It's easy to see why there are divided opinions on this. When someone sends an email, the recipient often wants to be able to prove that they did so. We think of email as something capable of leaving a paper trail, proof that certain people sent certain emails. It's reasonable for secure messaging to want to fill a different niche, more like private conversation. I've seen messaging apps advertised on the basis that they will delete all messages after a certain time, making them basically equivalent to talking to someone, in terms of non-repudiation and being ephemeral by default. But people frequently want email to be more like letter writing than private conversation. The tradition with letters was to sign your letters to prove that you sent them. People talk about having a certain thing "in writing", so that they can use it in litigation. Insofar as email is supposed to fill that niche, its reasonable to expect it to provide repudiable messaging.

My problem isn't that people have divided opinions on this. My problem is that people who oppose it write as if they're just now discovering that the opposite opinion exists --- in one case on this thread, someone suggested that the only reason Matthew Green held this opinion at all was political.

A serious argument against deniable messaging would start by acknowledging deniability as one of the shibboleths of the field of messaging cryptography, and then tackle the idea. Nobody on this thread has done that, and I think the reason why is that they're simply not aware that there is such a field.

Only because you circularly define experts in the field as those who agree with you.

Yeah that must be it. Sucks that I didn't cite sources.

I appreciate the re-framing of this comment and its parent. Personally I found the original article's argument to feel more like "people shouldn't be accountable for their correspondence" than "the default mode of email should be more of private secure messaging". Both are advocating for the same changes but only one seems reasonable to me. That may just be my flawed reading of the blog post, but regardless, I can better understand the positions now.

People shouldn't be accountable for their correspondence! That's the whole point of secure messaging!

Speech has consequences. Given the good done in holding rogue "politicians" accountable, not seeing that as axiomatically desirable is at least a little bit suspicious...

Private emails are not speech. Are you suggesting all private conversations should be public? That seems absurd to me. Do you subscribe to the "surveillance isn't bad if you have nothing to hide" concept?

Sending death threats or racial invectives by private message is as much speech as sending them by Twitter post.

All private conversations shouldn't be published. That isn't necessary to hold people accountable for dangerous or violent speech.

Publication and repudiation aren't the same thing.

There is no way to allow the verification of a death threat message without also allowing the verification of political dissidents, for example.

Yes, it might make it harder to punish death threats, but privacy is too important to sacrifice.

Let's see your mail spool. After all, how else can we know you're not having illicit conversations with politicians that we all deserve to know about?

Now you're just spouting non sequiturs. Publication and retention are two separate questions.

And not being a politician, and certainly not the one currently trying to hold the White House hostage, I don't see the public interest anyway.

I am not following... we are talking about gmail and email in general, not specifically the White House.

If you think White House emails should be signed and archived indefinitely, that is one thing. That is not what we are talking about.

But emails are meant to be accountable. They are the digital equivalent to sending letters. They should leave paper trails. Just like you have written before, secure messaging should be left to secure messaging apps, not email.

Woh, the idea that private letters shouldn't be private is WAY far away from the privacy standards that have been around in liberal democracies for centuries.

Mail being secure from surveillance is a foundational freedom.

I have no idea where you are getting the idea that we all should have to answer for what we send in private correspondence.

Letters and emails are private. DKIM does not change that.

This discussion about DKIM is about non-repudiation and the ability to prove that a certain person sent the email.

If you send me a letter, I (or someone else who gains possession of that letter) should be able to prove that you sent the letter and hold you accountable for the contents. DKIM does that for emails.

If you want to transfer assurance of the authenticity of an email to someone else, you can do so without DKIM; just sign a timestamp or something. The problem with current DKIM configurations is that it provides that assurance to everybody, including strangers who have no business having it. Which is why the ask here is for Google to do with DKIM what OTR does with MAC keys: burn them periodically, so that only people who have explicitly arranged to share authentication do so.

That seems less usable for the average email recipient. Most people who need to prove authenticity to a third party (eg of politically sensitive or offensive messages) aren't techies.

Too, it's easy to imagine not knowing you need proof until some time after you receive an email.

If it isn't usable and enabled by default, it won't be used in practice - for the same reason almost nobody uses PGP.

It's already common to use unsigned documents in court, as long as you can show provenance is legit or if the counterparty is willing to acknowledge authencity.

In fact, it's quite common that the issue over unsigned documents in court is the interpretation, not authencity.

I think the issue of having to teach users how to opt in to signing emails in potentially controversial cases is preferable to having to teach them how to handle email communications that are permanently provable (for starters, never ever again leave out a quote and never ever write ambiguously).

The author's suggestion, as I understood it, doesn't prevent this, it only prevents them from doing it beyond a certain point in the future.

If you got an email that warrants "holding someone accountable", you would have plenty of time before the keys are released. So if you receive an email and call the police, nothing would change.

