SoapboxSomeone finds a hole in something I’ve published. It’s late, they’re half sure it’s real and half sure they’re about to waste everyone’s time, and they’re deciding whether telling me is worth the next twenty minutes of their evening.
Everything I’ve built for that moment has been used twice in about twenty years. One of those two was me, testing it.
Two, and one of them was mine
That number is the best argument anyone has against me, so it goes first.
I’ve been publishing a PGP key in one place or another since I was young enough to think it made me interesting. Various addresses, various keyservers, eventually my own domain where no platform can revoke it. Across all of that, encrypted mail from an actual human being… one. The other was a test message I sent myself to prove the pipeline worked.
If you wanted to argue that publishing a key for security reports is a ritual hardly anyone participates in, you would use my numbers. They are the best evidence you have got.
It’s theatre. So is airport security.
So yes, it’s theatre.
But then, so is most of what happens at an airport. Very little of the queueing and the shoe-removal stops a determined person, and a great deal of it exists so that everybody moving through the building can see that someone has thought about this and taken it seriously. That isn’t nothing. I’d say it’s most of what the exercise is for.
What the theatre buys me is the only thing that matters at the moment I opened with. A stranger, deciding whether to bother.
They have no way of knowing whether my mailbox goes anywhere at all. They can’t tell whether a reply comes back from a person, or from a form, or ever. What they can see is whether the whole arrangement round it looks like it was built by a person who cares what turns up, and every visible piece of it counts as evidence one way or the other.
Email is plaintext on the wire and always has been. So the offer of encryption has to exist for the channel to be credible, even when almost no one takes it up. The offer is doing the work, and the cryptography barely gets a look in, which is an uncomfortable thing to write after the couple of weeks I spent building it.
The line I’d forgotten to write
I only found this next bit because I went to look at what a researcher would see, rather than what I remembered publishing.
I have a security.txt. It has the contact address, the expiry, the languages, the canonical URL, the policy link. It’s generated rather than hardcoded so the expiry can’t lapse on a day when I happen not to be looking. I’d been rather smug about it.
It had no Encryption: field, none at all. The key I’d deliberately published outside any platform’s reach, the one I wrote a whole post about publishing properly, was not mentioned in the one file a security researcher actually opens before deciding how to get hold of you.
Twenty years of publishing the thing, and no sign anywhere that I had.
A man who has received two encrypted emails in twenty years had somehow failed to advertise the possibility of a third!
It’s there now, two lines of it.
And there was a second one waiting in the same sweep: the key resolves by the WKD advanced method, and the apex path returns a 404. gpg tries advanced first so in practice everybody is fine, but a client that only knows the direct method gets nothing at all.
Both of those had been true for weeks while I was busy admiring the part I’d got right.
What the whole thing is standing on
The foundations are not good, and it would be daft to write all this without saying so.
Go looked at OpenPGP for the standard library and declined it, on the grounds that the thing is fragile. That was years ago now. The package is frozen, it carries an advisory with no fixed version at all (not “upgrade to this”, just: unmaintained and unsafe by design), and the fork everybody actually uses is kept going by one company for the purposes of that company’s product.
It is fine, in the specific way that a load-bearing wall nobody has ever inspected is fine.
That’s an awkward place to stand for someone whose whole pitch is a serious security posture, and I’ve not resolved it. I’m certainly not going to resolve it in the back third of a blog post (though I’d love to be the man who did).
The reason I keep it anyway is the stranger again. gpg is what a researcher has on their machine at two in the morning. Something more defensible that they’d have to stop and install first is a channel nobody uses, and a security contact nobody can be bothered with is worse than an imperfect one.
The channels I’d actually prefer
Asked what I’d rather have, none of my answers are PGP.
A properly configured and secured web form, over TLS, where the reporter doesn’t have to do anything but type. A peer-encrypted messaging service, where the hard part is someone else’s problem and has been solved better than I’ll solve it. Or, and this one only occurred to me while writing this, a direct message to my own Discord bot, which already sits inside my infrastructure and already knows who I am.
That last one is now on the bot’s backlog, which is a slightly absurd outcome for a post about whether a twenty-year-old key was worth publishing.
And I’d publish it again
That doesn’t change the answer, and the answer is yes, publish the key.
Making sure the channel for reporting a security problem actually works, and keeps working, is not paperwork about the security posture, it’s part of it, and a hole in the reporting path is a hole. I’ve spent months on the code and the infrastructure and the signing keys, and the route someone uses to tell me I got it wrong deserves the same attention, arguably more, because it’s the only part a stranger ever sees.
So the key stays. It’ll probably sit there another twenty years and get used twice more, and the second one will be me again, checking it still works after some change I’ve forgotten I made.
And that’s fine, because being used was never quite the job. It’s there so that at midnight, when someone is weighing up whether I’m worth the twenty minutes, there’s one more thing on the page that says I’d want to know.