Slashdot Mirror
PGP Universal - Usable Email Security?
An anonymous reader writes "For years, noted cypherpunks such as Brad Templeton, Ian Goldberg (PDF link), Bram
Cohen, and Len
Sassaman (PDF link) have been calling for easy to use email encryption solutions
which involve little crypto comprehension on the part of the user. Now, it seems like someone has listened: PGP
Corporation has announced its PGP Universal, which says it 'shifts the burden of securing email
messages and attachments from the desktop to the network in a way that is
automatic and entirely transparent to users'." The Register has more information on these newly announced proxy servers.
shifts the burden of securing email messages and attachments from the desktop to the network in a way that is automatic and entirely transparent to users'
If you think that letting the powers that be implement our security by shifting the responsibility for encryption to them is going to make us take off our tin foil hats then you have another thing coming o.0 Methinx that if anything this will make me consider constructing a newer, stronger hat.
This looks a lot like what the company I work for does.
(A box/infrastructure) that does the crypto/key management for you)
If someone really needs to use PGP security, which is almost unbreakable, they would figure out how to use existing programs. Most potential customers for this program have no need for it; the vast majority of people would be fine with little or no encryption. Really, though, who sends their credit card numbers over email? If it's that important, people go to the trouble to figure it out. So, in my view, this is a luxury. People who have a real need for PGP will take the 5 minutes to figure it out. Other people simply don't need the security.
"73% of quotes on the Internet are made up" -Ben Franklin
Pine/GnuPG ask me for a passphrase each time I encrypt and/or sign a message. This proves that I originated the message (not just some random punk who broke into my computer) for the purposes of authentication and non-repudiation.
The article and FAQ list were light on technical details, and I don't feel like registering for the actual whitepaper, but: since the aim of this service is to make encryption easy enough for common usage, I highly doubt there will be a passphrase prompt or any other method to ensure that the actual alleged sender is in fact the originator of a message. This seems to be confirmed by the statement that desktop mail clients (e.g. Outhouse) will be somehow directly "integrated" (how's that for nebulous?) with these proxy servers.
Without this precaution, I fail to see how this is anywhere as secure as straight-up PGP/GPG.
We have more to fear from the bungling of the incompetent than from the machinations of the wicked.
It seems that a device - like the keyfob-sized USB "memory drives" should be nearly enough for any personal use. Ideally there would be some sort of fingerprint or biometric reader in it too, though the existing passphrase mechanism could suffice. Just put your secret key on it and you can take it with you. I guess the problem is keeping randome machines from snagging a copy, though, since the same machine you plug the fob in to can also snag your keystrokes and thus your passphrase.
If it's not one thing, it's another.
The article states that the network is then responsible for decrypting and encrypting... it has to be clear text someplace on the network to begin with then. Doesn't that defeat the purpose? And, why is this necessary when the future 'ipv6' to be done by 2007 will be completely encrypted anyway (internet version 2 if you will).
What is slashdot?
Yahoo Mail does a superb job of catching spam and scanning for viruses. They also use SSL (optionally) for logging in. If they would just add PGP/GPG to their Mail Plus service, hell, I'd buy it!
The STARTTLS option to SMTP simply requests that your SMTP communication be done through an encrypted tunnel. It does nothing to help establish the authenticity or security of a message, which is what PGP's software is primarily about.
If I understand things correctly, using this server a company could set things up so that all outgoing emails are digitally PGP-signed with an appropriate corporate or user key. You could also set it up so that all emails stored on your servers are stored encrypted... the proxy transparently decrypts them for the client.
They talk a lot about "enforcing policy", which might include things like encrypting communications with certain vendors, signing all communications or communications of a certain nature, encrypting all communications against a corporate key as well as the recipient's, etc.
It looks like it provides a very useful function for an enterprise, without forcing your collaborators to purchase the same technology (as the output is normal, standard PGP encrypted and/or signed documents).
The spam can't be scanned while in PGP form, and according to their diagram it won't be decrypted until AFTER hitting the mail server.
I suppose one point up for security, one point down for preventing spam :(
Personally, I'm just going to use jwz's new script for all my communications:
Aoccdrnig to rscheearch at Cmabrigde Uinervtisy, it deosn't mttaer in waht oredr the ltteers in a wrod are, the olny iprmoetnt tihng is taht the frist and lsat ltteer be at the rghit pclae. The rset can be a total mses and you can sitll raed it wouthit a porbelm. Tihs is bcuseae the huamn mnid deos not raed ervey lteter by istlef, but the wrod as a wlohe."
http://jwz.livejournal.com/256229.html
It certainly isn't a universal solution but it's definitely a solution for some problems.
For example, if this is utilized by a company or an ISP, your email never hits the 'net unencrypted. Certainly, there are people who still have access to the email in its unencrypted form. I wouldn't use a system like this to transmit the names of the Colonels eleven herbs and spices. But it does bring email a bit closer to snail mail.
How much security does an envelope provide? Anyone who gets their hands on it can easily open it. But it's certainly more comfortable than sending a postcard.
"The legitimate powers of government extend only to such acts as are injurious to others." Thomas Jefferson.
For those who don't know, Phil stated when he left that every PGP product released while he was there contained no hidden back doors. Knowing that companies like PGP were being pressured, it makes me think the creative differences were them wanting to build something in that he thought shouldn't be in.
LordBodak's journal.
Actually, I've been playing with Thunderbird, and setting up encryption is pretty damn easy.
I work for a fairly "hip" company (IBM) and we have this nifty website you can go to, fill out a form, and they send you a nice little PKCS#12 file, signed by a real root cert and everything. To use this with Thunderbird, all you have to do is: "Manage Certificates" -> "Import" -> (password) -> done.
Of course, if you want to generate your own keys, that's a little harder, but nothing a simple script couldn't be created to do.