The PGP Problem (2019)

(latacora.com)

22 points | by croemer 6 days ago ago

26 comments

  • maqp 3 hours ago

    The biggest issue with PGP/gpg is the difficulty of getting rid of it. If you work on big distros, or know someone who works on big distros, please (start asking them to) add https://github.com/jedisct1/minisign to pre-installed packages to facilitate transition. It's almost a chicken egg problem but the sad thing is, no project wants to swap the signing tool to a better one until everyone can verify the new signatures.

    • singpolyma3 2 hours ago

      Note that minisign was also vulnerable in the gpg.fail exposures

      • woodruffw 2 hours ago

        Yes, but not nearly to the same extent. The GPG vulns are staggering in comparison.

  • felipelalli 3 hours ago

    Even though I read so many posts criticizing PGP, it's still difficult for me to find an alternative. He states in the article that being a "Swiss Army Knife" is bad. I understand the argument, but this is precisely what makes GPG so powerful. The scheme of public keys, private keys, revoke, embedded WOT, files, texts, everything. They urgently need to make a "modern version" of GPG. He needs a replacement, otherwise he'll just be whining.

    • schoen 3 hours ago

      There's a section in this post with proposed replacements:

      https://www.latacora.com/blog/2019/07/16/the-pgp-problem/#th...

      I was also frustrated with this criticism in the past, but there are definitely some concrete alternatives provided for many use cases there. (But not just with one tool.)

      • eddythompson80 2 hours ago

        I’m still frustrated by the criticism because I internalized it a couple of years ago and tried to move to age+minisig because those are the only 2 scenarios I personally care about. The overall experience was annoying given that the problems with pgp/gpg are esoteric and abstract that unless I’m personally are worried about a targeted attack against me, they are fine-ish.

        If someone scotch tapes age+minisig and convince git/GitHub/gitlab/codeberge to support it, I’ll be so game it’ll hurt. My biggest usage of pgp is asking people doing bug reports to send me logs and giving them my pgp keys if they are worried and don’t want to publicly post their log file. 99.9% of people don’t care, but I understand the 0.1% who do. The other use is to sign my commits and to encrypt my backups.

        Ps: the fact that this post is recommending Tarsnap and magicwormhole shows how badly it has aged in 6 years IMO.

        • nine_k 2 hours ago

          Has Tarsnap become inadequate, security-wise? The service may be expensive for a standard backup. It had a serious bug in 2011, but hasn't it been adequate since then?

          • eddythompson80 an hour ago

            I don’t know anything that makes me think it’s inadequate per se, but it’s also been more than 10 years since I thought about it. Restic, gocryptfs, and/or age are far more flexible, generic and flat out better in managing encrypted files/backups depending on how you want to orchestrate it. Restic can do everything, gocryptfs+rclone can do more, etc.

        • aniviacat 2 hours ago

          > the fact that this post is recommending Tarsnap and magicwormhole shows how badly it has aged in 6 years

          What's wrong with magic wormhole?

          • eddythompson80 2 hours ago

            It’s just not the same thing. There is significant overlap, but it’s not enough to be a reasonable suggestion. You can’t suggest a service as a replacement for a local offline tool. It’s like saying “Why do you need VLC when you can just run peertube?”. Also since then, age is the real replacement for pgp in terms of sending encrypted files. Wormhole is a different use case.

    • stackghost an hour ago

      The so-called web of trust is meaningless security theatre.

      >They urgently need to make a "modern version" of GPG.

      Absolutely not.

  • nine_k 2 hours ago

    I agree that age + minisign comprise a much neater stack that does basically everything I would need to use PGP for.

    Neither of them supports hardware keys though, as much as I could see. OTOH ssh and GnuPG do support hardware keys, like smart cards or Yubikey-like devices. I suppose by the same token (not a pun, sadly) they don't support various software keychains provided by OSes, since they don't support any external PKCS11 providers (the way ssh does).

    This may reduce the attack needed to steal a private key to a simple unprivileged infiltration, e.g. via code run during installation of a compromised npm package, or similar.

  • shakna 4 hours ago

    Probably resurfacing, because we have some new attacks thanks to CCC. [0]

    [0] https://news.ycombinator.com/item?id=46453461

    • shakna 3 hours ago

      Worth noting: minisign and age were also affected by a couple things here.

      GnuPG has decided a couple things are out of scope, fixed a couple others. Not all is in distro packages yet.

      age didn't have the clearest way to report things - discord is apparently the point of contact. Which will probably improve soon.

      minisign was affected by most everything GnuPG was, but had a faster turnaround to patching.

      • tptacek 2 hours ago

        The minisign bug was much less severe than the (insane) GPG signing bugs, and the age bug wasn't a cryptographic thing at all, just a dumb path sanitization thing. Minisign was not in fact affected by most everything GPG was. The GnuPG team wontfixed one of the most significant bugs!

      • stackghost an hour ago

        The mark of good security is not "has no bugs". It's how the maintainers respond to security-relevant bugs.

  • matted7505 an hour ago

    After reading the PyCon 2016 presentation about wormhole, and say my understanding of channels is correct (that is, each session on the same wireless network constitutes a session). What's stopping a hostile 3rd party, who wishes to stop a file transfer from happening, from spamming every channel with random codes?

  • jairuhme 4 hours ago

    Can the link be updated to not be to the end of the page?

  • brianjlogan 2 hours ago

    Is anyone else unable to read the report on mobile? Completely broken styling for me.

    • nine_k 2 hours ago

      Can't confirm, works fine for me (Android, Firefox).

  • bgwalter an hour ago

    So they recommend Signal. Mike Waltz had to resign over accidentally inviting a journalist to a group chat, and scanning a malicious QR code suffices to allow an attacker to read all your messages. People scan QR codes all the time:

    https://cloud.google.com/blog/topics/threat-intelligence/rus...

    Of course, people here who have recommended Signal are silent about these issues and rather continue to bash gpg.

  • stackghost an hour ago

    Anyone know why GitHub doesn't support signing commits with signify/minisign?

  • bgwalter 2 hours ago

    How does this help people who are not following this issue regularly? gpg protected Snowden, and this article promotes tools by one of the cryptographers who promoted non-hybrid encryption:

    https://blog.cr.yp.to/20251004-weakened.html#agreement

    So what to do? PGP by the way never claimed to prevent traffic analysis, mixmaster was the layer that somehow got dropped, unlike Tor.

    • tptacek 2 hours ago

      You could also say Cryptocat protected Snowden; he used it to communicate with reporters. So, that's how well that argument holds up.

      • bgwalter an hour ago

        https://en.wikipedia.org/wiki/Cryptocat#Reception_and_usage

        "In June 2013, Cryptocat was used by journalist Glenn Greenwald while in Hong Kong to meet NSA whistleblower Edward Snowden for the first time, after other encryption software failed to work."

        So it was used when Snowden was already on the run, other software failed and the communication did not have to be confidential for the long term.

        It would also be an indictment of messaging services as opposed to gpg. gpg has the advantage that there is no money in it, so there are unlikely to be industry or deep state shills.

        • tptacek 17 minutes ago

          Huh? There's no money in anything we're talking about here.