pgp.html

by mstef • 9 years ago

133 92 9 years ago

falcolas8• 9 years ago

Perhaps I'm just out of touch, but I'm not familiar with any of the alternative tools they mentioned. If we retire PGP (and its GNU clone), what widely available tool should we use in its stead?

gregoryrueda• 9 years ago

Signal? Some paid services seem to be blossoming, see https://protonmail.com

datatan5• 9 years ago

Protonmail uses PGP............

falcolas8• 9 years ago

Signal is not much of a PGP replacement. There's a lot that PGP can do that Signal can't: signing, encryption of large blobs at rest, and key management.

I use PGP as part of my backup solution, encrypting my backups at rest with an asymmetric key. I can't do that with Signal.

mstef10• 9 years ago

opmsg does masquerade as gnupg on the cli, if you take this further you could create a gnupg chameleon which detects what keys are available or what the input is based on auxillary info and then invoke the appropriate tool (which might be gnupg, or something else).

on a different note: gnupg is not widely used, signal is.

datatan5• 9 years ago

Signal is for text messaging and fails as an email replacement. It also does not work for signing code and it requires you give over your contacts list to a third party to work.

Signal is not fit for PGP's use case.

skrowl• 9 years ago

Quite a few listed here - https://alternativeto.net/software/gnupg/

twothamendment• 9 years ago

There are quite a few things listed there, but I fail to see one that looks like a replacement for PGP. Many are some form of PGP compatible encryption - some different platforms Android(AGP), Windows(GPG4Win, Fort) Apple(GPG Suite for apple mail). Some will only encrypt files with a password, others encrypt your disk. There might be some good software there, but I don't see anything that can replace PGP/GnuPG.

Using PGP/GnuPG isn't always easy, but it works for so many things. Signing code, encrypting files, emails, signing messages - replacing it is a fairly high bar.

I'd love to see encryption easy and used everywhere, but a few popular apps don't add up to replacing this old work horse.

tptacek4• 9 years ago

This is an unvetted list of random programs that claim to perform this- or that- cryptographic operation; it's not really helpful.

drzaiusapelord2• 9 years ago

but I'm not familiar with any of the alternative tools they mentioned.

The tinfoil hat part of me has been seeing this push for the Signal protocol straight out of nowhere and am a little worried its being done by a state level actor who knows something about it that we don't. Its much younger than PGP and as such has had less eyes on it. I also don't think Moxie Marlinspike, the founder of Signal's owner - Open Whisper, has the cred and trust Phil Zimmerman had, at least not yet. Its particularly worrisome as he seemingly is only known by a pseudonym.

I also would consier S/MIME, which is baked into most feature-heavy email clients including iOS, a practical alternative to PGP when the use case is email encryption. You and a friend can get certs easily, put them in your client via GUI, and be done with it. No command line skills needed if ease of use is the big complaint here. For the less technically inclined its a pretty good solution, pun intended.

mstef10• 9 years ago

if you knew the story you'd know that Phil did actually an abysmal implementation which had to fixed by others.

verytrivial3• 9 years ago

I think the title is a little inflammatory. The conclusion does not say we should stop using PGP but consider the weakness inherent in its operating model and assumptions when evaluating future replacement. I think it is fair to say that the world is still waiting for said replacement, and until that arrives, PGP still has a number of valuable properties, one of which being it exists.

mstef10• 9 years ago

the listed examples all exist. signal is already more widely used than pgp ever was in the last 25 years.

acqq• 9 years ago

Have you not written:

"I also do not recommend using a centralized service that keeps your keys on a smartphone. However I warmly recommend using the Signal Protocol whenever messaging is to be done. Signal can be a direct replacement for PGP someone just has to code up the whole thing (time to flesh out signal-cli)."

Can be, someone just.

datatan5• 9 years ago

Thats an impossible statement to prove. Signal is centralized with a concrete list of users. PGP is decentralized with no possible way of knowing how many use it or dont

mc42• 9 years ago

My biggest point of contention with this is... what should replace it? PGP is the current and retroactive psuedo-standard for verification for everything from email to code to builds.

