Stop Using Encrypted Email with William Woodruff

WEBVTT
00:00:00.060 --> 00:00:02.491
almost all PGP encrypted emails are larp.
00:00:02.767 --> 00:00:06.758
they're encrypted because, you know, people feel cool, encrypting it, they're like play acting.
00:00:06.788 --> 00:00:10.448
It's like a, you know, Nerf swords version of, of whatever it is they're doing.
00:00:14.670 --> 00:00:21.510
Hello and welcome to Security Cryptography and Whatever I'm your host Tom with.
00:00:23.041 --> 00:00:23.580
am Deirdre.
00:00:24.751 --> 00:00:26.865
Oh, we're running with wrong time.
00:00:27.286 --> 00:00:28.185
I'm always second.
00:00:28.885 --> 00:00:29.786
I'm always second.
00:00:30.451 --> 00:00:31.830
I know, but oh well.
00:00:32.731 --> 00:00:35.011
and with us today is William Woodruff.
00:00:35.310 --> 00:00:37.441
Uh, I spent, I'm a little wrecked.
00:00:37.441 --> 00:00:48.360
I spent the day moving boxes and bookshelves and furniture from my mom's office to clear out some space for her, which is a thing I would rather do than ever read a PGP email message.
00:00:48.691 --> 00:00:55.350
Um, which is what we are here to talk about with William Woodruff today, the secure email ecosystem.
00:00:55.801 --> 00:01:03.301
Um, and I kind of think we should kick this off with the reason we're talking about that this week, which is, uh, I think there was a bug.
00:01:03.901 --> 00:01:06.150
There was a bug this week in open pgp.
00:01:06.421 --> 00:01:06.661
Yeah.
00:01:06.721 --> 00:01:08.790
Oh it was, it was an open PGP js.
00:01:09.210 --> 00:01:10.260
Does anyone know how it worked?
00:01:11.771 --> 00:01:14.251
No, It was malformed packet.
00:01:14.251 --> 00:01:16.346
It was like, it was some kind, it was a packet of confusion of some sort.
00:01:17.406 --> 00:01:19.590
I, I, I was not being serious.
00:01:19.596 --> 00:01:21.930
Do, do you three really not know how this bug works?
00:01:22.230 --> 00:01:26.010
I really do not know how this bug works and I'm excited for you to explain it to me.
00:01:26.430 --> 00:01:27.540
You had one job.
00:01:27.540 --> 00:01:29.850
This is the thing we talked about that you were gonna talk about.
00:01:29.881 --> 00:01:30.480
Oh my God.
00:01:30.811 --> 00:01:31.831
I read the other things.
00:01:32.131 --> 00:01:36.331
told me to read the packet format and I looked at it and I was like, oh, cool.
00:01:36.331 --> 00:01:38.370
The new packet formats from 1998.
00:01:39.510 --> 00:01:46.141
I think we should talk, I think we should talk for a little while, for a very short while about how PGP messages are formatted.
00:01:46.501 --> 00:01:49.771
Can I ask if any of the three of you know how a PGP message is formatted?
00:01:50.105 --> 00:01:50.406
It is.
00:01:51.316 --> 00:01:55.456
Binary data that's been ASE armored and for some reason has a CRC check sum at the end.
00:01:56.671 --> 00:01:58.561
O if only that were the case.
00:01:58.861 --> 00:01:59.085
Oh.
00:02:02.686 --> 00:02:03.316
Go on.
00:02:04.081 --> 00:02:06.521
This is the point where somebody comes in and explains why it's not the case.
00:02:08.131 --> 00:02:14.971
All right, so there's a blog post from, what is it, the name of the, it's a good Find Code and Labs.
00:02:14.971 --> 00:02:16.260
They deserve credit for this, right?
00:02:16.441 --> 00:02:22.441
So they have a vulnerability that allows you to, um, spoof arbitrary open PGP messages as valid.
00:02:22.950 --> 00:02:36.540
Um, and that message opens up with the claim that PGP has a relatively simple packet format and then points to the RFC where they explain the grammar of the PGP packet format.
00:02:37.545 --> 00:02:39.360
RFC 48 80.
00:02:39.991 --> 00:02:41.941
this is RFC 95 80.
00:02:42.181 --> 00:02:42.931
Oh, Um.
00:02:43.621 --> 00:02:48.211
So an open pg p message is a packet or sequence of packets that adheres to blah, blah, blah.
00:02:48.450 --> 00:02:57.961
The following grammar, which is open PGP message, consists of encrypted message or sign message, or a compressed message, or a literal message where a compressed message is a compressed data packet.
00:02:58.020 --> 00:03:00.151
And a literal message is a literal data packet.
00:03:00.270 --> 00:03:02.850
It goes on and on like this, in like a pseudo BNF thing.
00:03:02.850 --> 00:03:05.971
And any of these things can wrap any of these other things.
00:03:06.061 --> 00:03:14.191
So it's like an arbitrarily nested, you know, set of packets, like, you know, type length value packets.
00:03:14.520 --> 00:03:18.230
Um, And, And, the packets have types.
00:03:18.251 --> 00:03:21.675
So this is like every network protocol has like a typed packet format.
00:03:21.675 --> 00:03:24.286
So why, why are we, uh.
00:03:24.346 --> 00:03:30.105
like thi this, like this packet format has apparently been a nightmare for PGP implementers for like a really long time.
00:03:30.466 --> 00:03:43.681
Um, there was like in the, up until like, I guess the late two thousands, somebody's gonna call me on this, but it's some, some, some, somewhere around that timeframe, there was a network of PGP key servers that everyone used.
00:03:44.116 --> 00:03:47.866
Um, there was like a global internet key server network where you could register your keys.
00:03:47.895 --> 00:03:51.195
This is by itself a bad idea and we'll get into why that is later.
00:03:51.436 --> 00:03:52.876
But it existed.
00:03:53.235 --> 00:04:00.151
Um, it stopped idea because the way the, the keys are used, like we have, we have bulletin boards for certain kinds of keys.
00:04:00.151 --> 00:04:01.800
That is not the worst thing in the world.
00:04:02.580 --> 00:04:04.036
Yeah, you're definitely right.
00:04:04.096 --> 00:04:13.501
And we'll get into like PGP as like a. PGP is like a strata for like signing things for like signing packages and things like that versus for secure messaging.
00:04:13.501 --> 00:04:14.070
Right.
00:04:14.161 --> 00:04:25.230
Um, but like, so the thing that takes my understanding is the thing that takes the key server down is a series of DOS attacks on the key server stuff based on packet parsing problems.
00:04:25.230 --> 00:04:32.581
Like there are ways to make the parsing of those packets go quadratic, um, so that you can send like, you know, fork bombs of PGP packets.
00:04:32.730 --> 00:04:35.490
William is nodding, so I think William knows something so I can stop talking.
00:04:35.790 --> 00:04:42.295
Yeah, well, I, the, the main thing that I remember was I think the, the big PGP key server explosion was in, I wanna say 2018 or 2019.
00:04:42.721 --> 00:04:45.346
And that was because That's far too late.
00:04:46.170 --> 00:04:53.550
Yeah, shock shockingly, I, I would say, um, and it was, yeah, they, they, it was, it was trivial to make, uh, both GPG and other PGP backends.
00:04:53.550 --> 00:04:56.790
Not that there's so many, but the other ones as well go quadratic on key paring.
00:04:57.511 --> 00:05:02.790
Um, Which keys in, like, keys in PGP messages are themselves packets.
00:05:02.790 --> 00:05:03.300
Yes.
00:05:03.360 --> 00:05:03.540
Yeah.
00:05:03.540 --> 00:05:08.415
I guess I guess I'm using key interchangeably with what PGP also calls a certificate, but, Mm.
00:05:09.360 --> 00:05:10.350
which is a set of packets.
00:05:11.641 --> 00:05:11.911
Right.
00:05:11.940 --> 00:05:19.440
So like it's, I was gonna say, it's easy to explain and complicated in practice, but it's not even easy to explain, right?
00:05:19.440 --> 00:05:26.100
Because there's a grammar in ten three of that RFC, but then there's like, like 12 different exceptions to the grammar.
00:05:26.100 --> 00:05:31.380
And like all sorts of weird shit happens, and there's just no reason for any of this stuff to exist in the format.
00:05:31.380 --> 00:05:36.511
But it does, uh, it's like a 1990s format that we still live with today or some people do, right?
00:05:36.810 --> 00:05:55.050
And there was an open P pgp JS of vulnerability in the handling of that format, and that vulnerability was, um, you take a valid signed PGP message, um, from anywhere, and you tack onto the end of it, an additional compressed data packet.
00:05:56.370 --> 00:05:57.661
And that is the vulnerability.
00:05:58.711 --> 00:06:02.581
The, so the signature on that message for what proceeded the message is valid.
00:06:02.625 --> 00:06:08.836
It, um, the, whatever the, whatever the hell you tacked into the compressed data packet at the end is not valid.
00:06:08.836 --> 00:06:16.576
It's just a random thing you slap to the end of the message and open P-G-P-J-S returns the data from the unsigned thing that you slapped onto the end of the packet.
00:06:16.906 --> 00:06:17.485
That's the whole bug.
00:06:18.286 --> 00:06:21.526
The whole bug, which is like, I, it's interesting, right?
00:06:21.586 --> 00:06:27.196
'cause this is also like an XML dci SAML vulnerability type situation.
00:06:27.196 --> 00:06:33.886
It's kind of the same idea, or it's a similar vibe as, uh, what's, what's what's called XML signature wrapping.
00:06:34.185 --> 00:06:49.365
Where like in that format, there's this idea that like, you have a single XML document and like a subset of the tree of that document is the signature and kind of the way that HTML has like IDs for like different, like different elements in the document, right?
00:06:49.396 --> 00:06:55.245
The signature in that little, that subset of the document has an ID that points back to the part of the document that's signed.
00:06:55.516 --> 00:06:58.545
Just saying this out loud, you can hear how fucking crazy this is, right?
00:06:58.576 --> 00:07:00.646
But that's how XML dsig works, right?
00:07:00.706 --> 00:07:04.065
But like you sort of give X ML-DSA, pa, you don't give it a pass.
00:07:04.065 --> 00:07:05.685
That's literally the worst format.
00:07:05.940 --> 00:07:08.250
But like literally the worst format that there is.
00:07:08.250 --> 00:07:08.641
Right?
00:07:08.940 --> 00:07:11.521
But like, open PGP isn't XML.
00:07:11.670 --> 00:07:17.071
Like it's not, it doesn't, it's not supposed to have that kind of flexi, it, it doesn't even, it doesn't benefit from that kind of flexibility.
00:07:17.281 --> 00:07:19.560
It's not like an extensible grammar or whatever.
00:07:19.560 --> 00:07:23.850
It's not like, it's not XML, but they manage to re recreate the vulnerability anyways.
00:07:24.091 --> 00:07:32.550
Um, like a funny thing when you see like people in that ecosystem responding to this bug is just like, well, this is an implementation failure, right?
00:07:32.581 --> 00:07:34.141
Like, and it is an implementation failure, right?
00:07:34.141 --> 00:07:36.420
Only open P-G-P-J-S has this bug, right?
00:07:36.810 --> 00:07:39.630
But like, there's the obvious objection to that, right?
00:07:39.630 --> 00:07:43.380
Which is it shouldn't be possible to have this kind of whatever.
00:07:43.591 --> 00:07:44.161
So that's.
00:07:44.701 --> 00:07:50.190
Have, like have you ever read open pg p code?
00:07:50.250 --> 00:08:01.471
Like my, my theory here, I, I did this once, um, when I was trying to figure out like, uh, you can talk to like UB keys through some PGP protocol.
00:08:01.471 --> 00:08:04.016
It's separate from PIV and sometimes like yeah.
