5 ms·

The Sinking Ship of E-Mail Security

36 points by earthrise 12y ago

0xeeeeeeee 12y ago
Email security is really bad. We have a lot of companies trying to roll out "secure email" every week. There are a ton of problems to solve before one of these actually works, javascript crypto being the least (since HN likes to discuss it...). Backwards compatibility with old email protocols and insecure service is clearly a weak-link in any hypothetically secure service. It would be nice to see a more distributed protocol...where the bulk of the world's email is holed up in a few company's data centers.
- deleted 12y ago
  [deleted]
JadeNB 12y ago
While the spirit is laudable—I'm not sure if there's an 'e-mail security' version of https://craphound.com/spamsolutions.txt https://craphound.com/spamsolutions.txt, but, if there were, then I'm pretty sure that one of the reasons for failure would be "You are a private individual announcing that you will be rolling out a new standard for e-mail in a couple of weeks".
- adamcaudill 12y ago
  Change has to start somewhere. Starting with a draft and getting feedback from the community before pushing it ahead for more formal standardization seems like the right place to me. As I said in the article, my goal is to get people talking about potential solutions. I have little hope that the solution I propose will be accepted and used as is - but if it gets more people talking, and discussions going about something that will work, then it was worth the effort.
  - JadeNB 12y ago
    > Change has to start somewhere. Starting with a draft and getting feedback from the community before pushing it ahead for more formal standardization seems like the right place to me. I agree that change has to start somewhere, and, to be clear, I don't mean anything against you, but rather against the likelihood of any success: I think that we're stuck with a broken legacy system until something radical, by which I mean "all existing infrastructure is destroyed"-type radical, forces a ground-up re-start. Nonetheless, there seem to be at least two competing objections to trying to start the change here: - My point of view: It seems unlikely that the eventual solution (if there is one) will come from a large group carrying a large and representative collective weight, not an individual (or even a small, self-selecting community like HN, or—probably, and with no offence meant—the readership of your blog) with a necessarily specialised viewpoint; and that a large group is more likely to buy in to "let's create a new standard!" than "let's use my / my community's standard that I / we created without your viewpoints or input!" - Alternatively, if one believes (as it seems you do) that the solution will start with an individual, then surely the thing to do is to deliver a product, not a promise. I don't know about anyone else, but my reaction when I see assurances of delivery RSN is automatic scepticism.
tptacek 12y ago
Mobile - Using PGP on a mobile device can be risky, as it requires storing the private key on devices that are likely to have known security issues. Many people recommend against it, as it puts the private key at too much risk. ARGH. The whole point of PGP keyrings --- the costliest part of the PGP UX --- is that you don't have to have a single key. If you're terrified of exposing your secret key on your mobile device (which is frankly the most secure device you own), just cut a new key for it. Any time someone suggests a new application for PGP, people come out of the woodwork saying things like "what, you want me to put my PGP key in my browser?" No. We want you to put --> a <-- PGP key there.
- adamcaudill 12y ago
  Yeah, I have mixed feelings about that one; I almost didn't include it, but it's an argument that I hear often enough that I thought it was worth pointing out. Personally, I have my key on my phone, and I'm fairly comfortable with it - though there are certainly some that aren't.
- click170 12y ago
  But, wouldn't that mean that if you share the same email account on your Desktop and Phone, that using a different key on your phone would mean you could not decrypt emails intended for your Desktop? My understanding was that you can associate a key with your email address, does this just mean you would have two keys associated, one for "me@me.com Desktop" and one for "me@me.com Phone"?
  - tptacek 12y ago
    You can encrypt messages to more than one key. You have to be pretty fussy to begin with to even have this concern.
- jiggy2011 12y ago
  > If you're terrified of exposing your secret key on your mobile device (which is frankly the most secure device you own), just cut a new key for it. The mobile device is the one most people have the least control over in terms of software (which can be both good and bad) but is also the one they are most likely to lose in a shady part of town. I agree with the rest of your post though.
lifeisstillgood 12y ago
Ok, I'll bite. This is a good post - I am negative on your ability to pull this off, but it's a worthwhile discussion to have IMO * Totally anonymous (ie no metadata trail) communication seems impossible / impractical. If everywhere is the Tor then we massively increase traffic, (not to mention the trustworthiness of "everyone" is a lot lower per unit than everyone currently running a tor node) Anyway, even if a encrypted anonymous message arrives for me, just working out who it's from without any metadata seems complex web of double decryption I do struggle with how anonymity is going to solve all problems with totalitarian states. In the end we need to solve this in the real world of politics and execution squads so we don't mortally worry about letters or emails being read. * there is a lot more here than my tired brain can handle - but my main concern is a simple human one - if secure anonymous comms is "impossible", then I could see levels of secure encryption (sent from my iPhone, sent from my PC hardwired at home that has a secure USB boot on my key ring). But this idea demands that as the recipient I work hard to determine from context if the message is secure - aha it's 11pm in the UK and Adam just mailed me a secure note saying we should give everyone an Owl. Chances are high he is pissed and his mates sent it. Once technology stops helping us make those decisions it's kind of pointless - May as well just keep sending clear text is not an irrational stance. Be interested in the discussion in the morning - cheers * lastly - what email client do you guys use that allows gpg on mobile?! Edit: clean up
