Facebook Is Ending Support for PGP Encrypted Emails
joltmailer.com
joltmailer.com
> This renders recovery emails sent to the user’s email address unreadable, as only the hacker has the encryption keys.
So: PGP encrypted emails were rarely used, except to lock out the legit user after account was compromised.
They're just looking for excuses
Shamefully I also turned on the pgp messages from Facebook. I never found value with it, but to this day it’s still enabled and I don’t care to log in to Facebook to disable it.
Comically I forgot all about it until I had to reset my password and got an encrypted email. Was a pain to dig out my keys and decrypt it, but it worked.
[1]: https://datatracker.ietf.org/doc/html/draft-koch-openpgp-web...
[2]: https://wiki.gnupg.org/WKD#Mail_Service_Providers_offering_W...
I’ve received a PGP encrypted email by a non-proton user. It worked fine. But I was unable to encrypt my reply to him.
Proton support told me that he needs to attach his public key to his message so I can use it.
It seems that the Proton interface doesn’t offer any way to automatically try to find the public key of an user (from which you have an email address and probably a signature).
We have plans to also look up keys on keys.openpgp.org as well, to offer an automatic solution in case the provider doesn't support WKD.
As I received the email without the key attached and his domain doesn’t support WKD, I was stuck to manually import from keys directory. It makes sense.
Can you give a quick explanation for someone too dumb to understand your first citation?
I use pgp for years but struggle to understand how proton can say email is encrypted when I never have to decrypt it myself.
If proton has the key how is that different from Google just encrypting everything until right before it displays?
I used proton for a couple years but moved back to Gmail cause I figured all the encryption talk was just promotional and using pgp your self is the only way.
Then, when you log in, the client fetches the encrypted private key, decrypts it with your password, and decrypts your emails with the private key. All of this is done automatically but it's still end-to-end encrypted.
The first citation (WKD draft specification) simply describes how to publish (and look up) public keys for a given email address on its domain. So for twiss@proton.me (hypothetical example), the key is published at https://openpgpkey.proton.me/.well-known/openpgpkey/proton.m....
I suspect this was a state actor funded operation, for this has effectively, and significantly reduced the usefulness of PGP/GNUPG.
Many people I know were starting to use it, now they do not. It doesn't matter that security should overcome conveniences, conveniences often win.
And state actors hate encryption at rest.
So feature was basically there only to shoot oneself in the foot.
If it was popular, they wouldn't axe it.
My comment was certainly about facebook dropping it, but also about how this is a larger picture issue. You don't need to weaken encryption standards(NSA, others), or have back doors(loads of states), if people just find it too annoying to use!
Banks, bigtech, government choose other means, for their own reasons. Some of those might have been spies lobbying to hold on to their surveillance superpowers, for sure. Another might have been "not invented here".
And if your email is compromised, well, it is game over already, for every single thing you have access to.
So it is just a poor excuse. I guess the main reason is that virtually nobody knew this feature existed and the intersection between the population privacy savy enough to use PGP and using Facebook is ridiculously small.
If it was, they did us all a favour, because PGP as means of encrypting emails is a steaming pile of garbage, as it requires both, client support, and the counterparty to have the same OPSEC as you (e.g. not just forwarding the email unencrypted to someone else)
Email was never meant to be encrypted, and the existing implementations (including S/MIME) suck for this exact reason. And the worst thing is that it’s simply not possible to make it work.
All encrypted communication protocols have this requirement. And all of them will in the future. By definition, you need the counterparty to be able to decrypt your message, which means you're always vulnerable to them forwarding the unencrypted message to anyone they want.
email makes this trivial.
Same for images inline, and the idea of attachments was an add-on. Other examples abound.
While I don't use html in my emails, it's effectively a standard now. So much so, that I have to prod some corporations to fix their stuff.
My point is, the "email was never meant" ship sailed decades ago. Change happens.
And there is no way to encrypt anything, ever, and send it to someone, who can't see it, and then copy it and send to others. A person can take a screen shot, or just take a phone and take a pic of the screen! So even if it's not simple, this problem is a non-solve, because if a human can read it, it can be copied to others.
Which means, I do not believe your criticism on this point is valid.
I must assume you are an opponent of privacy
And "state actor funded"? Come on, the spam attack was absolutely trivial. It required no state funding, just a single person with an axe to grind, a target, and a trivial shell script. Attaching spam signatures was a thing decades ago already and didn't require any real resources of technical knowledge.
There are plenty of keyservers that are usable. There is a visualization diagram of the forest of replication partners.
Hell, even amongst my peers, I'm continually shocked at how many people have never used gpg, ever. And, anecdotally, the number gets lower as age gets lower. Young people aren't using it. It's dying.
The original PGP manual talked about secretly communicating with your lover. That was the usage model, transmitting secret messages to people you could sometimes meet in person, and where the model was you talking to people you directly know.
Try to verify the GPG signature on say, the Tor Browser. It's signed by "Tor Browser Developers (signing key)". Have you ever met this "Tor Browser Developers" person?
Okay, what about the web of trust? Well, GPG offers no help whatsoever in finding a way of making a connection.
And that's why it's dying, because the model it targets ceased to be relevant, and we developed plenty new needs like verifying software signed by random people on the other side of the globe, while GPG did nothing to accommodate that use.
That's actually a really common use-case for GPG. I've seen it used for this more than for email...
To verify the tor browser correctly, you need a trust path.