00:08:04.321 --> 00:08:09.271
those that lets you do operations that, that aren't exposed in piv like curve 2, 5, 5 19.
00:08:10.021 --> 00:08:14.550
And so I was trying to understand like how open PGP did this at one point.
00:08:15.271 --> 00:08:25.230
And I, you know, I went to grad school, meaning I've dealt with some like bullshit code that wasn't written by me more than perhaps in other situations.
00:08:25.500 --> 00:08:28.831
Um, and PGP was scary.
00:08:30.211 --> 00:08:34.591
Like I could not figure it out like for the life of me, like what the code even did.
00:08:34.650 --> 00:08:38.640
Like, not even like where it taught, just it was very like 1990 C code.
00:08:39.120 --> 00:08:52.110
And I have a feeling that the packet structure is like downstream of some imperative C code that someone wrote Okay, because I was gonna say, like got back solved into some sort of packets format.
00:08:52.770 --> 00:09:02.730
Um, using whatever like style of writing c code was acceptable, popular whatever in 1990.
00:09:03.525 --> 00:09:23.265
I was gonna say like, and r the format seems like it's like miserable and, and would lead to a miserable parser with all these exceptions and like, circular and like, it's like the fact that you have nested, nested, nested like types.
00:09:23.265 --> 00:09:25.635
Like it's a key, but it's also a packet.
00:09:25.635 --> 00:09:26.985
But it might also be a certificate.
00:09:26.985 --> 00:09:31.186
Like I would think it would be the other way around, but I could totally see it being like, no, no, no.
00:09:31.365 --> 00:09:37.306
We have code that resulted in a format, not a format that resulted in this gnarly, uh, parser code.
00:09:37.725 --> 00:09:38.235
I dunno.
00:09:38.750 --> 00:09:43.370
that's, that's my understanding of the history of PGP, is that the, the, the tail wagged the dog in terms of the standard.
00:09:43.370 --> 00:09:52.071
The standard came, well, well, after the set of initial needs were, were established, Ah, so it just sort of grew outta that.
00:09:52.740 --> 00:09:55.806
I, not that I I don't think that's necessarily a bad thing, right?
00:09:55.806 --> 00:09:59.221
Like I think more standards should stuff, but like, you, you wanna start with something good.
00:09:59.806 --> 00:10:00.105
Yeah.
00:10:00.225 --> 00:10:00.765
Yes.
00:10:01.186 --> 00:10:03.615
in, in And usually, the nineties.
00:10:04.096 --> 00:10:04.456
Yeah.
00:10:04.456 --> 00:10:06.765
I, I think the history, the process itself is, is justifiable.
00:10:06.796 --> 00:10:09.181
It's more the, the timing is unfortunate.
00:10:10.214 --> 00:10:10.423
sorry.
00:10:10.634 --> 00:10:28.333
If I recall correctly, like the early versions of like the dot doc file for, for Microsoft Office was just like, um, you just mem copied, like, like, or, or me mapped the struct that they used to represent a document in the program to disc and then like un and mapped it.
00:10:28.634 --> 00:10:36.433
And this had obvious problems, um, for years and vol eventually someone solved it by introducing XML and Doc X.
00:10:37.063 --> 00:10:50.984
But like same, same story I think type of thing where like the format, it's perfectly fine to do things without standards, but like if you're operating under the constraints of the nineties, it's likely that your format is like.
00:10:51.913 --> 00:10:53.624
Uh, a little insane.
00:10:53.624 --> 00:10:59.533
It is not necessarily what it would look like if you, you know, built something without a standard that used a format.
00:10:59.744 --> 00:11:00.208
Um, today.
00:11:00.974 --> 00:11:01.274
Yeah.
00:11:02.854 --> 00:11:09.624
Yeah, I am not sure we've ever like done a proper PGP takedown before, and there's like a lot wrong with PGP.
00:11:10.438 --> 00:11:15.328
Um, like this, like the signature format is crazy.
00:11:15.328 --> 00:11:18.298
The way they handle authentication is crazy.
00:11:18.389 --> 00:11:19.948
Like there's all this crazy stuff in it.
00:11:19.948 --> 00:11:23.188
Like I don't if there's anything like top line important to talk about there.
00:11:23.188 --> 00:11:30.658
I think like generally if you're kind of paying attention to us, I think pretty much everyone here mostly is written off PGP.
00:11:31.379 --> 00:11:43.379
Every time this comes up on a message board, I'm always like, please find me one cryptographer, just one anywhere, any, any cryptography engineer that works anywhere that will stick up for pgp and I'm not sure that exists.
00:11:43.438 --> 00:11:43.889
Right?
00:11:43.979 --> 00:12:00.928
So like, going through the litany of all the things that PGP does not get right, um, is like, I don't know how super productive that is, but I think there's a more important thing which is like PGP has two use cases, right?
00:12:01.229 --> 00:12:05.639
It is a package signing system for packages that people don't check signatures on.
00:12:06.389 --> 00:12:11.519
Um, and it is a secure messaging system for messages that no one will ever care to read.
00:12:12.374 --> 00:12:24.494
Or, or it's, it's a way to encrypt data, but usually that data is a message, not, uh, not like a file for format, although it is also used to encrypt like files.
00:12:25.229 --> 00:12:27.538
Yeah, that's, I mean, that's a fair point, right?
00:12:27.538 --> 00:12:29.278
So it's actually, it's three things, right?
00:12:29.278 --> 00:12:35.729
It's, it's, it's the two things I said, and then it's also like encrypting files and for like a very long time.
00:12:35.759 --> 00:12:49.678
A thing that really pissed me off was that none of the, like, like Mac Os for instance, doesn't have like a tool to just password protect and encrypt a file that you have to download something to do that, which means that people, you know, download, like.
00:12:50.698 --> 00:12:54.839
Whatever the zip program is, and then that's a, its own complete nightmare, right?
00:12:55.109 --> 00:13:03.538
And like for that problem, like you should use age or aga or whatever, how you, however you pronounce Felipe's thing in, in preference to pgp.
00:13:04.109 --> 00:13:11.188
But like the, the big problems with PGP aren't going to screw you if you're just encrypting a file, right?
00:13:11.399 --> 00:13:18.359
Like, I mean, I guess it has a really bad password, K, d, F, so don't password, like, use like a a use a random password or something like that, right?
00:13:18.479 --> 00:13:19.828
But, but that aside, right?
00:13:19.918 --> 00:13:20.548
KDF now.
00:13:23.578 --> 00:13:24.749
I can't remember what it was.
00:13:24.749 --> 00:13:25.859
I just remember that it's bad.
00:13:26.068 --> 00:13:30.239
Um, but like, so, so there's those three things, right?
00:13:30.328 --> 00:13:36.719
But like, I think the, like the, the important thing to talk about is PGP email.
00:13:37.094 --> 00:13:37.423
Right.
00:13:37.423 --> 00:13:49.994
It's, it's, and it's, it's more broadly any attempt to get email to be secure and like this is a thing that has been setting, this is like the fifth thing in this conversation we're having, where I've pointed out that something sets me off.
00:13:49.994 --> 00:13:50.443
Right.
00:13:50.504 --> 00:13:52.183
But this one really sets me off, right?
00:13:52.214 --> 00:13:59.528
Which is like, there's so for obvious reasons, we are in a time period where we're reading lots of security guides for activists, it's a big problem.
00:14:00.178 --> 00:14:04.798
Lots of activists, you know, doing important work and don't wanna be surveilled, right?
00:14:05.099 --> 00:14:17.908
So you've got all these security guides and there's like, there's two really big tells for me when I'm reading these things that like, whoever wrote this was not super plugged in to, you know, serious kind of digital security stuff, right?
00:14:18.178 --> 00:14:21.568
Number one is when they uncritically recommend that people use Firefox.
00:14:21.839 --> 00:14:28.469
Um, I'm fine if you have a, well, a well-reasoned Firefox argument, but if it just says use Firefox, it's open source.
00:14:28.469 --> 00:14:31.019
You don't want to, you know, be up in Google or whatever, right?
00:14:31.288 --> 00:14:33.178
Um, like that's a, a red flag for me.
00:14:33.178 --> 00:14:44.428
'cause that's not, that's not that simple that, but the other thing is, any attempt to get people to use PGP for email, and you see this all the time, like this is like a, a really big recommendation that people try to give people.
00:14:44.428 --> 00:14:53.668
Like, they're trying to get people to do encrypted email and encrypted email is bad, can't be made to work.
00:14:54.239 --> 00:14:58.678
Um, I don't why is encrypted email bad and can't be made to work?
00:14:59.259 --> 00:14:59.458
Yeah.
00:14:59.458 --> 00:15:01.769
You, you, you, you, you can just disagree with me.
00:15:02.219 --> 00:15:09.629
Ba no, no, I'm, I really, I like, tell me, uh, I, I agree with you almost entirely.
00:15:09.808 --> 00:15:15.928
Please tell me, because I literally was to like, scratch my brain and explain this to a normie the other day.
00:15:15.928 --> 00:15:18.658
And, uh, and they were like, well, what, well, why is that bad?
00:15:18.658 --> 00:15:20.788
And, um, and then so on.
00:15:22.288 --> 00:15:25.528
Well, I mean, I think, I think David, so I was talking to Deirdre.
00:15:25.528 --> 00:15:29.249
I saw Deirdre's face and then a blog post that I wrote like five years ago was in my face.
00:15:29.249 --> 00:15:30.089
'cause she pushed the button.
00:15:30.389 --> 00:15:32.519
I think, I think David should, should kick this off.
00:15:32.519 --> 00:15:34.469
Otherwise it's just gonna be me talking this whole time.
00:15:35.458 --> 00:15:35.969
Yeah.
00:15:35.969 --> 00:15:48.688
Well, I, I think we should, uh, go through this blog post, by which I mean, I will read out loud and pretend I am that streamer who shall not be named, um, this blog post called Stop Encrypted email.
00:15:48.869 --> 00:15:50.219
Stop using encrypted email.
00:15:50.219 --> 00:15:51.778
I already screwed up reading it.
00:15:52.259 --> 00:15:54.899
Now you're reading, you're reading it about as well as the YouTuber would read it.
00:15:55.198 --> 00:16:02.068
um, uh, which Thomas wrote, um, in 2020 that I thought this was older than this That doesn't seem right.
00:16:02.364 --> 00:16:07.288
I, I 20 before the It, it has a, it has a timeless, it has a timeless quality about it.
00:16:07.874 --> 00:16:14.234
it does, um, but it begins saying that email is unsafe and cannot be safe.
00:16:14.234 --> 00:16:17.083
The tools we have today to encrypt email are badly flawed.
00:16:17.323 --> 00:16:20.714
Even if those flaws were fixed, email would remain unsafe.
00:16:20.923 --> 00:16:33.568
Its problems cannot be plausibly, be mitigated, avoid using encrypted email, which I think was just Thomas's point I think I write in a way that is difficult for people to read on streaming things.
00:16:34.089 --> 00:16:36.739
Eh, well, we're doing it.
00:16:37.543 --> 00:16:38.293
we're we're doing it.
00:16:38.413 --> 00:16:48.673
Um, and as Thomas noted, technologists hate this argument because few of them specialize in cryptography or privacy, but all of them are interested in it and everyone wants to use encrypted email tools.
00:16:48.913 --> 00:16:54.134
I don't know if by everyone you really mean everyone, but I think you mean people who write guides for journalists online.
00:16:56.232 --> 00:16:57.312
I think it's also nerd currency.
00:16:57.312 --> 00:16:58.552
I mean, I definitely, when I was.
00:16:59.357 --> 00:17:00.643
A, a, a, a teenager.
00:17:00.643 --> 00:17:02.202
I was like, man, this is the coolest thing ever.
00:17:02.202 --> 00:17:09.313
I want to encrypt emails to my friends, which, you know, didn't go well, but it was like nerd credit at the time.