Any replacement would have to be at least semi-compatible, so as not to break the (likely) hundreds of solutions relying on and expecting PGP.

verandaguy• 9 years ago

I used to be skeptical about this... but if the Signal protocol sees more widespread adoption outside of the Signal app and Whatsapp, it could be a good fit.

I'm very open to hearing about reasons why this wouldn't be the case, though.

CaptSpify• 9 years ago

AFAIU, the Signal protocol doesn't work with email, only with sms. Am I mistaken in this?

lmm2• 9 years ago

There are times when you want non-repudiable signatures, times when you want to be able to keep an archive, times when you want your messages to behave more like letters than like spoken conversations. PGP is still the best fit for email-like use cases and long-lived identities; Signal et al don't even try to address that use case.

tptacek4• 9 years ago

This is in fact the problem with trying to write eulogies for PGP. PGP is still a useful tool, just not for the application it was originally intended to: it's a very idea to try to retain secrecy among even small groups of people using PGP-encrypted email.

jwilk• 9 years ago

Very idea?

nickik• 9 years ago

What Keybase does with their new Key model and the way they send encrypt messages is pretty nice. The way they do the public directory is pretty nice, but improvement can still be made.

https://saltpack.org/

bubblethink3• 9 years ago

"Consider your average investigative journalist or whistleblower, with windows or a mac, that they haven't updated because then their kids favorite game doesn't run anymore or they simply don't want windows 10. .... This makes forward secrecy a mandatory requirement, as this implies that the malware has to be constantly active and thus also enhances chances of detection and mitigation."

This is a bit of a straw-man argument. Forward secrecy or not, if you can get root on the client device, you own everything. So if you are a journalist/whistleblower, and have invested the effort to learn PGP, you should use Tails or something more appropriate for your job than windows or a mac.

Edit: This may be a good use case for hardware support for trusted execution (Intel SGX), along with all the other nasty features that it brings (DRM). The threat model for trusted execution is that the OS cannot be trusted whereas the app is sacrosanct.

nemothekid2• 9 years ago

So for those us that need to run Windows/OSX to run software, like Photoshop, for our job, we should just give up on PGP? Seems like a supporting argument for the article then.

verytrivial3• 9 years ago

Your argument comes down to the threat model. A journalist whom also uses Photoshop is free to use whatever system they have sufficient trust in for the nature of the communication at hand.

If they're likely to be killed because someone reads the content of their messages, they should easily be able to weigh that cost against needing to boot of USB every now and again.

So that said, if you use crypto-system X on a machine you cannot trust, crypt-system X will not be able to protect you very much.

TallGuyShort• 9 years ago

You don't have to run exclusively on any operating system. You can use multiple operating systems for different parts of your job, and there's a whole spectrum of convenience / security for how to go between the two that you can choose from.

Bartweiss3• 9 years ago

Traditionally, you should have a second cheap machine running Tails, and do your email through PGP there.

The idea isn't that PGP is compromised on a Windows box with outside software, it's that everything is compromised on that box. Changing algorithm or app doesn't matter if your hardware might be recording every key stroke and sending it through a side channel.

Nadya• 9 years ago

Tails can boot from USB. You don't need to not use Windows/OSX, you just need to boot into Tails prior to using PGP.

Is it inconvenient? Yes. Almost all privacy/security is. Security is largely a series of tradeoffs between privacy and convenience. The more privacy and security you desire - the less convenient everything is going to be.

Burner phones, faraday cages, encrypted harddrives, using cash/bitcoins (which should be purchased with cash), using a VPN over Tor (and not Tor over a VPN). Making sure any phone calls from different locations with none being near work/home, that the call is kept very short and preferably with a short and precise coded language. Cycling your PGP key frequently, and scheduling all electronic communications as to not give any hint of any "active hours".

All of those are inconvenient, but necessary, if privacy and security are desired.

derefr2• 9 years ago

No, you just keep your work computer separate from your whistleblowing/terrorism computer. Productivity and secure+anonymous communications have different needs, and an air-gap between them is pretty much the only way to achieve both.

Luckily, in the modern world, owning a second single-purpose device is really easy: your secure+anonymous communications can be done on a rooted Android phone or a Tails-reformatted Chromebook for ~$150.

theon1442• 9 years ago

Those of you that need (outdated) proprietary software should just give up on security to begin with, PGP or no PGP.

if you can get root on the client device, you own everything.