What you couldn't do it save it for years and keep it as blackmail material / until it's politically opportune to use. Of course it's not as clear cut as that, and an email may look harmless at the time, and only later, with more context, you might realize it contains evidence of misdeeds. So even a good faith actor might unknowingly sit on evidence.

I think the reason there's so much controversy about this post is because it was written in the context of a recent political controversy around which tribes have formed unusually strong opinions. It's hard to have a quality technical discussion when so many of the participants are being driven more by tribal emotions than by rational discussion.

> To allow a stranger to authenticate a messages is to concede information to them, and avoiding concessions is the point of messaging cryptography.

Whilst I agree with you that email messages should be repudiable , I have a feeling you're trying to pass something off as axiomatic that isn't. For example isn't a confidential business agreement basically exactly, by design, an authenticated non-repudiable message that can be authenticated by third parties (such as courts)?

Yes.

And they have much better mechanisms than DKIM available which they should use instead.

In fact, with reliance on DKIM you create the distorted incentive that one company might want to fake getting hacked to claim an email they sent is not authentic.

As a matter of fact, they might even be so sneaky as to send individual emails without DKIM signatures, with a policy set for the recipients to not reject those emails. Since most email clients do not display this discrepancy in a lack of a DKIM signature, the recipient might not notice and then the sender can later claim forgery.

So then let's not rely on something so unreliable if you need reliable authentication.

Sure, I'm not in favor of using DKIM for repudiation and in favor of Google releasing the secret keys.

Has this kind of repudiation ever been tested in the real world? It's hard to imagine a court throwing out email evidence because it lacked a DKIM signature. And on a personal level seeing a chat transcript that had cryptographic non-repudiation would make me likely to believe it, but seeing one that lacked it would probably not weigh heavily in how I came to that determination.

> Has this kind of repudiation ever been tested in the real world? It's hard to imagine a court throwing out email evidence because it lacked a DKIM signature.

They're more likely to ask their expert witness to testify about the evidence, and the deniability of the DKIM signature could be brought up by the expert witness as a reason to distrust the evidence. I wouldn't expect lawyers to discover this argument from first principles.

Has it ever happened? Not that I know.

The success of the "trojan defense" is encouraging on this point, I guess:

https://en.wikipedia.org/wiki/Trojan_horse_defense#Cases_inv...

I'm sure defense lawyers would love it :)

I would expect any half decent prosecutor to focus on how the emails were acquired when a verifiable DKIM signature is missing. Then the defense doesn't even need to bring that argument up, just challenge the provenance of the evidence.

The problem of deniability and "disavowing keys" is subjective and requires technical skill to understand, that average person will not find this "equalization of legit and forged data" intuitive and will believe that keys/signatures/encryption on content adds authenticity on equal level with "legit data" - instead of "repudiation" you have a 'weak proof of authenticity' that could be disproved later(the burden of proof shift here is important psychologically since keys/encryption are perceived as legitimizing content).

Email fills a different niche than secure messaging protocols though. Email has come to be used much like mail, including for legal purposes. Non-repudiation is actually a useful feature for a lot of those use-cases.

Obviously the conflation of a bunch of different use-cases into this one protocol is a problem, but I don't know that just making email more secure is a solution.

I agree completely.

Non-repudiation is of course a needed property for many systems, but it is not a property a system, especially an everyday messaging system like email, should have by accident - even "weak" non-repudiation such as DKIM. It is a violation of privacy. The suggestion the author makes of course doesn't completely get rid of it, but at least makes it time-limited.

Excuse my ignorance but how does someone else signing my message prove that I sent the message? Moreso if the body of the message is not being signed at all?

Good luck arguing that Gmail forged and signed an email from you.

My 14 year old who has access to my computer sent it as a prank.

And now we're talking ethics.

On one hand we have the Utilitarianist view of security. If increased security results in "more good" than evil, it is inherently ethical and thus acceptable. In this view, the idea that a good person may be blackmailed is perfectly acceptable, as long as it exposes political malfeasance.

On the other hand there's the Kantian view. If you have to lie, it it hurts someone, or it wouldn't work if it applied to everyone, then it's unethical. This doesn't seem to work at all, because we have to allow lying (non-repudiation). But non-repudiation could prevent someone from being hurt. And applying it to everyone would allow for the least harm, rather than the most good.

In the end Utilitarianism usually reigns because it's easier. But it does ignore the edge cases, which we should consider. Perhaps the way forward is not to pick one or the other, but actually re-make the world to embrace the good and avoid the bad. Sadly, that's probably the most difficult choice of all; when's the last time we replaced a working standard just because it had crappy outcomes?

I honestly don't care about this Sophomore Dorm Room stuff, as long as we can all at least acknowledge the role of deniability in messaging security. If you want to argue that email isn't messaging, that's fine, I disagree, but at least you'll be vindicating my "never use encrypted email" argument.

I was more pointing out that the choice of how to move forward isn't simple, and that the premise is probably flawed due to bad design, but that we probably won't fix the design because it works.