00:17:10.303 --> 00:17:24.522
I think, I think technologists see like, I can make this work in the Golden case and you may be able to do that, but a lot of security and privacy is like, is not the golden case.
00:17:24.853 --> 00:17:27.673
It's the average case or often the worst case.
00:17:27.673 --> 00:17:37.393
And a lot of that comes down to kind of usability and like defaults of the whole system, which is not a technologist sort of thing.
00:17:37.423 --> 00:17:40.663
It's like a usability and design sort of thing.
00:17:41.323 --> 00:17:49.212
And that's not necessarily where our, uh, that has evolved over time with the tools that we have available today.
00:17:49.333 --> 00:17:54.313
And that was not part of how encrypted email came about really.
00:17:54.913 --> 00:18:03.282
Yeah, so we have like the LARP case that Thomas mentions here of just, of what, you know, William was describing of Oh, let's send encrypted emails to each other because it's cool.
00:18:03.942 --> 00:18:05.982
Um, and I set up the software.
00:18:06.792 --> 00:18:16.992
Um, but then we have the case that Thomas refers to going on in which security does matter because messages can be material to civil cases subject to discovery, subpoenaed by law enforcement action.
00:18:17.488 --> 00:18:20.413
All that fun stuff, journalists, confidential sources.
00:18:20.907 --> 00:18:31.038
Um, and in this case you have like actual harms coming, um, where if the message leaks, I think it's fundamentally true that almost all PGP encrypted emails are LARP.
00:18:31.667 --> 00:18:32.087
Right.
00:18:32.278 --> 00:18:36.688
They are, they're encrypted because, you know, people feel cool, encrypting it, they're like play acting.
00:18:36.718 --> 00:18:40.377
It's like a, you know, Nerf swords version of, of whatever it is they're doing.
00:18:40.377 --> 00:18:40.678
Right.
00:18:40.917 --> 00:18:49.887
Um, the, the, the subtext here is like, um, when you talk about how shitty encrypted email is, people are always like, well, what else are you gonna use?
00:18:49.887 --> 00:18:51.387
Like, what's, what's, what's your suggestion?
00:18:51.387 --> 00:18:51.597
Right.
00:18:51.597 --> 00:18:54.268
And if you like, say signal, they'll like, you know, scoff or whatever.
00:18:54.268 --> 00:18:54.597
Right.
00:18:54.867 --> 00:18:57.752
But like, signal was created by the US government, Thomas.
00:18:59.758 --> 00:19:02.998
I, I don't, I don't think that's true, but continuing right?
00:19:02.998 --> 00:19:09.597
Like, um, so, so like you, it always kind of boils down to like, you know.
00:19:10.542 --> 00:19:14.292
Like the choices are sending plain text email or sending encrypted email.
00:19:14.472 --> 00:19:19.363
And so you sound crazy when you tell people not to send encrypted email 'cause it might go wrong.
00:19:19.813 --> 00:19:24.972
The thing I think people need to get their heads around is that those are not the only two choices, right?
00:19:25.182 --> 00:19:31.333
The, the more important choice, like the important third choice is don't send the email to begin with.
00:19:31.542 --> 00:19:31.992
Right?
00:19:32.083 --> 00:19:43.242
Like, if you're coordinating a protest like thing or a direct action or something like that, like there are very good reasons not to trust any secure messaging system with those messages, right?
00:19:43.242 --> 00:19:44.143
Like that's opsec.
00:19:44.442 --> 00:19:49.663
Um, and like almost all of the discussions about secure email don't have that premise.
00:19:49.663 --> 00:19:53.022
They all have the premise that the message has to get sent, right?
00:19:53.053 --> 00:19:54.192
And that can't be true.
00:19:54.967 --> 00:20:02.797
I do think there are some systems deployed out there that are like in our little email system where we control all the ends.
00:20:03.186 --> 00:20:25.237
We require PGP, we require, you know, there's other, there's other things that are kind of like PGP and that, like you have a, a message encryption key that's encrypted under some other key, but it's all still like bolted onto email and you can still send a plain text email and it's really hard to enforce that in practice.
00:20:25.561 --> 00:20:29.756
What stuff is all mostly smm, which is like, Yeah.
00:20:30.056 --> 00:20:30.685
BU's different.
00:20:31.046 --> 00:20:42.955
separate, discuss technology, but like, kind of same concept, but like there are ways to deploy SMM mildly effectively within the context of a single enterprise and get Exactly.
00:20:43.736 --> 00:20:49.675
something maybe out of it, um, out of I, I, I think most of these arguments will.
00:20:49.766 --> 00:20:50.905
Apply to s mine as well.
00:20:52.901 --> 00:20:53.891
Yeah, I would agree with that.
00:20:53.891 --> 00:20:59.641
I mean, SIM is the, the, the basic flaw is, is present in both cases.
00:20:59.711 --> 00:21:05.425
the the only difference is that SIM has the, the benefit of actually having a community, like a standards body that's, I guess, somewhat serious.
00:21:09.401 --> 00:21:21.221
Um, and you can configure like most, I think web like organization like enterprise web mail now to be like, you use SMM and you have to use SMM for emails within my organization.
00:21:21.221 --> 00:21:23.861
And like, here's the key server now.
00:21:23.861 --> 00:21:27.911
Like, does that actually do anything if like the keys are all escrowed somewhere else?
00:21:27.941 --> 00:21:28.361
I don't know.
00:21:28.361 --> 00:21:37.121
But if you're really concerned about the emails existing in plain text on the mail provider server, you can understand why people might like this.
00:21:38.010 --> 00:21:44.560
So you are thankfully giving up on the, uh, premise of just reading this straight through, Yes.
00:21:44.921 --> 00:21:45.730
I appreciate.
00:21:45.790 --> 00:21:46.330
Right.
00:21:46.391 --> 00:21:51.820
So like what I'm gonna do is just introduce the first argument and then let you discuss and tell me if I'm wrong.
00:21:52.330 --> 00:21:52.855
All right.
00:21:53.080 --> 00:22:01.810
So my first argument, no matter whether you're using sime or PGP or the secure email system of the future, you have this problem, which is that.
00:22:02.980 --> 00:22:18.730
Ultimately, if you're using a system that defaults to plain text, wants to send plain text, eventually you're gonna send plain text, which is to say like everybody who's ever used PG p or SM and anger, and at a security consultancy I ran the mid two thousands, we used SM for everything, right?
00:22:18.971 --> 00:22:29.230
Like inevitably somebody will respond to your message with an unencrypted reply, which will include your message that you sent originally encrypted.
00:22:29.800 --> 00:22:33.101
Everybody who has ever used secure email has seen this happen.
00:22:33.520 --> 00:22:41.471
This is a thing if you are, if you're a journalist or if you're like, you know, you know, organizing or anything like that, that can't happen.
00:22:41.471 --> 00:22:44.260
You're talking about like life and death there, right?
00:22:44.351 --> 00:22:49.480
Um, and so the first reason that secure email is completely broken, right?
00:22:49.480 --> 00:22:50.471
Is that that can happen.
00:22:51.161 --> 00:23:08.365
Tell me if I'm wrong, or tell me or I think I think of your, this whole blog post from 2020, this is the strongest argument, and this was also the argument that some people had about the old school variant of, I think it was Signal when it was Text secure.
00:23:08.665 --> 00:23:10.675
Text secure, which was like.
00:23:11.066 --> 00:23:15.151
It was encrypted chat over SMS.
00:23:15.865 --> 00:23:23.665
Um, it was using the best, you know, uh, ratcheting, uh, cryptography on top of the SMS messaging protocol.
00:23:23.665 --> 00:23:30.986
That was the, in the clear, visible to your mobile provider, uh, messaging protocol, uh, to start.
00:23:31.105 --> 00:23:34.496
And that it was definitely like, be careful.
00:23:34.496 --> 00:23:38.695
You can send a end-to-end encrypted chat message on Tech secure.
00:23:39.056 --> 00:23:43.675
Or you may, you know, if you are sending it to the wrong person, you may be sending it in the clear.
00:23:43.766 --> 00:23:59.246
And this is, this is also kind of what I happens in my iMessage to this day, which is like you use one client to send a chat message, but you may or may not know that going to the non iPhone receiver phone number, it will be in the clear.
00:23:59.635 --> 00:24:04.645
Uh, and if it goes to the iPhone receiver or iMessage receiver, it will be end-to-end encrypted.
00:24:05.066 --> 00:24:05.695
Um.
00:24:06.820 --> 00:24:17.800
It's an unfortunate failure mode for like signals way like years and years and years has been all signal clients are end-to-end encrypted.
00:24:17.800 --> 00:24:27.161
There is no accidental sending of a signal chat message or WhatsApp chat message after they migrated their entire client base to end-to-end encryption.
00:24:27.520 --> 00:24:35.861
Um, they originally were SMS, they, they were in a nice space because they were SMS and then they migrated the whole thing to end-to-end encryption.
00:24:35.861 --> 00:24:43.421
Where signal in the very early days was kind of this, you know, possibly both, uh, case, um, but.
00:24:44.125 --> 00:24:45.415
That is impossible with signal.
00:24:45.415 --> 00:24:47.786
Now everything is end to encrypted by default.
00:24:47.786 --> 00:24:48.596
That is impossible.
00:24:48.596 --> 00:24:54.145
In WhatsApp, everything is end to encrypted by default, even though it has a little bit less metadata privacy than signal.
00:24:54.596 --> 00:24:55.826
That is not the case.
00:24:56.125 --> 00:25:03.715
In encrypted email, you might have es IM you might have this PGP, you might have everything nicely done correctly.
00:25:03.895 --> 00:25:07.375
The protocol is still a default plain text protocol.
00:25:07.556 --> 00:25:16.046
You are layering this extra crap on top of a default plain text protocol and it's up to you to never fuck up.
00:25:16.915 --> 00:25:17.455
Like there.
00:25:17.695 --> 00:25:18.145
What is it?
00:25:18.145 --> 00:25:20.036
The, you have to be perfect all the time.
00:25:20.036 --> 00:25:23.125
The adversary only has to get it right once, something like that.
00:25:23.395 --> 00:25:26.125
Or you have to fuck up once and the adversary just has to catch you.
00:25:26.486 --> 00:25:31.675
Um, that's, that's the case for trying to make end, uh, end-to-end crypto email work.
00:25:32.006 --> 00:25:43.346
Um, and it's, we've learned those lessons of why this is bad in other places for secure communication, and it just doesn't seem like we're ever able to make it work.
00:25:44.066 --> 00:25:53.786
Email, signal, WhatsApp, all these other, um, iMessage aside, they aren't on top of the default plain text protocol anymore.
00:25:53.846 --> 00:25:55.645
They completely moved away from it.
00:25:56.276 --> 00:25:59.455
Um, email is still plain text by default.
00:26:00.236 --> 00:26:04.016
So I think this is the strongest part of your, your, your arguments here.
00:26:04.461 --> 00:26:05.310
Yeah, I think.
00:26:06.056 --> 00:26:16.435
Kind of a funny thing that that keeps happening is every once in a while, someone who defends pg p will, will bite the bullet on this and they'll say, well, what we'll do is we'll control the client and we'll force the client not to send plain text responses.
00:26:16.855 --> 00:26:31.705
And that gets to the argument that I've seen Thomas me before, which is that, well, if you're gonna do this entire thing where you build the whole ecosystem around PGP such that you can't use pg p wrong, why not simply do the easier thing and not use PGP given that you're gonna break compatibility anyways?
00:26:32.276 --> 00:26:33.678
Um, yeah, I don't know.
00:26:33.678 --> 00:26:35.417
Like I, I know like that's like the Delta chat thing.
00:26:35.478 --> 00:26:38.718
Like I, I haven't really looked too closely at what they do, but their whole thing is they claim to do.
00:26:38.722 --> 00:26:40.428
They, they, they're the ones who have finally done it.
