[Discuss] privacy with pgp keys

[dsr at randomstring.org (Dan Ritter)]

On Fri, Sep 11, 2015 at 11:28:47AM -0700, Rich Braun wrote:
> This thread about PGP inconvenience reminded me of the yet-unsolved problem of
> dealing with finance professionals.  H&R Block (a firm for which I once
> worked, as a front-line preparer) has a "secure portal" which their corporate
> parent encourages customers to use for document transfer.  Yet the guy I
> worked with at the downtown office this year said he had no access to that, so
> I had to hand over my docs on a thumb drive.

Odds are pretty good that he technically does have access
there... and has never figured out how to use it. Or it is
unreliable. Or it *was* unreliable when he was first told
to use it.

Human problems. Difficult to solve.

> Last year I bought a home, and found myself having to dig out an antique *fax*
> machine to "securely" send documents.  Some of the participants used the
> Docusign cloud service, but for the most part everything had to be done
> old-school. (And I'm not at all convinced that Docusign addresses many of the
> security fears that I have whenever I transmit credit- and income-related
> paperwork.)

I read through their terms of service on the customer end a few
months ago. It's not entirely horrendous, but it's not great,
either. They don't do end-to-end encryption. What they do is
this:

- all access is authenticated with username/password or better
  (several kinds of 2FA are available)

- all access goes through HTTP/SSL (ok, TLS) with reasonable
  algorithm choices

- all files received get dropped into encrypted filesystems
  along with hashes.

- they replicate the filesystems to 3 data centers, probably by
  sending off copies of new files as they come in.

- they log things off-system and sign the logs

Most importantly, they have managed to convince regulatory
authorities that this is sufficient for legal paperwork,
including contracts to authorize sending lots of money various
places.

-dsr-