- narrowrail 12y ago
  K-9 mail on Android. Not sure about iOS, but I have seen an implementation somewhere on code.google in the past (not sure of its current status).
  - lifeisstillgood 12y ago
    Thanks - am looking to jump to the dark side soon anyway :-)
  - mike-cardwell 12y ago
    K-9 Mail is good, but it doesn't support PGP/MIME. Only inline PGP. Doesn't look like they will either as it's been on their todo list for several years now with no progress.
ams6110 12y ago
I think of email like a postcard. It's addressed to me, but anyone can read it if they snoop in my mailbox. I don't expect it to be really secure, and I don't do anything that requires real security via email. Simple enough.
- leeoniya 12y ago
  what arrives in your inbox is often out of your control. account confirmation and password reset emails, pictures/info others send you who are more satisfied that you with the level of privacy normal email provides, etc.
  - raving-richard 12y ago
    Yes, to extend the postcard metaphor, it's like the bank sending a bank card PIN on a postcard. Not secure at all.
htns 12y ago
I would suggest taking a look at I2P-Bote. Although I haven't had it installed for a year at least, I2P-bote seems to be a slow-moving project, with lots of features TBD, but it does hit all the keywords.
RexRollman 12y ago
The title "The Sinking Ship of E-Mail Security" implies there once was security but there never really was. For the most part, email is more like a postcard than a sealed letter.
- adamcaudill 12y ago
  Good point. I should have thought of a better title.
x1798DE 12y ago
I've thought a lot about this and so far the solutions I've seen put forth (e.g. Flowingmail, Bitmessage, for starters) don't seem likely to get any widespread adoption, and that can be the death knell of anything like this that relies on network effects. Hell, I can't even get people to send me a PGP key even when I refuse to send them important documents without one (they just say they're going to send me one later, then forget about ever getting the document they wanted). It's really not that hard to generate a PGP key, but even motivated people don't do it. My immediate intuitions are that 1.) this is a very hard problem to solve and 2.) if it's going to be solved in any reasonable amount of time, it needs to be bootstrapped into existing, popular methods of communication (such as e-mail). Adding some sort of PKI into the existing e-mail spec would probably be a good start, since it's just not something that people are used to dealing with.
donniezazen 12y ago
I am always scared that if I start signing my emails (the least I can do) they might start looking weird to my friends, family, and colleagues. They may even think that the block of gibberish may be spam. I do like my KDE KMail client which masks the signing information and presents signed and unsigned messages in a sane way.
lifeisstillgood 12y ago
This has really got me thinking about an architecture I had not really considered before so forgive the obvious in this - it's partly aide memoire and partly a contribution to OP - goals of the "new email" should presumably be to reduce the ability of state actors and major comms providers to collect sufficient metadata to conduct mass surveillance for tyranny or profit. as such we can try either - Vast citizen owned mesh networks (ie every smartphone is a ISP) - Anonymity over traditional large ISPs / backbones Anonymity is hard. We could encrypt entire message and then round robin decrypt each incoming message, this would cripple all metadata apart from the TO: field and mean any listener would need to own most entry points to catch the first uptake. It seems difficult - webs of trust, guessing the encryption key. Add in other constraints - all messages in transit and at rest are encrypted - gmail becomes no more than S3 - and we see the end of free email, and weirdly a return to POP3 as the client must store all my mail. If this does exist however, why restrict it to emails - every message format seems similar - MQ and Facebook can all go this way. Mesh networks have even greater barriers to uptake ...
rakoo 12y ago
Pond (https://pond.imperialviolet.org/ https://pond.imperialviolet.org/) seems to hit some keywords you mention.
e12e 12y ago
From a quick look around, it looks like the best bet on asynchronous forward secrecy that doesn't rely on a (highly) trusted server (one that eg: shares a secret with every sender and receiver, kerberos-style) is something along the lines of "The Text Secure Protocol"[1]. No reason why this couldn't be bolted on top of email (send the actual message as an attachment like with pgp/mime). It would probably create a new set of metadata (requests to the recipients "half-key" service/server (locating which could be delegated to SRV records or something similar, with domain derived from the email address) -- but I'm not aware of any other schemes for generating ephemeral keys in a reasonable manner compatible with (semi)asynchronous communications. It does seem like "true" off-line message composition wouldn't be possible (the email client (or client service) needs to go online in order to encrypt/pack up the final message. This means that drafts/messages "in transit" would be possible to recover from the senders device in the case of eg: several mails being written on a flight w/o net access, and a search/seizure before mails could be encrypted to the receiver). All in all, this sounds like a tricky problem... Anyone know of any recent bright ideas in the field of PFS for asynchronous messaging? [1] https://whispersystems.org/blog/asynchronous-security/ https://whispersystems.org/blog/asynchronous-security/