00:26:40.458 --> 00:26:42.917
They finally cracked the code on encrypted secure email.
00:26:42.917 --> 00:26:48.647
But, um, they do that by, by totally breaking the, the compatibility assumptions in, in email.
00:26:49.262 --> 00:26:59.222
But I mean, the one thing and that like you do that, the one thing that you are retaining from email is the possibility of being compatible with somebody who won't encrypt their messages.
00:26:59.553 --> 00:27:00.992
That's all you've saved.
00:27:01.847 --> 00:27:27.587
also like the sending of messages solution, like I think people are, they want to use the thing that already works, which is like the modality of sending emails, but they want to do it securely and so they, it, it, like, it's so, I can see it being so easy to just be like, well, we just don't send emails.
00:27:27.587 --> 00:27:30.377
It looks like email, smells like email, but it's not email.
00:27:30.978 --> 00:27:38.087
But then people were like, well, why can't I email this person who uses this client who, that it's suppo.
00:27:38.208 --> 00:27:39.617
Like it's not secure.
00:27:39.617 --> 00:27:42.617
It's not set up to take my ex unencrypted email.
00:27:42.617 --> 00:27:44.508
And then you kind of, you're back at square one.
00:27:45.198 --> 00:27:45.488
Yeah.
00:27:45.752 --> 00:27:49.202
Man, I would love it if I couldn't accept email from people so.
00:27:52.053 --> 00:27:53.553
uh, There is that subtext.
00:27:54.002 --> 00:27:55.367
uh, I think there's a lot of like, um.
00:27:56.403 --> 00:27:58.472
I think about this a lot with like, with like, uh, protocols in general.
00:27:58.472 --> 00:27:59.762
There's a lot of like nerd pattern matching.
00:27:59.893 --> 00:28:05.222
People love the username at domain scheme for things, and I think email in that sense is very comforting.
00:28:05.222 --> 00:28:08.762
And so the idea that you can do encryption on top of that is, is, is especially comforting.
00:28:09.198 --> 00:28:14.778
S speaking of, speaking of the thing that users love about this, which is the username at thing, right?
00:28:14.778 --> 00:28:21.887
My second argument, which I think might be stronger than the first argument, so I'm waiting for, uh, you guys to tell me I'm wrong about this, right?
00:28:22.157 --> 00:28:36.468
The second argument is, um, for a serious adversary, you know, if it's a, a, you know, a state level adversary or whatever, the metadata surrounding the message is often, maybe, even usually just as valuable as the message itself.
00:28:36.827 --> 00:28:37.157
Right.
00:28:37.367 --> 00:28:40.548
What they wanna do is roll up the network of who's talking to who.
00:28:40.788 --> 00:28:53.178
They're probably starting from a point where they've got like some particular person or contact that they know they're targeting, and they're just trying to work out what the network is like, who they should, like, expand surveillance to and all that.
00:28:53.208 --> 00:28:53.567
Right?
00:28:53.807 --> 00:28:56.298
So metadata super, super important.
00:28:56.597 --> 00:29:02.417
And email doesn't just like leak the metadata email, like proudly publishes the metadata.
00:29:02.567 --> 00:29:09.048
It's a store and forward system where every time you send a message, the, you know, no matter what you're doing to encrypt the content.
00:29:09.347 --> 00:29:18.917
The funniest thing about this whole thing, by the way, is that PGP email doesn't encrypt the subject editor, which is like the subject, the subject head isn't even metadata, it's just message.
00:29:19.083 --> 00:29:19.278
Right.
00:29:19.278 --> 00:29:22.278
It's just part of the, it's the summary of the message.
00:29:22.577 --> 00:29:22.788
Right.
00:29:22.998 --> 00:29:30.147
But, but that aside, like the, the, the two in the, from of that message and that graph that you build of who's talking to who, like this is.
00:29:30.663 --> 00:29:41.073
The entire reason why Signal asks for your phone number is so they can draft off of your local contact list and not maintain a server side contact list.
00:29:41.252 --> 00:29:51.423
Because if they had that server side contact list, somebody would eventually, you know, target them for it legally or otherwise and get it and then have the entire graph of everybody who's talking on the service.
00:29:51.512 --> 00:30:03.272
By the way, if you use like a secure messaging system where like you go from device to device and you just automatic automatically have the complete contact list everywhere, you should ask yourself how that's working, right?
00:30:03.363 --> 00:30:11.403
Because if the way that works is that they have a server side contact list, they're keeping the whole graph of who's talking to everybody, like server side, just there, right?
00:30:11.613 --> 00:30:24.032
Um, yeah, yeah, they, the iMessage and, uh, apple like migration tooling, and now the signal migration tooling from device to device has like.
00:30:24.512 --> 00:30:32.222
Uh, become a very advanced, to avoid this scenario in particular, they literally take everything on your device.
00:30:32.222 --> 00:30:44.042
You do like a, you do a little bit of a diffy Hillman handshake to make sure that you like, do a daisy chain of, of auth and you're, uh, you know, authorized to move things from a old device to a new device.
00:30:44.313 --> 00:30:46.623
Um, and they go from device to device.
00:30:46.623 --> 00:30:53.462
There's nothing going up in the cloud really, other than like, I am registering a, a new device like at timestamp.
00:30:53.462 --> 00:30:54.363
Like that's kind of it.
00:30:54.843 --> 00:30:57.363
Um, that's going from device to device, if.
00:30:57.708 --> 00:31:06.288
You're not doing that kind of like, you know, kind of little dance protocol between devices and things just show up on your new device.
00:31:06.288 --> 00:31:11.298
It's because they're, it's up in the cloud and maybe there's some sort of password and maybe some of it's encrypted or whatever.
00:31:11.298 --> 00:31:19.248
But, you know, going from device to device and not going up through somebody else's computer, um, is, you know, less risky and less, uh, exposed.
00:31:19.728 --> 00:31:47.387
Um, the other part about the, the contact list being like public and available and subpoena able, or hackable or whatever, um, signal's done a lot of work to like, keep as much metadata about who's talking to who, who's in what groups, what the groups are about the, the profile pictures and, you know, aliases and nicknames of people in groups and between people completely encrypted and private and not accessible, visible to signal the service.
00:31:47.657 --> 00:31:51.438
But that has involved a lot of advanced cryptography that no one else does.
00:31:52.008 --> 00:31:53.178
WhatsApp doesn't do it.
00:31:53.448 --> 00:31:57.048
A lot of these advanced, uh, you know, end-to-end encrypted messengers that aren't.
00:31:57.377 --> 00:32:00.468
Super popular yet they're not quite there yet either.
00:32:00.468 --> 00:32:05.778
Signal has done a lot of work and that was definitely not available when they were kind of up and coming.
00:32:05.928 --> 00:32:19.877
And that's like why the, the bootstrapping of your local contact list of, you know, phone numbers in your phone, um, which is just on your phone and does not get uploaded and, and none of that, um, uh, that occurred.
00:32:19.877 --> 00:32:24.528
And it's sort of like the historical legacy, um, that's, that's kind of inherited into Signal.
00:32:24.587 --> 00:32:38.657
Doing that, doing that syncing privately is a ton of work and Signal may be the only encrypted messaging service that could do it, and they're still not doing it because it's very difficult.
00:32:39.752 --> 00:32:49.083
Like I, it is gonna sound, I think a lot here, like we're just boosting a signal and like the, I'm like the, the really just use anything but email and I don't have this much of a gripe.
00:32:49.083 --> 00:32:49.323
Right.
00:32:49.323 --> 00:32:50.702
It's just email is the problem.
00:32:50.702 --> 00:32:51.063
Right.
00:32:51.228 --> 00:32:52.682
Use use matrix.
00:32:52.682 --> 00:32:53.492
That's fine.
00:32:53.492 --> 00:33:00.488
There's, I, I have like, I have things to say about Matrix, but I think Matrix is generally a well-intentioned and heading in the right direction project.
00:33:00.663 --> 00:33:00.873
Right?
00:33:00.873 --> 00:33:02.613
Like there's lots of different things you can use.
00:33:02.883 --> 00:33:05.163
Um, just email.
00:33:06.093 --> 00:33:08.163
You should, I guess, matter most.
00:33:09.421 --> 00:33:18.151
think also specifically the, the email argument or the rather the metadata argument with email is that email is uniquely profligate with how much metadata it encourages everybody to use.
00:33:18.211 --> 00:33:22.230
Like, Like, all the email clients have emoji reactions now, and those are in metadata.
00:33:22.685 --> 00:33:24.996
And those are also part of the message semantically.
00:33:25.296 --> 00:33:27.365
Uh, but those are now in metadata.
00:33:27.425 --> 00:33:35.961
And so now people I think probably don't realize the five people who both use PGP and Emoji reacts in Gmail, uh, are sending, you know, clear text emojis.
00:33:36.726 --> 00:33:41.300
I hate that and Do we, do we do We know This is, this is, you're breaking news here.
00:33:41.300 --> 00:33:43.611
This is, so how does this work?
00:33:43.611 --> 00:33:45.846
Is it like my matters that, that could attach to Yeah.
00:33:45.846 --> 00:33:51.125
They, they add, I, I can't remember what the Gmail one is, but the, the m phone is like XMS react or something like that.
00:33:51.635 --> 00:33:58.790
And then it's, uh, I, I, I would've to, I would've to look up the exact details, but it's like, You can just off the top of your head, this, you don't actually have to have it.
00:33:58.790 --> 00:33:59.000
Right.
00:33:59.000 --> 00:34:00.951
But is like a, is it like a single line base?
00:34:00.951 --> 00:34:03.201
64 header, like an actual header?
00:34:03.441 --> 00:34:03.840
It's not like the.
00:34:04.445 --> 00:34:05.945
I'm, I'm, I'm pretty sure it's an actual header.
00:34:07.476 --> 00:34:09.576
I can, like, I can imagine like a mime section, right?
00:34:09.576 --> 00:34:14.255
Like it's the, you do the whole, like the, the messages, like this set of mime packets or whatever.
00:34:14.885 --> 00:34:19.385
I believe you, when you say it's a header, I just think that's It's, it, it it may also vary by email provider.
00:34:19.385 --> 00:34:23.735
Is, is the, is the thing that is concerning me is that I think what I'm saying is correct possibly for, for Outlook.
00:34:23.735 --> 00:34:24.876
It might not be correct for Gmail.
00:34:24.936 --> 00:34:30.876
Gmail may do the mime thing, but let me, I, I am trying to actually find this documented somewhere.
00:34:31.295 --> 00:34:34.175
I, hate this so much because emojis are content.
00:34:34.356 --> 00:34:35.291
They are, they are.
00:34:36.246 --> 00:34:38.255
They're the body of communication.
00:34:38.255 --> 00:34:47.016
I mean, you can have an entirely like important, very sensitive conversation just in emoji reacts, because I've done it, I've done it.
00:34:47.838 --> 00:34:53.329
on the argument that metadata is important as content, um, it, it really depends.
00:34:53.329 --> 00:34:56.059
Like some, it's important to protect it.
00:34:56.059 --> 00:34:57.409
It's also difficult to protect it.
00:34:57.438 --> 00:35:09.739
The, the e emoji reacts not being counted as content is just wrong, but like the metadata about who's talking to who at what time and like how long the conversation is and things like that.
00:35:09.739 --> 00:35:15.289
The sub, the subject line that is content that should just be encrypted and the fact that it's not as, as ridiculous.
00:35:15.469 --> 00:35:20.748
Um, but the other stuff, um, it's hard to protect it because a lot of it is like.
00:35:21.304 --> 00:35:24.304
Control flow, like how do we route information?
00:35:24.574 --> 00:35:28.954
Um, even, even WhatsApp has, uh, doesn't encrypt this stuff.
00:35:29.134 --> 00:35:33.393
They, they know who is talking to who at what times and things like that.