Option A: You've met at least one of them directly, and for some reason decided to sign a key with the label "Tor Browser Developers" on it. How did that person prove to you that they're a legitimate Tor developer? That's a pretty tricky thing to demonstrate.
Option B: You've signed the key of somebody who did the above. Same problem, but even more dubious.
Technically, GPG allows longer trust paths, you can do Alice -> Bob -> Carol -> Tor, or I think even Alice -> Bob -> Carol -> Dave -> Tor. But the software won't help you with this.
To do the first, you download the Tor key, look at who signed it, download all those keys, and hope that one of those might have a signature by somebody you know on it.
To do the second... you're on your own. You can do a brute force key download, where you download thousands of keys in the hopes of some connection being found, and blowing up the size of your keyring. This will add lots of random people into whatever UI you use and slow down every GPG invocation. And you'll need to write some sort of shell script for that, it's a pain.
For your example,
1. Download the software form the official website.
2. Verify the signature.
3. Done. If you are very concerned, you can double check the signature from a previous version from the Way back Machine.
What are the chances the official site AND the archive were both compromised?
Look at your list of CAs sometime. There's multiple national organizations there. Controlled by a government.
And any of those will be deemed as valid, so if you go to https://www.torproject.org/download/ and it's signed by a Chinese CA for some reason, to your browser that's perfectly fine.
> What are the chances the official site AND the archive were both compromised?
You're talking about a piece of software that's designed to hide stuff from state level actors. If you're in actual need of such a thing, that threat is pretty damn serious.
In a way, having JavaScript client-side verification of files as an option would be as secure (if not more secure) in most circumstances because it'd be more noob friendly. At the very least to ensure mirrors aren't doing anything nefarious.
Once you verify the fingerprint, you import the key into your keyring and sign the key. It’s TOFU, so it’s done only once.
GPG was made to be a self-contained system. It works based on chains of signatures (web of trust). The GPG program enforces this model, you must sign keys for a signature to be identified as valid. Approximations like "I can find the same key on this other website" aren't part of the intended model.
Key servers don't provide trust, they provide convenience. You may obtain keys from keyservers, but to actually trust a key you're supposed to do the work of verifying it. Eg, if you get my key from a keyserver the only legitimate reasons to trust it is that either you met me personally and compared fingerprints, or you trust somebody else who did that.
Mailvelope makes it sort-of easier, but it also fails at UX because it doesn't support clear signatures. Gmail and such should address this. Proton is an improvement but it doesn't allow using an external GPG key. keybase sort-of solved the scalability of effort problem / barrier that is web of trust, countersigning keys, and the bad UX of keyservers.
There is no readily suitable admixture of keybase, Mailvelope, and Proton that doesn't suck while supporting maximum flexibility.
The tech is old and out of sync with modern cryptographic principles. It supports a bunch of obsolete algorithms for backwards compatibility, some of which are badly broken. It has a complicated packet format that's hard to parse and itself has security issues. It encourages bad practices like keeping ancient keys around because they have signatures on them.
It's also highly hostile to using it in any way but how it was designed. For ages, there was no library to parse OpenPGP packets. You had to run gpg itself, maybe give it a fake home directory, feed it whatever you need, parse the output... it's an enormous amount of pain even for simple things, and it's all terribly slow.
And it badly damaged the ecosystem, because either you spend lots and lots of time on reimplementing lots of crypto (which tends to be a bad idea), or you try to trick GPG into doing what you need and end up with a system that's dreadfully slow and painful to use.
The problems you speak of are probably due to this. There wasn't an usable base to build services on until very recently, when GPG was already effectively dead.
GPG works.
If you don't like it, invent something better.
Being uncharitable with security critical software is the right attitude to have.
> GPG works.
Yeah, not quite. I've used it extensively. I've got an excellently well connected key. I've tried writing software that uses gpg. I've reached the conclusion that it's a lost cause.
> If you don't like it, invent something better.
People have. Things like the Signal protocol for instance.
They HATE encryption, it's why control of the Bitcoin GitHub repo is so critical, an encrypted peer to peer payment option is even more dangerous than encrypted peer to peer communication.
People just have too much trust, are too lazy, or were just giving a job for whatever reason.
1. Attacker somehow gets control of email
2. Attacker uses email to "recover" facebook.
3. Attacker uses email to add pgp.
(time passes)
4. User realizes facebook and email are taken over
5. User somehow recovers email
6. User tries to recover facebook using email but is unable to
It's quite disingenuous to make it sound like PGP was the problem here.
Read that sentence again: "Once a hacker gains access to a Facebook account" regardless of PGP or not... then, of course, they own the account and can do what they want!! But that's the problem, not that they can enable PGP encryption. If you had PGP encryption to start with, ironically you wouldn't be "susceptible" at all as it's the hacker who wouldn't be able to read your emails even after compromising your account (though they may do worse thing at that point).
Of course they could've just fixed that instead of sunsetting encryption entirely, but note that Facebook didn't say this was the reason why they're killing the feature, that's just speculation from the news article. Facebook didn't give an official reason, so maybe it's really just because of low adoption.
You could make the same case against 2FA. Most sites don't require email verification when you enable it. Someone with your password could lock you out by adding a TOTP app. But I wouldn't consider that a vulnerability. It is, if anything, a consequence of not locking down the account in the first place.
I left after tagging people in photos became a thing but before "privacy" controls existed.