Hacker News Reader

The word "appalling" describes something that creates surprising distress or dismay (itself implying surprise).

To be surprised at a cryptographer advocating for deniable messaging is to suggest that you're unacquainted with the field of messaging cryptography, in which deniable messaging has been a foundational goal for almost 2 decades, going back to Ian Goldberg and Nikita Borisov, who once yelled at me on Twitter for giving OTR short shrift and thus ensured I'd always associate his name with OTR and thus, I'm sure to his delight, his name being dropped on this thread.

I'd again like to point out how clear it is, the epistemic approach being taken in this thread. You can disagree with deniable messaging as a valid goal (it'd set you apart from cryptography engineers, but that's fine). But you can't be appalled by it in 2020, because the idea is old enough to drink in a bar in Canada, and motivated at least two of the most famous protocols in all of cryptography.

Instead, what people are doing here is skimming this post, digging no further, and then calling to mind their understanding of current events. Then, from that tiny thread of information and a bunch of axioms invented, I presume, in the span of just a minute or two, they're deriving an entire first-principles explanation of how messaging security is supposed to work.

You can do that, but I think it's more than fair to point out that there are people that have dedicated their entire career to studying this subject and publishing on it, and if commenters are going to make it clear that they haven't even tried to engage with that material, it's unclear why they should be taken seriously.

Also, Google should publish DKIM keys.

In the quote I presented above, the author wasn't making a technical argument, but a moral one.

If you or the author are presenting an argument why repudiation is necessary on technical grounds, I will admit ignorance and defer to the experts.

But my reading of the blog post was that it is not a technical argument. It's an argument about morality, and specifically the author used political examples. If the author did not want lay people to argue about the moral implications, why did they use non-technical arguments?

I don't know how fair this is but will just say that the first thought that jumps to my mind here is that being surprised at a cryptographer advocating for deniable messages is a little bit like being surprised at a medical researcher advocating for effective antibiotics. It probably never occurs to either of them to question the legitimacy of their moral stance.

I certainly could be wrong. What’s the case for repudiation? Is making blackmail harder really the cryptographer’s mail argument for why repudiation is a benefit?

I didn’t see a more convincing argument in the blog post. If there is a technical reason why repudiation is beneficial, I would be grateful for an explanation.

Read Goldberg, Brewer, and Borisov:

https://otr.cypherpunks.ca/otr-wpes.pdf

I'm not going to present a moral argument (what is a moral argument in this context?), only two direct rebuttals of your objections:

1. DKIM provides neither truthfulness nor objectivity. It's a signature mechanism used between mail servers to reduce spam. For implementation reasons, most DKIM users sign with RSA keys that are either currently crackable or will be crackable in a matter of years. Consequently, "signed" emails that are leaked years after their alleged transmission provide a false sense of non-repudiation.

2. Per 1, these emails are already impossible to authenticate after a period of time. This just makes the expectation more explicit. More generally, however, this just isn't a fruitful (or intended) application of DKIM: if the government wants to obtain evidence of a crime, they're going to subpoena the email provider and retrieve the originals. If the suspected criminal is sufficiently important, they'll use pointier methods. The outcomes of our criminal justice system intentionally doesn't hinge on the validity of a few DNS-published RSA keys.

If right now DKIM doesn’t provide truthfulness or objectivity, then the author’s blackmail example already doesn’t apply.

DKIM signatures, by your argument, are useless in blackmail, since they don’t verify the message. So why did the author resort to that as an example?

First: I don't think Matthew Green "resorted" to anything. I think he chose the blackmail example because it's easy to understand on a personal level: we all use repudiatable protocols in other contexts (like Signal), so why wouldn't we want it on our emails?

Second: That's not how blackmail works. It's contingent on what the extorted party thinks, not the cryptographic integrity of the blackmail material. That's why mass blackmail spam campaigns (that DKIM fails to prevent, ironically enough) are remarkably effective. Publishing DKIM secret keys after their expiry doesn't magically prevent blackmail; it just removes one more tool from the blackmailer's toolbelt for instilling fear in the target.

The problem is that it's not clear about it. It looks like it does quite a bit, and the counter-argument boils down to "someone could have cracked the secret key", which everyone always is told is the thing that is impossible. So you get plenty people believing and claiming DKIM can do that. This would be fixed by obviously breaking it.

> 1. The truthfulness and reliability of the historical record is important. [...]

Everybody agrees here, but how does one gets to decide that Google, a private corporation, is the one to decide that a given email is an accurate historical email? An email provider is a defacto certificate authority? Are these dkim keys subject to the same standard of care as private keys that CAs manage?

For your regular-person scenario, having a way for a 3rd party private company "certify" an email sent from another private company (example: your online order) may be good enough, but is it good enough in every scenario?

We could catch a lot of criminals if we every OS had a backdoor that the police could access. So, are you in favor of that?

In the general case, repudiation is desired by users, and non-repudiation is needed in only very particular cases. Companies serving nontechnical users should make repudiation the default, because if given the choice most users would prefer it to be the default.

In the particular case of Google releasing its DKIM keys, I think I would need more context. What kind of repudiation property do users expect when sending emails over GMail? Is non-repudiability currently used by users for legal or business purposes? Probably the way to do it would be to announce a particular date maybe a year into the future that the private keys would be released.

> Seriously, can someone present a moral argument for why this should be adopted? It seems only harmful to me.

Because this isn't just about politicians, or holding politicians accountable. It affects the rest of us too!

Instead, imagine what would happen if a hacker accessed the email of a closeted LGBTQIA+ person living in a country where being outed is practically a death sentence, and the DKIM signatures were sufficient proof of guilt.