00:35:33.423 --> 00:35:42.753
Uh, signal has done a lot of work to not be able to detect a lot of this, uh, but it got better at it over time.
00:35:42.844 --> 00:35:52.653
And the stuff that's subpoena able from Signal is literally like the time that someone registered an account, like the very first time and the last time they contacted the signal service.
00:35:52.653 --> 00:36:02.764
Like that's, they've very proudly put up their, you know, responses to, you know, subpoenas and court orders about like, give me information about X, Y, z, uh, users.
00:36:03.474 --> 00:36:03.824
Right.
00:36:04.474 --> 00:36:08.583
but even if you get it, it, I think there's like.
00:36:09.559 --> 00:36:13.998
This, this has been kind of the evolution of what you can get from devices.
00:36:14.358 --> 00:36:17.688
If you just be like, just try to give me access to devices.
00:36:17.688 --> 00:36:37.128
If you can get access to devices, there's a lot of content, including previously secure, securely communicated, end-to-end, encrypted content on devices or on clouds, especially like iClouds that are not fully, uh, encrypted, backup or other cloud backups, um, that you might be able to get access to.
00:36:37.128 --> 00:36:38.478
And that's really rich.
00:36:38.478 --> 00:36:43.369
And if you can get, get access to that, uh, that's really good stuff.
00:36:43.789 --> 00:36:47.929
If you can't get access to that, the metadata is useful.
00:36:47.929 --> 00:36:51.409
And especially if you're trying to spider out from a target.
00:36:51.409 --> 00:36:58.398
If you're trying to find more people in like a communications network and you're trying to find links, I do think it's important.
00:36:58.759 --> 00:37:00.978
Uh, I don't.
00:37:01.324 --> 00:37:35.494
Quite agree that it is as important as content in the year of our Lord 2025, because there's just so much content available out there from random places, whether it's the cloud or, you know, just give me access to your device, uh, via some sort of like corridor or if you want to be, uh, really, you know, targeted as a specific person, you can try and like target their devices specifically and send them, you know, an attack, um, depending on the security of their device and get everything quote, like effectively everything.
00:37:35.494 --> 00:37:36.853
So, Right.
00:37:36.934 --> 00:37:39.559
I, I think that those are all totally valid points, right?
00:37:39.559 --> 00:37:42.414
Like, um, I think the thing I'm trying to call out about.
00:37:43.224 --> 00:37:48.474
The un salvageability of email is just, if you think about how email works, right?
00:37:48.474 --> 00:37:58.344
Like, um, when you, there's so many places where you can do a dragnet and just collect all of the metadata going through like a message flow for a bunch of people, right?
00:37:58.403 --> 00:38:14.364
Like every every MX hop, whatever, like they're just, the processing of these emails leaves a log trail of who is talking to who, and not just on the central, the one central place that you could potentially protect or whatever, but just like everywhere that the message goes, just like leaving this trail.
00:38:14.664 --> 00:38:23.028
Um, it's also like, to me the, the, like, another important thing here is just that, um, governments are already really good at accessing this metadata.
00:38:23.333 --> 00:38:26.514
They understand SMTP metadata, right?
00:38:26.679 --> 00:38:33.384
Like there's, for a long time there was a, there was a thing that got passed around about like for each of the different messaging services, which what could the FBI access.
00:38:33.713 --> 00:38:35.153
Like, which things could they actually use?
00:38:35.199 --> 00:38:39.414
And it's like with Signal it was like, you know, that you use Signal and then nothing else.
00:38:39.414 --> 00:38:39.833
Right.
00:38:40.259 --> 00:38:47.994
Um, but like the amount of stuff they can mine out of SMT p metadata, I think is a lot more than they can, like they're ready to, to get from anything else.
00:38:48.128 --> 00:38:55.599
Yeah, And, and like every client, just like re-broadcast all the metadata from their perspective at every step.
00:38:55.599 --> 00:38:57.429
And that's like how the protocol works, right?
00:38:57.429 --> 00:39:02.949
You include all the parent responses, you say exactly who you're responding to and why, and like the chain of how you got there.
00:39:03.338 --> 00:39:12.309
And then the provider signs every message to make it clear that the metadata is like real, because everything via, uh, what's that dm?
00:39:12.639 --> 00:39:22.688
Um, uh, and yeah, because everything that we had to build for spam is all about like authenticating the med, allowing servers to authenticate the metadata to each other.
00:39:23.159 --> 00:39:33.523
Can we do like a one minute thing about how you should never take any kind of security advice from anybody who says that De Kim messages should be authentic and like that it's a bad idea to burn de Kim signatures.
00:39:34.963 --> 00:39:36.554
This is very definitely a thing right?
00:39:36.554 --> 00:39:42.403
There are definitely, like, this is how like the, the Hunter Biden messages got authenticated, like they were published with valid deam signatures.
00:39:42.614 --> 00:39:49.228
And it's like you respond to that and say like, well, we should burn the Deam keys so that you can't really authenticate we fought the deep state.
00:39:49.978 --> 00:39:53.039
would never be able to fight the deep state without Deam keys.
00:39:53.804 --> 00:39:59.083
and it's like PE people will say things like, well no, we need to keep these d Kim keys secrets so we can authenticate messages.
00:39:59.293 --> 00:40:03.134
'cause that's how we'll do journalism by like authenticating people's leaked messages.
00:40:03.134 --> 00:40:05.143
And it's like, you are the adversary.
00:40:05.233 --> 00:40:08.023
Like you're, you are being the adversary right now.
00:40:08.954 --> 00:40:14.893
I, I mean, leaking them on the scale of like, you know, uh, rotating them every one month to six months or whatever.
00:40:14.893 --> 00:40:17.443
And then like publishing the old ones, I think.
00:40:17.443 --> 00:40:20.503
Yeah, I don't think we should stop authenticating messages.
00:40:20.503 --> 00:40:21.583
A time of send, right?
00:40:21.583 --> 00:40:27.103
Like, I, for one, enjoy that I'm, my inbox is only like 50% spam and not 95% spam.
00:40:27.554 --> 00:40:27.853
yeah.
00:40:28.034 --> 00:40:36.253
And like 50% spam is like stuff that I signed up for once upon a time and not like boner pills are us or whatever.
00:40:37.364 --> 00:40:46.184
Um, of new sponsor, you do wanna sponsor us and you, you are not boner pills are us.
00:40:46.244 --> 00:40:49.454
Uh, we're trying to hold an event in Las Vegas during blackout Defcon.
00:40:49.903 --> 00:40:53.054
Um, contact us@securitycryptographywhatever.com.
00:40:53.233 --> 00:40:54.793
Uh, are we.com.
00:40:54.793 --> 00:40:55.304
Dot org?
00:40:55.304 --> 00:40:55.934
I me.
00:40:55.994 --> 00:40:57.523
Just, just contact me, figure it out.
00:40:58.048 --> 00:41:00.074
Da David's the one that handles this.
00:41:00.134 --> 00:41:05.849
Um, the, the, just talking me a PGP email, I will not respond.
00:41:06.088 --> 00:41:17.878
I received, I sent, after I defended my PhD, I sent a number of people thank you emails, and then one person responded to mine with A PGP email, and to this day, I still not have read it.
00:41:18.523 --> 00:41:18.824
yep.
00:41:19.753 --> 00:41:26.114
Um, this, this is the way that it stays secure is when you do send the encrypted email, no one will ever be able to decrypt it.
00:41:26.114 --> 00:41:28.543
And so it stays, that part stays secure.
00:41:29.023 --> 00:41:32.233
Um, this is re all this metadata discussion is reminding me that.
00:41:32.503 --> 00:41:36.884
One of the pros of email of, you know, SMTP is that it is federated.
00:41:37.244 --> 00:41:43.153
Um, that is why it's what part of the reason it's leaving this metadata trail, like all over the internet.
00:41:43.483 --> 00:41:51.088
Um, this is like a thing that some people like about the protocol, that I would call it a pro, that it's federated.
00:41:51.088 --> 00:41:52.724
I would simply state that it is federated.
00:41:53.563 --> 00:41:58.903
I have a bigger thing here, which is just, okay, so it's federated and people might or might not like federation.
00:41:59.204 --> 00:42:08.864
This is like a, a long time thing with, uh, um, signal, like Moxie wrote a whole thing about how, why they weren't federated, which really set people off, right?
00:42:08.923 --> 00:42:10.454
And like, I feel like he was.
00:42:11.159 --> 00:42:17.818
Utterly vindicated on that after what happened with Matrix and their attempt to convert from, uh, encrypt, uh, non-encrypted to encrypted.
00:42:18.088 --> 00:42:20.579
Um, but there's a deeper issue here, right?
00:42:20.759 --> 00:42:22.349
Um, people complain about federation.
00:42:22.349 --> 00:42:23.728
Maybe that's a colorable argument.
00:42:23.728 --> 00:42:26.248
People complain about things being open source.
00:42:26.309 --> 00:42:27.748
Maybe that's a colorable argument.
00:42:27.748 --> 00:42:30.688
People complain about running too much stuff through Google.
00:42:30.958 --> 00:42:34.949
Maybe that's a colorable argument, but none of those arguments are about security.
00:42:35.338 --> 00:42:35.759
Right.
00:42:36.059 --> 00:42:45.838
If, if, if the premise is we're creating a transport for messages that are life or death sensitive, then none of that can matter.
00:42:45.958 --> 00:42:58.018
It can't matter whether or not, if so, if you are, if you are talking to, like, if you are talking to an activist community, especially if you're talking to an activist community in some other country, but increasingly in ours as well, right?
00:42:58.168 --> 00:43:02.909
If you're talking to people who are like organizing to protect immigrants from ICE, for instance, or something like that, right?
00:43:03.088 --> 00:43:11.639
And you tell them to use pg p email because the alternatives are not open source or federated enough for you, that's malpractice.
00:43:11.693 --> 00:43:13.199
It's literally malpractice.
00:43:13.199 --> 00:43:17.938
Not in a funny way, not in a dunking way, like you are committing professional malpractice, right?
00:43:17.938 --> 00:43:27.208
You're like, you're putting people at risk to serve your weird goal of being a federated or open source or non Google transport, and that's fucking crazy.
00:43:27.389 --> 00:43:33.119
Like, I don't understand why people look like, why people's jaws don't drop when they see people saying this stuff out loud.
00:43:33.853 --> 00:43:34.143
Yeah.
00:43:35.199 --> 00:44:02.833
I, I think this is now getting into like the crank side of the world, but like I think, I think people sometimes just don't believe that things are actually end, end encrypted and because they don't believe that they then believe contrapositive things, like it should be federated like, well, if they're not gonna end, end encrypted, then I might as well do the federated thing, and this is obviously wrong to me, but I think this is why we get into these weird online arguments as a community over and over again about this stuff Yeah, Yeah, the set, the set of people that think signal.
00:44:03.239 --> 00:44:15.869
Has a backdoor there because it's centralized or because Moxie wrote a blog post they didn't like, or because they think the CEO is like too, whatever.
00:44:16.528 --> 00:44:23.494
Yeah, my next argument, uh, this one is I think, more small ball than the first two.
00:44:23.525 --> 00:44:26.224
I think the third, the, the last one, there's four of them total.
00:44:26.465 --> 00:44:29.224
The last one gets us back to kind of, you know, grand theory stuff.
00:44:29.224 --> 00:44:30.695
This one's really specific, right?
00:44:30.934 --> 00:44:40.715
Which is everybody who uses email has an archive of their email messages, um, which is a thing that secure messengers deliberately go out of their way to not have, right?
00:44:40.804 --> 00:44:44.614
So I can go and search through pretty much every email that anybody's ever sent me.
00:44:44.945 --> 00:44:50.434
Um, going back like a staggeringly far, you know, back time in history and, and my Gmail account, right?
00:44:50.735 --> 00:44:53.795
Um, so all of those things will eventually somehow leak.