36 points by earthrise 12y ago

Email security is really bad. We have a lot of companies trying to roll out "secure email" every week. There are a ton of problems to solve before one of these actually works, javascript crypto being the least (since HN likes to discuss it...). Backwards compatibility with old email protocols and insecure service is clearly a weak-link in any hypothetically secure service. It would be nice to see a more distributed protocol...where the bulk of the world's email is holed up in a few company's data centers.

deleted 12y ago
[deleted]

JadeNB 12y ago

While the spirit is laudable—I'm not sure if there's an 'e-mail security' version of https://craphound.com/spamsolutions.txt https://craphound.com/spamsolutions.txt, but, if there were, then I'm pretty sure that one of the reasons for failure would be "You are a private individual announcing that you will be rolling out a new standard for e-mail in a couple of weeks".

adamcaudill 12y ago
Change has to start somewhere. Starting with a draft and getting feedback from the community before pushing it ahead for more formal standardization seems like the right place to me. As I said in the article, my goal is to get people talking about potential solutions. I have little hope that the solution I propose will be accepted and used as is - but if it gets more people talking, and discussions going about something that will work, then it was worth the effort.
- JadeNB 12y ago
  > Change has to start somewhere. Starting with a draft and getting feedback from the community before pushing it ahead for more formal standardization seems like the right place to me. I agree that change has to start somewhere, and, to be clear, I don't mean anything against you, but rather against the likelihood of any success: I think that we're stuck with a broken legacy system until something radical, by which I mean "all existing infrastructure is destroyed"-type radical, forces a ground-up re-start. Nonetheless, there seem to be at least two competing objections to trying to start the change here: - My point of view: It seems unlikely that the eventual solution (if there is one) will come from a large group carrying a large and representative collective weight, not an individual (or even a small, self-selecting community like HN, or—probably, and with no offence meant—the readership of your blog) with a necessarily specialised viewpoint; and that a large group is more likely to buy in to "let's create a new standard!" than "let's use my / my community's standard that I / we created without your viewpoints or input!" - Alternatively, if one believes (as it seems you do) that the solution will start with an individual, then surely the thing to do is to deliver a product, not a promise. I don't know about anyone else, but my reaction when I see assurances of delivery RSN is automatic scepticism.