No security model will protect you from a compromised system.

ori_b• 9 years ago

So for those us that need to run Windows/OSX to run software, like Photoshop, for our job, we should just give up on PGP? Seems like a supporting argument for the article then.

If you're paranoid, run that stuff in a VM. If you're really paranoid, run it on a separate machine.

graycat• 9 years ago

On forward secrecy, at

http://www.google.com/search?hl=en&source=hp&biw=&bih=&q=%22...

I just saw:

In cryptography, forward secrecy (FS; also known as perfect forward secrecy) is a property of secure communication protocols in which compromise of long-term keys does not compromise past session keys. Forward secrecy protects past sessions against future compromises of secret keys or passwords.

Okay.

prance2• 9 years ago

This attitude of "either you really need the security, so make do with whatever inconvenient method is necessary, or just forget about it" is what keeps secure methods out of the mainstream, and thereby from widespread usage. This in turn means that anyone actually using those methods is immediately suspicious. Carrying multiple devices at the airport, or is there a Tails on that USB stick? Let's interrogate!

Also the notion that only journalists/whistleblowers by today's definition need this level of security is wrong. Your "normal", politically active person of today may be the whistleblower of tomorrow. E.g. after a regime change, or just by voting some crazy people into government. I'm living in a country where bloggers are sometimes arrested because of some alleged nonsense. But even in the West, it's nowadays all too easy to just be labelled "terrorist".

So the only sensical way forward is to popularize secure communication methods so that they are normally used by everyday people (including "professionals") with their everyday systems. This increased user base would likely increase the demand to close the existing holes and insecurities of the rest of the system, thereby creating a market force in this direction. And for this purpose, I agree with the author that PGP is not the way forward.

bubblethink3• 9 years ago

I don't have an answer to all your questions, but there will always be a fundamental conflict of interest between privacy & security (of the end user) and market forces. You can hope for more usable systems that are also secure. If you are put off by Tails or usb sticks and different devices, look at QubesOs. They also have a good approach to security, but even they are having a hard time finding hardware that meets their requirements. In the end, you, as an end-user, will have to pick your trade-offs.

platz• 9 years ago

hopefully there'll be more and better tools

Good criticism, but we need an actual plan for "repeal and replace", rather than "hope" for better tools.

sildur• 9 years ago

Agreed, PGP is dead, long live to GnuPG!

dmix• 9 years ago

GPG is still the domain of nerds. But yes, we all still use email and as long as we do I will use GPG with my coworkers who know how.

nickpsecurity4• 9 years ago

Or people that value strong privacy + will tolerate using a command written down on a piece of paper.

krick2• 9 years ago

I started reading to know what's wrong with PGP, but it very quickly escalated to the discussion about making educated bets about cryptography as a whole. I think this is hugely important topic and it is a real shame this is not being discussed more. Maybe security people a more conscious about that (I surely hope so), but general public doesn't seem to be. And by "general public" here I actually mean self proclaimed paranoids and not your grandma or a girlfriend. We talk a lot about if something is proclaimed secure by so-called experts, about theoretical weaknesses of Telegram or something, monitor important 0-days, buzz about how bad it is to give all your private data to facebook or google and how fucked we all are. But we rarely seriously talk about who our adversaries really are, what exactly we are trying to protect and if we're using the right tools for that. About making educated bets. And in the end of the day, this is all it is actually about — making educated bets. Because not all our data, not all our accounts are equally important, and they are not equally important to the different kinds of adversaries. So the only way to be somewhat secure is to recognize, that there's no absolute security and we cannot protect everything. So better start taking it consciously and focusing on what's really important.

zobzu• 9 years ago

Another "I don't think PGP is good enough" and "here's all these things"

Yet none fully replaces PGP yet. Before you actually retire PGP, maybe you need one of these projects to finish a real, complete, reviewed and high quality replacement ;-)

mstef10• 9 years ago

some of these tools actually fully replace pgp (see opmsg for example) however that is actually a very low bar to master. it seems pgp is seen as a silver bullet handling all use-cases like a charm, this is far from reality, actually it fails in many cases, and specialized tools might actually fit the purpose much better, also surpassing pgp in their special niche.

PGP needs to be retired in honor

Related Stories