00:44:53.824 --> 00:44:58.204
Like every day that you hold that archive, you're incurring some kind of risk that it's gonna leak.
00:44:58.534 --> 00:45:01.324
Um, it's just inevitable that at some point it has to, right?
00:45:01.505 --> 00:45:07.144
So there's no plausible mechanism for doing any kind of disappearing messages in email.
00:45:07.594 --> 00:45:08.135
Um.
00:45:09.019 --> 00:45:13.369
And I think like, that's not like the most super interesting, fun technical topic to talk about.
00:45:13.610 --> 00:45:14.510
'cause it's really simple.
00:45:14.780 --> 00:45:15.289
Right?
00:45:15.349 --> 00:45:20.719
But I think it might be pretty important, um, in terms of actually impacting people's safety.
00:45:21.139 --> 00:45:26.480
Um, just the fact that you can't court, you can't like set a maximum amount of time for a conversation to lift.
00:45:27.039 --> 00:45:27.730
Yeah.
00:45:27.804 --> 00:45:36.489
I, I, I think that's actually like the most important feature for like, quote unquote, like secure messengers for like non activists as well.
00:45:36.730 --> 00:45:46.179
Like, like even iMessage, like you can, if you go into settings, you can set your iMessage to delete after like 30 days, but it's like per device setting.
00:45:46.650 --> 00:45:49.030
Oh, that's can end up with like iMessages that.
00:45:49.030 --> 00:45:59.110
are on one device from like, I just saw some that were over like a year old on this, on, on this laptop, even though I have it set to delete after 30 days on my phone.
00:45:59.800 --> 00:46:12.139
Um, and, and that's not because like it's a life of your death scenario or because I'm an activist, but just because I'm like, I. don't want these messages.
00:46:12.139 --> 00:46:17.570
Like, like I just don't want old shit to like come up and bite me regardless of what it is.
00:46:17.599 --> 00:46:22.730
'cause it's old and like, oh, remember when, you know, David cheered for the wrong football team?
00:46:22.730 --> 00:46:22.969
Right.
00:46:22.969 --> 00:46:33.500
Like, even shit like that, like, it's just like, no, you don't want, um, you don't want that to come, uh, to just like somehow get screenshotted or whatever.
00:46:33.500 --> 00:46:33.739
Right.
00:46:34.112 --> 00:46:45.378
I like the idea that at some point in your past, you cheered for Ohio, I cheered for Michigan State for like a small period of time when I was in high school and my brother was a student there before I had the good sense to become an engineer at Michigan.
00:46:48.152 --> 00:46:48.393
yeah.
00:46:48.393 --> 00:46:51.132
Like I'm in Gmail right now and like Gmail's not.
00:46:51.693 --> 00:46:52.322
I don't know.
00:46:52.382 --> 00:46:54.452
A, a fold, it's a web client.
00:46:54.452 --> 00:47:01.802
It has other, you know, desktop clients, but like, there's no option for me to just like automatically delete things at, at, at any age.
00:47:01.862 --> 00:47:08.822
Like, I can throw stuff in the trash that requires me to take an action and it will auto delete stuff in the trash.
00:47:09.182 --> 00:47:17.253
But like, yeah, I've got thousands and thousands and thousands of emails from many years in my, in all like, and then I've got multiple email accounts.
00:47:17.853 --> 00:47:25.623
And like a co a comeback you can imagine is somebody saying, okay, well they'll just add the feature or you'll use an email client that has that feature, but that's actually not the feature, right?
00:47:25.652 --> 00:47:36.572
The feature is the protocol accommodation where you can communicate to your counterparty that they should also delete these messages, which is something that's like, you could write a signal client that didn't honor that message, but no one's gonna use it.
00:47:36.693 --> 00:47:37.112
Right?
00:47:37.353 --> 00:47:43.353
Um, it's, it's the fact that the protocol kind of, it, it's an accepted feature of the protocol, which it will never be an not true.
00:47:43.382 --> 00:47:48.603
Pete Hegseth will use that signal client, but other than that, no one will use it.
00:47:51.137 --> 00:47:52.068
Pc small group.
00:47:53.757 --> 00:48:04.137
Um, yeah, let, this is sort of like one plus in the, in the kind of the moxie know federate argument that he made.
00:48:04.137 --> 00:48:13.827
And we, we we're linking to the, that post in, in the show notes where the off chance you're listening to this and you don't know who Moxie is, he is the creator of Signal Yeah.
00:48:13.827 --> 00:48:24.088
He, he's the, the primary, the primary creator of Tech Secure and, oh gosh, I forget the name of the, the calling app that he, that then got merged into open Whisper Systems.
00:48:24.088 --> 00:48:24.807
Open whisper.
00:48:24.838 --> 00:48:27.432
e the original, the original think was the app.
00:48:27.432 --> 00:48:31.452
Text Secure was the texting app, And the company was called Whisper.
00:48:31.452 --> 00:48:31.722
Open.
00:48:31.722 --> 00:48:32.293
Whisper.
00:48:32.938 --> 00:48:34.168
yeah, it was Whisper system.
00:48:34.168 --> 00:48:38.507
And then there they were involved with Twitter long ago, and then they.
00:48:38.592 --> 00:48:39.672
Twitter somehow.
00:48:40.288 --> 00:48:55.378
And then like, he made the new open Wi Whisper systems and everything got turned into the signal app and the signal service and everything is, is like a Cano, uh, licensed and open.
00:48:55.378 --> 00:48:58.797
But you know, it's a, it's a, a copy left license.
00:48:58.797 --> 00:48:59.878
So Don't look at it.
00:48:59.907 --> 00:49:02.322
to Yeah, well you can look at it, your gaze.
00:49:02.818 --> 00:49:03.507
yeah.
00:49:04.108 --> 00:49:05.938
Um, so you could run it if you wanted to.
00:49:05.938 --> 00:49:17.907
Everything's there, but you can't, uh, anyway, but, um, because everything is controlled, um, and not federated, they control all the clients.
00:49:17.938 --> 00:49:23.878
They imple implement them themselves, are able to my update and move the protocol forward.
00:49:24.237 --> 00:49:29.367
Um, uh, because they control all the clients and they're able to move faster and they were able to.
00:49:29.773 --> 00:49:39.972
Um, make, uh, automatic deletion and deleting messages for all the parties, all the clients in a chat, for example, a thing.
00:49:40.362 --> 00:49:59.893
And that is so much harder to do when it's like, uh, an open protocol such as something like SMTP, like you can do it, but like, do you have the guarantees and practice that that is going to be implemented, uh, honestly and correctly when it's an open protocol?
00:49:59.893 --> 00:50:08.592
Like, okay, yeah, you may have like a must in this, like delete this message packet header or something like that.
00:50:08.592 --> 00:50:15.282
Delete after, you know, t plus 30 days according to your local clock or delete for in 24 hours and like.
00:50:16.347 --> 00:50:23.637
As I think we all know that like you can put all the musts and must snots in your protocol spec as you, as you want.
00:50:23.637 --> 00:50:29.907
And like people may do their damnedest and sometimes issues happen and sometimes you fail.
00:50:29.907 --> 00:50:34.617
And sometimes there are bugs and sometimes there are bugs in client software when you control all the clients.
00:50:35.097 --> 00:50:53.007
But generally it is less likely that you will have implementation skew, uh, and bugs between interop, independent interoperable implementations of something like a, a delete me flag on a message when you control all the clients and there's only like three of them in the case of signal.
00:50:53.007 --> 00:50:56.847
There's the iOS, there's the desktop, and there's the Android clients.
00:50:57.177 --> 00:51:14.668
Um, that seems like less of a thing that you can do on, on a protocol like SMTP, Yeah, although I'm very curious how ML Slike protocols will do this, but I, the it, it just may be maybe more of the same, of like.
00:51:15.898 --> 00:51:17.128
Try real hard.
00:51:17.248 --> 00:51:20.998
to like interoperate, aside from the one obvious example.
00:51:21.237 --> 00:51:26.907
Um, Well, they really want can implement disappearing messages by implementing disappearing messages.
00:51:26.907 --> 00:51:32.788
And they happen to use FLS with other WebEx Europe is really incentivizing people to actually make it happen.
00:51:35.117 --> 00:51:37.998
Yeah, I, I think I, I mean, a key part about this is, this is not even a cryptography thing.
00:51:37.998 --> 00:51:40.038
Like you can't cryptographically prove deletion.
00:51:40.068 --> 00:51:43.487
This is purely a applica, a protocol and application design matter.
00:51:44.614 --> 00:51:47.494
Right, which makes it interesting that how intractable this is for email, right?
00:51:47.494 --> 00:51:49.985
It's not like, it's not even like there's a theory issue for it.
00:51:49.985 --> 00:51:54.664
It's just like you'll never get something deployed where you can reliably tell somebody else to delete an email.
00:51:54.664 --> 00:51:56.280
So, Yeah.
00:51:58.168 --> 00:51:59.043
uh, last argument.
00:51:59.072 --> 00:52:00.512
Last argument, last argument.
00:52:00.873 --> 00:52:01.472
You guys ready?
00:52:01.713 --> 00:52:02.253
I think we're ready.
00:52:02.762 --> 00:52:04.652
The last argument, long-term secrets.
00:52:04.657 --> 00:52:04.713
So.
00:52:06.077 --> 00:52:08.418
Eventually any secret you hold will also leak.
00:52:08.447 --> 00:52:11.777
This is the forward secrecy thing, which is like forward secrecy.
00:52:11.898 --> 00:52:20.177
If you're talking to people like I'm, I'm imagining I do a lot of local politics and every once in a while I'll get asked about secure messaging stuff from people who are not computer people.
00:52:20.628 --> 00:52:28.293
And I'm trying to imagine explaining forward secrecy to somebody who is not like, 'cause it's not like it's the, the, it's the worst term, right?
00:52:28.338 --> 00:52:34.487
Because it's like, it's not about secrecy going forward, it's about secrecy going backwards, but it's called forward secrecy, right?
00:52:34.577 --> 00:52:42.018
So it's just the idea that every solution that we have for secure email is based on static long-term secrets.
00:52:42.288 --> 00:52:44.358
Um, there's no such thing as an ephemeral.
00:52:44.777 --> 00:52:49.307
You know, email secret exchange, which means that, you know, everything's kind of tack down, like whatever.
00:52:49.307 --> 00:52:59.358
If you're, you know, having ongoing conversations with people, any, at any point if that secret leaks, the entire backlog of everything that you've ever sent is also gonna leak, which is a complete own goal, right?
00:52:59.358 --> 00:53:02.507
You don't have to have that problem in a serious messaging protocol.
00:53:02.507 --> 00:53:05.628
You could just do, you could fix that with ephemeral key exchanges.
00:53:05.777 --> 00:53:07.547
So I think that's also a really big point.
00:53:08.072 --> 00:53:08.282
Yeah.
00:53:08.552 --> 00:53:18.393
And this, this is fundamentally like both how s mime and PGP based, uh, encryption schemes work is you have a encryption public private key pair.
00:53:18.693 --> 00:53:31.382
You push the public key onto one of these key servers, these bulletin boards, and then someone will usually encrypt a message encryption key to your asymmetric public key.
00:53:31.382 --> 00:53:43.907
It's a symmetric encryption key for something like a s. Um, and they encrypt it to you under your public, uh, a, um, like RSA or EC, um, public key encryption scheme.
00:53:44.208 --> 00:53:54.168
Um, and then you decrypt the key with your private key that goes with the public key, and then you decrypt the message with that secret.
00:53:54.677 --> 00:54:03.347
But this is still protected by one key pair that you use over and over and over and over and over again.
00:54:03.557 --> 00:54:11.387
And so while you have a different key per se message or whatever it is, it's still all fundamentally protected by the same key.