tptacek 12y ago

Mobile - Using PGP on a mobile device can be risky, as it requires storing the private key on devices that are likely to have known security issues. Many people recommend against it, as it puts the private key at too much risk. ARGH. The whole point of PGP keyrings --- the costliest part of the PGP UX --- is that you don't have to have a single key. If you're terrified of exposing your secret key on your mobile device (which is frankly the most secure device you own), just cut a new key for it. Any time someone suggests a new application for PGP, people come out of the woodwork saying things like "what, you want me to put my PGP key in my browser?" No. We want you to put --> a <-- PGP key there.

adamcaudill 12y ago
Yeah, I have mixed feelings about that one; I almost didn't include it, but it's an argument that I hear often enough that I thought it was worth pointing out. Personally, I have my key on my phone, and I'm fairly comfortable with it - though there are certainly some that aren't.
click170 12y ago
But, wouldn't that mean that if you share the same email account on your Desktop and Phone, that using a different key on your phone would mean you could not decrypt emails intended for your Desktop? My understanding was that you can associate a key with your email address, does this just mean you would have two keys associated, one for "me@me.com Desktop" and one for "me@me.com Phone"?
- tptacek 12y ago
  You can encrypt messages to more than one key. You have to be pretty fussy to begin with to even have this concern.
jiggy2011 12y ago
> If you're terrified of exposing your secret key on your mobile device (which is frankly the most secure device you own), just cut a new key for it. The mobile device is the one most people have the least control over in terms of software (which can be both good and bad) but is also the one they are most likely to lose in a shady part of town. I agree with the rest of your post though.

lifeisstillgood 12y ago

Ok, I'll bite. This is a good post - I am negative on your ability to pull this off, but it's a worthwhile discussion to have IMO * Totally anonymous (ie no metadata trail) communication seems impossible / impractical. If everywhere is the Tor then we massively increase traffic, (not to mention the trustworthiness of "everyone" is a lot lower per unit than everyone currently running a tor node) Anyway, even if a encrypted anonymous message arrives for me, just working out who it's from without any metadata seems complex web of double decryption I do struggle with how anonymity is going to solve all problems with totalitarian states. In the end we need to solve this in the real world of politics and execution squads so we don't mortally worry about letters or emails being read. * there is a lot more here than my tired brain can handle - but my main concern is a simple human one - if secure anonymous comms is "impossible", then I could see levels of secure encryption (sent from my iPhone, sent from my PC hardwired at home that has a secure USB boot on my key ring). But this idea demands that as the recipient I work hard to determine from context if the message is secure - aha it's 11pm in the UK and Adam just mailed me a secure note saying we should give everyone an Owl. Chances are high he is pissed and his mates sent it. Once technology stops helping us make those decisions it's kind of pointless - May as well just keep sending clear text is not an irrational stance. Be interested in the discussion in the morning - cheers * lastly - what email client do you guys use that allows gpg on mobile?! Edit: clean up

narrowrail 12y ago
K-9 mail on Android. Not sure about iOS, but I have seen an implementation somewhere on code.google in the past (not sure of its current status).
- lifeisstillgood 12y ago
  Thanks - am looking to jump to the dark side soon anyway :-)
- mike-cardwell 12y ago
  K-9 Mail is good, but it doesn't support PGP/MIME. Only inline PGP. Doesn't look like they will either as it's been on their todo list for several years now with no progress.

ams6110 12y ago

I think of email like a postcard. It's addressed to me, but anyone can read it if they snoop in my mailbox. I don't expect it to be really secure, and I don't do anything that requires real security via email. Simple enough.

leeoniya 12y ago
what arrives in your inbox is often out of your control. account confirmation and password reset emails, pictures/info others send you who are more satisfied that you with the level of privacy normal email provides, etc.
- raving-richard 12y ago
  Yes, to extend the postcard metaphor, it's like the bank sending a bank card PIN on a postcard. Not secure at all.

htns 12y ago

I would suggest taking a look at I2P-Bote. Although I haven't had it installed for a year at least, I2P-bote seems to be a slow-moving project, with lots of features TBD, but it does hit all the keywords.

