News for hackers. Stuff that matters.
Re:Stop Using Encrypted Email by joshuamorton on Thursday February 20, 2020 @04:17AM (#22373789)
There are schemes that make it difficult for a recipient to accidentally disclose your information. PGP isn't one of them. For example a common enough way of doing PGP is to use a chrome extension that PGP-ifies your webmail. Or to use an encrypted mail service like protonmail or tutanota. In all of those cases, assuming the mail provider is untrustworthy enough that you feel the need to use e2e encryption, they can also just inject JS to steal your plaintext from the client, so you aren't really secure unless you're using an imap client, which by definition you aren't doing.
Re:Stop Using Encrypted Email by buzzkillington on Thursday February 20, 2020 @04:41AM (#22373869)
>You don't. The same way that you don't ensure your recipient doesn't leak screenshots of signal conversations to icloud.

Again, if your counter party is an idiot nothing will save you.

Re:Stop Using Encrypted Email by joshuamorton on Thursday February 20, 2020 @05:02AM (#22373950)
Good protocols prevent people from shooting themselves in the foot. A good protocol will get in your way if you try to do something insecure. PGP doesn't do that, see "oops I accidentally forwarded the plaintext of my encrypted email" vs. Gmail and Outlook's "confidential" modes, which prevent accidental exfiltration via forwarding or copying. They're possible to circumvent, but you have to make an effort to do it.

PGP requires that you not only not be careless, but be near-perfect, and that every counterparty does the same. Good protocols prevent you from making mistakes that spew your plaintexts everywhere.

In other words, I want a protocol that doesn't necessarily protect me from idiots, but does protect me from humans who occasionally act imperfectly.

Re:Stop Using Encrypted Email by blacklion on Thursday February 20, 2020 @06:36AM (#22374333)
It is not problem of protocol. It is problem of user agent. And, yes, all webmails is incredibly crappy user agents. Stop using webmails!

On the other hand, UA (for any protocl) which will not allow copy'n'paste from is crappy by definition and nobody could stop your recipient to copy'n'paste plain text from your message. Ultimately, it is THEIR message as much as YOUR message!

On the side note, I think that GMail is worst thing that has happened both to the web and to e-mail.

Re:Stop Using Encrypted Email by joshuamorton on Thursday February 20, 2020 @07:01AM (#22374430)
Secure protocols ensure that user agents are secure, as part of the protocol.

A secure protocol would, for example, not mix plaintext and encyrpted text messages, but would ensure that all messages were always encrypted. This way a we'll designed user agent couldn't accidentally mix cypher and plaintext messages.

I'm not arguing that UAs should do user hostile things in the name of security, which is the straw man you're arguing against. Nor did I mention anything webmail specific.

I'm saying that a security protocol shouldn't have, in practice, fail open attributes that user agents have to put warnings up about. A good protocol should allow the UA to entirely hide those dangers.

This is abundantly clear if you try to use any pgp mail client vs any signal protocol client. The protocol makes it easier for UAs to be both more secure and more user friendly.

Re:Stop Using Encrypted Email by GoblinSlayer on Thursday February 20, 2020 @06:49AM (#22374382)
People don't share information in text anymore, they share screenshots and screen photos, it's infuriating.
Re:Stop Using Encrypted Email by upofadown on Thursday February 20, 2020 @03:45PM (#22378435)
>For example a common enough way of doing PGP is to use a chrome extension that PGP-ifies your webmail.

You mean mailvelope[1]? That's a straight up plugin/extension. It gets installed once and is as secure as whatever is used to secure extensions on a particular browser.

[1] https://www.mailvelope.com/

Re:Stop Using Encrypted Email by joshuamorton on Thursday February 20, 2020 @04:27PM (#22378801)
It's one of a number of options (gmail for example had an unofficial official one for a while, and there are other similar extensions). They still all have the same issue that the only threat they protect from is "my webmail provider is incompetent".
Re:Stop Using Encrypted Email by GoblinSlayer on Thursday February 20, 2020 @06:38AM (#22374338)
>There are schemes

Schemes like "everyone has great opsec".

Re:Stop Using Encrypted Email by Klonoar on Thursday February 20, 2020 @04:24PM (#22378779)
A nitpick: Tutanota does not use PGP.