00:54:11.927 --> 00:54:18.498
This is not how it works in Signal or WhatsApp or MLS or possibly matter most.
00:54:18.498 --> 00:54:20.297
I'm not, I forget that protocol.
00:54:20.657 --> 00:54:26.987
This is just not what modern encryption messaging protocols are like they.
00:54:27.393 --> 00:54:38.702
Do a new key establishment for every message, and they mix in information from when you set up the session that kind of, that binds to identities to a little bit.
00:54:38.702 --> 00:55:01.112
You attest that you are who you say you are and that this is linked to previous messages, but every message is computed differently so that if any of those previous things leaked, uh, the, like, if any pieces of these things leak, like you are safe, like the previous things are safe, the future things are kind of defunct.
00:55:01.112 --> 00:55:05.432
And like, depending on how the protocols, uh, implemented, it can self heal.
00:55:05.702 --> 00:55:17.402
If you have an honest protocol and you kick out the, you know, the leak at the adversary or whatever, it can heal and then you can get back to that same security level of independent messages.
00:55:17.762 --> 00:55:23.373
Um, having different key material that is just not how it works with BDP email or my.
00:55:24.123 --> 00:55:29.373
I'm gonna read you something and you're gonna tell me when you know who the author of this thing is, don't tell who the author is.
00:55:29.373 --> 00:55:31.507
I don't want to, Okay, but you'll, you'll tell me.
00:55:32.012 --> 00:55:32.228
All right.
00:55:32.313 --> 00:55:32.492
Here.
00:55:32.492 --> 00:55:32.943
Here we go.
00:55:33.753 --> 00:55:34.503
Forward.
00:55:34.503 --> 00:55:38.313
Secrecy is somewhat overrated in end-to-end encrypted messaging.
00:55:38.762 --> 00:55:44.402
Most people do not want a truly off the record experience, but instead keep their messages around.
00:55:44.402 --> 00:55:53.702
Definitely, as long as those old messages exist and are accessible to the user, they'll be just as accessible to any attacker who gets access to the secret key material.
00:55:54.438 --> 00:56:01.097
The signal protocol somewhat excessively provides forward secrecy for each and every message sent.
00:56:01.547 --> 00:56:05.057
This is sort of pointless while the messages still exist on the screen.
00:56:06.472 --> 00:56:07.012
Uh, I.
00:56:07.788 --> 00:56:13.007
I, I knew after the first sentence, and I, you still don't want me to say who it is Now you can, you can in the abstract.
00:56:13.307 --> 00:56:13.757
okay.
00:56:13.967 --> 00:56:19.907
Uh, this, this is, this is one of my, my favorite people on the internet, uh, is who it is.
00:56:20.898 --> 00:56:25.907
Uh, someone who I've, I've talked with many times, or rather I don't even talk with, is maybe not the right way to say it.
00:56:25.907 --> 00:56:30.887
Exchanged missives with, I, he, he does a valuable service.
00:56:30.887 --> 00:56:31.068
Right?
00:56:31.068 --> 00:56:35.177
So it's, this is a commenter on Hacker News who is like the designated defender of pgp.
00:56:35.177 --> 00:56:35.568
Right.
00:56:35.568 --> 00:56:45.438
And like, um, it's actually pretty valuable like having like something like this be written 'cause it forces you to kind of refine, like he has a whole spiel about why authenticated encryption is not always good.
00:56:46.188 --> 00:56:47.088
Which is like, it's real.
00:56:47.117 --> 00:56:49.068
I can't, I can't even remember what the argument is, right.
00:56:49.068 --> 00:56:50.597
It's, it's hard to get your head around.
00:56:50.597 --> 00:56:56.027
Like it's something about, it was something about like, um, recovering, corrupted messages.
00:56:56.717 --> 00:57:02.208
Like what most users want is messages where if there's like a bit flip failure or something like that, they can like, recover it or something.
00:57:02.208 --> 00:57:05.268
And authenticated encryption makes that break down or something.
00:57:05.628 --> 00:57:08.628
Um, but it's like having to articulate why.
00:57:08.628 --> 00:57:12.197
Of course you need, you know, authenticated encryption everywhere is actually kind of valuable.
00:57:12.557 --> 00:57:17.597
Um, it's just the amount of like back rationalizing you have to do to keep pgp like kind of in the story.
00:57:18.197 --> 00:57:18.378
Yeah.
00:57:18.438 --> 00:57:23.088
And he has, he has a couple of posts that are not like in or not, they're not entirely nonsense.
00:57:23.088 --> 00:57:25.728
Like he has one about like 20, 48 bit RSA, like.
00:57:27.288 --> 00:57:27.947
It is fine.
00:57:28.277 --> 00:57:31.668
Is, is I think, the point of his argument and it's like, you know, is it good?
00:57:31.668 --> 00:57:32.898
I, I would say it's not good.
00:57:32.898 --> 00:57:35.208
It's something that I would, I would, I mean, I would, I would do a default.
00:57:35.717 --> 00:57:36.197
Bad.
00:57:36.318 --> 00:57:36.588
Bad.
00:57:36.588 --> 00:57:36.797
No.
00:57:36.797 --> 00:57:39.793
For any RSA, but like, is it the worst thing in the world?
00:57:39.972 --> 00:57:40.193
No.
00:57:41.492 --> 00:57:53.793
Uh, Like, there's, there's strong arguments within like the, you know, uh, proper cryptographic community about how much, how big these parameter sets really need to be.
00:57:53.822 --> 00:57:59.822
Like a lot of them are arguments about symmetric primitives, like some of the new stuff that's based on ketch.
00:58:00.512 --> 00:58:06.543
Uh, if you want to, uh, look up Too Much Crypto, by JP Aumasson, he makes some nice arguments about.
00:58:06.858 --> 00:58:17.958
The bounds that we need in practice against known adversaries and the best known attacks, uh, so that we can arguably get just as much security with smaller parameter sets, blah, blah, blah.
00:58:18.228 --> 00:58:29.418
I don't know if that applies to RSA 2048, but there are good faith, uh, well-founded debate about other cryptographic primitives and sizes and things like that.
00:58:29.583 --> 00:58:39.992
Um, arguing that like you, like just don't have good forward security or post-compromised security, um, just because you don't, you don't really need it.
00:58:40.172 --> 00:58:55.112
Um, that that's fundamentally just like giving so much Lee power to a possible attacker of just like, again, they only have to be right once and you have to be right over and over and over again.
00:58:55.112 --> 00:59:00.902
And having these forward, forward secrecy and post-compromised security protocols make it so that.
00:59:01.682 --> 00:59:07.862
The adversary basically has to, it gets reset almost every time you send a message practically.
00:59:08.193 --> 00:59:29.088
Um, it just makes it a lot, lot, lot, lot harder for someone to just, you know, take all the public information you're sending in these cipher texts and like get a good crack at like Well if, if you assume every, uh, via I Thomas's, I think principle too was that every PGP message ends up getting sent in plain text anyway.
00:59:29.507 --> 00:59:32.538
Um, you don't need forward secrecy then.
00:59:35.253 --> 00:59:36.302
There's look.
00:59:36.378 --> 00:59:37.523
it will simply leak.
00:59:38.463 --> 00:59:45.483
So there's like, there's a kernel of like a, you know, a useful conversation in that, in that argument that he has.
00:59:45.483 --> 00:59:45.753
Right.
00:59:45.753 --> 00:59:49.413
Which is like, you know, people don't, people are gonna keep their messages around anyways.
00:59:49.413 --> 00:59:50.672
So what does forward secrecy matter?
00:59:50.672 --> 00:59:58.143
And it's like there's some truth to like, you know, I have an archive of emails going back to like, whenever Gmail started apparently.
00:59:58.143 --> 00:59:58.382
Right.
00:59:58.382 --> 00:59:59.822
Like, and I just, I don't care.
00:59:59.882 --> 01:00:03.333
Like I'm, I'd rather have them around than like opsec them out.
01:00:03.333 --> 01:00:03.543
Right?
01:00:03.543 --> 01:00:06.512
Like, when I'm, I, I just don't use email for stuff that, that would matter for.
01:00:06.512 --> 01:00:06.902
Right.
01:00:07.143 --> 01:00:13.818
So like, the thing to, the thing to note here is like, it's fine to say that email is fine for some kinds of conversations.
01:00:14.043 --> 01:00:17.523
Like, it's fine to say that, like, I'm not saying don't ever use email.
01:00:18.172 --> 01:00:19.103
Use email, that's fine.
01:00:19.103 --> 01:00:20.362
I use email for all sorts of things.
01:00:20.362 --> 01:00:20.663
Right?
01:00:20.873 --> 01:00:22.402
Just don't use encrypted email.
01:00:22.608 --> 01:00:25.253
Don't like try to send secure emails to people.
01:00:25.253 --> 01:00:25.612
Right.
01:00:25.762 --> 01:00:31.402
We get in trouble when we try to make this one system that we all like serve life and death use cases.
01:00:31.733 --> 01:00:49.432
And if you can't, like if you can't articulate a threat model, like if you don't, if you, first of all, if you don't know how to articulate a threat model, but like if you can't like just roll, rattle off what the different threat models are for people protecting immigrants from ICE versus people chatting with people they met on Hacker News or whatever.
01:00:49.432 --> 01:00:49.702
Right.
01:00:49.702 --> 01:00:52.253
Like then you shouldn't be giving people advice.
01:00:52.253 --> 01:00:52.523
Right.
01:00:52.523 --> 01:00:59.932
And this brings me back to just like digital security guides for activists and things like this where there's clearly no threat model in this stuff, right?
01:00:59.932 --> 01:01:03.983
Like it's just, it's not based on an understanding of who their adversaries are.
01:01:04.163 --> 01:01:08.032
And what's really frustrating about that is the real advice is not that complicated.
01:01:08.063 --> 01:01:12.592
It's not like, this is just not that, like we don't have the sophistication that we need to give people good advice.
01:01:12.773 --> 01:01:16.313
It's just you need people to just be able to say like, just use signal.
01:01:16.697 --> 01:01:17.148
Right.
01:01:17.297 --> 01:01:18.708
Forget about all the politics of it.
01:01:18.708 --> 01:01:21.677
Forget about like whatever you think about Moxie Marlinspike or federation.
01:01:21.677 --> 01:01:23.297
Just, just use Signal, right?
01:01:23.358 --> 01:01:25.277
Um, probably don't use Firefox.
01:01:25.338 --> 01:01:26.327
You know, just things like that.
01:01:26.628 --> 01:01:32.958
Um, which again is just like this whole thing right now for me is just my red flags for digital security guides.
01:01:32.987 --> 01:01:35.527
One of them being anybody talking about PGP.
01:01:35.842 --> 01:01:36.063
Yep.
01:01:36.362 --> 01:01:56.251
And like number one for me, a lot of people when you're making recommendations of like how to stay, how to, how to achieve digital security, uh, trying to achieve a goal, you're trying to organize, you're trying to keep, keep your team secure, you're trying to serve some community.
01:01:56.612 --> 01:02:00.871
Um, it needs to be easy to use and easy to get right.
01:02:01.172 --> 01:02:04.952
It can't be, make sure you use super special client.
01:02:05.012 --> 01:02:07.742
Oh, you know, it might not be available on this phone.
01:02:08.041 --> 01:02:10.472
Oh, like you have to make sure you tick this box.
01:02:10.472 --> 01:02:11.762
You have to add this extension.
01:02:11.762 --> 01:02:14.461
You have to do X, y, Z to make sure that you use it right.
01:02:15.541 --> 01:02:16.472
That's bound to fail.
01:02:16.532 --> 01:02:20.492
One, it's bound to fail because it's hard to get right and so you might actually get a security failure.
01:02:20.492 --> 01:02:23.791
Two, it's a lot of work for people to do.
01:02:24.271 --> 01:02:29.521
If the other of the alternatives are download signal, we will add you to the chat.