RexRollman 12y ago

The title "The Sinking Ship of E-Mail Security" implies there once was security but there never really was. For the most part, email is more like a postcard than a sealed letter.

adamcaudill 12y ago
Good point. I should have thought of a better title.

x1798DE 12y ago

I've thought a lot about this and so far the solutions I've seen put forth (e.g. Flowingmail, Bitmessage, for starters) don't seem likely to get any widespread adoption, and that can be the death knell of anything like this that relies on network effects. Hell, I can't even get people to send me a PGP key even when I refuse to send them important documents without one (they just say they're going to send me one later, then forget about ever getting the document they wanted). It's really not that hard to generate a PGP key, but even motivated people don't do it. My immediate intuitions are that 1.) this is a very hard problem to solve and 2.) if it's going to be solved in any reasonable amount of time, it needs to be bootstrapped into existing, popular methods of communication (such as e-mail). Adding some sort of PKI into the existing e-mail spec would probably be a good start, since it's just not something that people are used to dealing with.

donniezazen 12y ago

I am always scared that if I start signing my emails (the least I can do) they might start looking weird to my friends, family, and colleagues. They may even think that the block of gibberish may be spam. I do like my KDE KMail client which masks the signing information and presents signed and unsigned messages in a sane way.

lifeisstillgood 12y ago

This has really got me thinking about an architecture I had not really considered before so forgive the obvious in this - it's partly aide memoire and partly a contribution to OP - goals of the "new email" should presumably be to reduce the ability of state actors and major comms providers to collect sufficient metadata to conduct mass surveillance for tyranny or profit. as such we can try either - Vast citizen owned mesh networks (ie every smartphone is a ISP) - Anonymity over traditional large ISPs / backbones Anonymity is hard. We could encrypt entire message and then round robin decrypt each incoming message, this would cripple all metadata apart from the TO: field and mean any listener would need to own most entry points to catch the first uptake. It seems difficult - webs of trust, guessing the encryption key. Add in other constraints - all messages in transit and at rest are encrypted - gmail becomes no more than S3 - and we see the end of free email, and weirdly a return to POP3 as the client must store all my mail. If this does exist however, why restrict it to emails - every message format seems similar - MQ and Facebook can all go this way. Mesh networks have even greater barriers to uptake ...

rakoo 12y ago

Pond (https://pond.imperialviolet.org/ https://pond.imperialviolet.org/) seems to hit some keywords you mention.

e12e 12y ago

From a quick look around, it looks like the best bet on asynchronous forward secrecy that doesn't rely on a (highly) trusted server (one that eg: shares a secret with every sender and receiver, kerberos-style) is something along the lines of "The Text Secure Protocol"[1]. No reason why this couldn't be bolted on top of email (send the actual message as an attachment like with pgp/mime). It would probably create a new set of metadata (requests to the recipients "half-key" service/server (locating which could be delegated to SRV records or something similar, with domain derived from the email address) -- but I'm not aware of any other schemes for generating ephemeral keys in a reasonable manner compatible with (semi)asynchronous communications. It does seem like "true" off-line message composition wouldn't be possible (the email client (or client service) needs to go online in order to encrypt/pack up the final message. This means that drafts/messages "in transit" would be possible to recover from the senders device in the case of eg: several mails being written on a flight w/o net access, and a search/seizure before mails could be encrypted to the receiver). All in all, this sounds like a tricky problem... Anyone know of any recent bright ideas in the field of PFS for asynchronous messaging? [1] https://whispersystems.org/blog/asynchronous-security/ https://whispersystems.org/blog/asynchronous-security/