01:02:30.601 --> 01:02:39.422
That's so much easier to one do period and get right, because you don't have to do a bunch of extra steps to get it right and achieve better security.
01:02:39.864 --> 01:02:56.094
yeah, I feel like a lot of people are just trying to, uh, they have their values and they're trying to say, oh, you should do X, Y, Z because this is, this, uh, aligns with my values as opposed to people trying to achieve something in the real world.
01:02:56.213 --> 01:03:03.324
And if it's too complicated and it takes too much work to achieve good security, they're not gonna do it.
01:03:03.384 --> 01:03:12.083
Or if they try to do it, they will fit, they will fail and they'll open themselves up to a vulnerability and like, and then what's the point of the technology in the first place?
01:03:12.572 --> 01:03:27.286
and one, one thing I kind of wanted to point out is like, oh, if you're, if you've got an archive of all your messages forever and theoretically your messages will just leak because they're around forever and you know, so what's the point of, of forward security and, and like what one.
01:03:27.996 --> 01:03:29.766
It's a belt and suspenders things.
01:03:29.766 --> 01:03:33.126
It's the Swiss Swiss cheese approach of security and systems.
01:03:33.126 --> 01:03:34.956
It's not any one thing.
01:03:35.286 --> 01:03:41.795
It's if you don't have forward security, you are more vulnerable to one of these things going wrong.
01:03:42.005 --> 01:03:46.835
An adversary, you know, pointing one of these keys or a key server or whatever it is.
01:03:47.195 --> 01:03:49.476
Um, well the key one of these keys.
01:03:49.806 --> 01:03:51.695
Um, and then everything falls apart.
01:03:52.056 --> 01:03:58.385
But if you don't have a giant me, you know, message archive, like, you know, the, the blast radius is, uh, less bad.
01:03:58.385 --> 01:04:02.465
And like if you don't have all this metadata, then like the blast radius is, is less bad.
01:04:02.795 --> 01:04:06.215
It's all of these things to together are pretty fucking bad.
01:04:06.755 --> 01:04:11.856
If any one of these things was less bad, then it would be less bad.
01:04:11.856 --> 01:04:18.456
If all anyone, if any of these things were less bad together, we probably wouldn't be talking about this, uh, at all.
01:04:18.456 --> 01:04:21.275
But they are all pretty bad together.
01:04:21.576 --> 01:04:24.485
So the forward security, you know.
01:04:25.175 --> 01:04:27.666
Just don't try to do encrypted email, use signal.
01:04:27.666 --> 01:04:28.385
Use WhatsApp.
01:04:28.746 --> 01:04:31.025
Like some people don't like WhatsApp for reasons.
01:04:31.356 --> 01:04:34.476
Using WhatsApp is way better than trying to use encrypted email, in my opinion.
01:04:35.076 --> 01:04:37.820
Yeah, It's also like the only way to talk to people in Europe.
01:04:38.121 --> 01:04:41.083
Yeah, I, I was blown away by that.
01:04:41.083 --> 01:04:52.063
Every time I, I go somewhere that is, especially like Southern Europe or Northern Africa, it's like people will just message me randomly on WhatsApp and I will have no idea who they are, but better than anything else possible.
01:04:52.092 --> 01:04:52.572
It's awesome.
01:04:53.135 --> 01:04:53.315
yeah.
01:04:53.692 --> 01:04:58.356
Use signal, use WhatsApp if you need to encrypt files, use Tor.
01:04:59.092 --> 01:05:04.972
yeah, if you need to use Tor, install the Tor browser, then you're done.
01:05:05.362 --> 01:05:07.012
It's a good, it's based on Firefox.
01:05:07.101 --> 01:05:09.862
It's a pretty good browser, Huh?
01:05:10.356 --> 01:05:12.626
Did, didn't we just tell people not to use Firefox?
01:05:13.847 --> 01:05:14.027
wait.
01:05:14.027 --> 01:05:14.356
Hold on.
01:05:14.896 --> 01:05:15.286
Hold on.
01:05:16.757 --> 01:05:23.177
William, are you gonna respond to this or am I Oh, Actually, I think can't, I can't tell if dear, just trying to make my brain pop.
01:05:23.617 --> 01:05:26.597
Sorry, but the Tor just not ironically.
01:05:27.336 --> 01:05:30.251
the Tor browser, is like it's, everything's set up.
01:05:30.251 --> 01:05:30.961
Everything's good to go.
01:05:31.552 --> 01:05:36.487
And I think the other options are less less tailored, but sorry.
01:05:36.786 --> 01:05:45.532
Yes, I said that I, I'm guessing for reasons that you're probably familiar with Dan Guido's argument about why the tor browser bundle is the literal least safest browser to use in the world.
01:05:46.876 --> 01:05:48.862
I, I, I've definitely heard him make the argument before.
01:05:48.862 --> 01:05:49.956
I, I can't remember off the top of my head.
01:05:50.572 --> 01:05:56.556
So, so it's, it's, it's a combination of things where it's like, so first of all, you're using torque.
01:05:57.277 --> 01:06:02.347
Right, which, like from a traffic analytic perspective, you can see that somebody's using Tor, right?
01:06:02.586 --> 01:06:18.996
You are using Firefox, which is the least secure of the mainstream browsers, and you're using a fork of Firefox, like a tracking fork of Firefox, and you're collapsing all of the Firefox vulnerabilities down to a very small set of tor browser bundle targets.
01:06:19.416 --> 01:06:29.646
Um, so like the exploits that you need for that, like you, you, you, like a serious adversary needs like a battery of exploits for like all the different versions, whatever they're using, but they don't need that for tor browser bundle people.
01:06:30.172 --> 01:06:30.472
Hmm.
01:06:31.043 --> 01:06:43.530
Yeah, I've definitely heard it make that argument before and I, I mean, I find it convincing, especially for, I mean, I, I, I think it was, it was especially true maybe 10, 12 years ago when the state of Firefox container or isolation was, was really, really bad.
01:06:44.490 --> 01:06:47.280
It's been a long time since, since I've looked at browser security and so.
01:06:48.240 --> 01:07:00.121
I would say Firefox has come a long way, especially in terms of sandboxing and a lot of memory safety integration into, into the whole stack.
01:07:01.005 --> 01:07:05.280
I think arguably Safari is less good than Firefox at this point.
01:07:05.851 --> 01:07:07.650
For some of those reasons.
01:07:08.221 --> 01:07:18.630
Um, but yes, if you're, if you're using, if you're using to browser, you are a little bit sticking out in terms of, you know, fingerprinting and all that sort of stuff.
01:07:19.231 --> 01:07:24.541
Um, in terms of, I don't think we're, we're really selling people.
01:07:24.570 --> 01:07:38.161
You should use Tor, we're mostly doing the meme of use signal, use Tor, and if you, if you wanna use Tor, like downloading the to browser and just using it is like the easiest, straightforward way to do that.
01:07:38.791 --> 01:07:45.376
But yeah, just nevermind Is this is, it's, it's not a super strongly held opinion of mine.
01:07:45.376 --> 01:07:57.751
It's just a, it's like, it's, it's an argument I've had beaten in for me, in, into me by, uh, Dan Guido and the Grugq Uh, but if, if you use safari, you get to use the best named mitigation ever, which is the giga cage.
01:07:58.291 --> 01:08:00.630
the the if the giga cage gig?
01:08:00.786 --> 01:08:01.766
Oh, giga Cage.
01:08:02.161 --> 01:08:02.581
yeah.
01:08:03.070 --> 01:08:03.831
I want to gig a cage.
01:08:03.960 --> 01:08:10.920
this is my favorite mitigation ever added to a browser, uh, which is, uh, people kept using Ray Buffer for exploits instead of safari.
01:08:11.221 --> 01:08:24.661
And so what they did was they put every, um, uh, they put the, the backing store for all of, for a ray buffer into a, uh, uh, and mapped four gigabyte key region and made all, uh, offsets 32 bed.
01:08:24.780 --> 01:08:26.730
So you just can't escape that region.
01:08:27.131 --> 01:08:31.860
This is, this is a Dan Kaminsky idea from like the mid two thousands.
01:08:32.280 --> 01:08:36.390
This was like his big memory, like his big memory safety thing was 64 bits.
01:08:37.171 --> 01:08:37.591
yeah.
01:08:38.190 --> 01:08:43.860
this is also how the V eight sandbox works as well as, it's a little part of it.
01:08:43.980 --> 01:08:57.855
So like the, the V eight sandbox is a little more than that, but to make the, the memory regions work, they have a variety of slightly larger than four gigabyte regions that are only addressed in 32 bits that you, you can't get off of, um, cool.
01:08:58.261 --> 01:09:02.055
in theory, but like then, then there's a bit more to it There's always, yeah.
01:09:02.685 --> 01:09:10.036
We're only gonna find out over the next 20 years that Dan Kaminsky was literally right about everything, just in like subtle ways.
01:09:10.550 --> 01:09:15.289
someone has one of those Wall Street Journal dot profile pictures.
01:09:15.965 --> 01:09:16.805
The stipple painting.
01:09:17.119 --> 01:09:17.539
Yeah.
01:09:17.539 --> 01:09:22.640
the stipple painting you, they just, that just makes you correct about everything.
01:09:23.585 --> 01:09:25.625
I was, I was wrong to doubt the Stipple painting.
01:09:26.011 --> 01:09:27.390
Rip, rip Dan Kaminsky.
01:09:28.636 --> 01:09:28.966
Yes.
01:09:30.094 --> 01:09:44.764
Alright, so I'm gonna go, I'm gonna go install some random mass PGP extension in my browser, and I'm just gonna start sending the, the wrap up for this, uh, recording with an an encrypted email.
01:09:45.363 --> 01:09:47.684
Um, I hope you make sure you use Tor browser.
01:09:48.394 --> 01:09:48.604
huh?
01:09:48.904 --> 01:09:49.444
Yes.
01:09:49.503 --> 01:09:51.514
e armor of the episode notes.
01:09:51.559 --> 01:09:52.429
Yeah, Yeah.
01:09:52.429 --> 01:09:52.759
Yeah.
01:09:53.304 --> 01:09:56.184
I want, I want it Cast5, the official Canadian block Cipher.
01:09:56.913 --> 01:09:57.094
right.
01:09:57.109 --> 01:10:03.498
Uh, and apologies to the person who sent me that PGP email on the off chance you're listening because it's kind of identifiable.
01:10:04.819 --> 01:10:06.248
Maybe it was a really mean email.
01:10:07.609 --> 01:10:08.149
Could have been.
01:10:08.149 --> 01:10:08.838
Who knows.
01:10:09.747 --> 01:10:10.136
all right.
01:10:10.226 --> 01:10:10.556
Yep.
01:10:10.737 --> 01:10:17.247
Uh, if you can stop using encrypted email and stop, stop telling people to use encrypted email.
01:10:17.247 --> 01:10:22.136
It's just not, not good in our opinion.
01:10:22.856 --> 01:10:28.346
Good note, Deirdre, Yeah, cryptography, whatever is a something of who?
01:10:28.346 --> 01:10:30.987
With, of wait.
01:10:30.987 --> 01:10:34.016
It's, it's a side project of you, you, me, and David.
01:10:34.287 --> 01:10:34.827
Yeah.
01:10:35.676 --> 01:10:36.167
exactly.
01:10:36.822 --> 01:10:41.992
And our editor is Netty Smith and we sell merch at merch dot securitycryptographywhatever dot com.
01:10:42.011 --> 01:10:45.551
And we thank you for listening and we thank William for coming on this episode with us.
01:10:46.452 --> 01:10:48.042
William, thank you very much.
01:10:48.242 --> 01:10:48.532
Yeah.
01:10:48.532 --> 01:10:48.837
Thank you.
01:10:48.837 --> 01:10:49.197
for having me.
01:10:49.662 --> 01:10:50.322
Bye.