Ask HN: Why is PGP not used widely?

Because its too easy to not use it. HTTPS has widespread adoption because end-users don't need to supply any cognitive resources to make the leap - until PGP occurs with the same simplicity it'll never see adoption amongst the commoners.

Huh, I don't see what I would have considered the obvious answer among what's already been said.

So, to me, the obvious answer is that if you want to use PGP, you first have to make everyone you intend to communicate with also use PGP. That's an obvious no-go. I would be happy to set it up, but what good would that do me?

I know some folks in the Air Force - all of their ID cards have public/private keys stored on them. They use them (plus a pin) for logging onto their computers at work, all of their e-mails are digitally signed, and the computer is locked just by removing the card from the card reader. Most personnel don't know a thing about public key encryption/two factor authentication, and likely wouldn't care if you offered to explain it to them.

I can imagine this could easily get rolled out if you integrated the public/private keys into driver's licenses. A quick search online suggests that blank cards are about $.06 each in bulk [1], but smart card vary between $.60 and $1.50 [2] (don't take this as definitive - I have no experience purchasing them). I don't think anyone would care paying an extra, say $2 or so whenever they get a new license for the cost of the card plus recouping the cost of hardware to print them.

Phase it in over time - have hand-outs at the DMV answering "What's this funny chip on my driver's license?" Gradually phase it in over time for online tax payments/water bills/etc. - something like "your username and password will be good until {date reasonably far in the future}, but after that you'll need a card reader. You can purchase one for $15 from any of these retailers: ..."

Once both the cards and readers are in place, it's a lot easier to get the critical mass to push for stronger authentication from banks, online retailers, etc. People worried about privacy implication could purchase their own cards from independent retailers and put their own keys on them.

[1] http://www.smartcardsupply.com/Content/Cards/cards.htm

[2] http://www.smartcardsupply.com/Content/Cards/ISO7816.htm

> First, I think we should rename the keys to 'locking key' and 'unlocking key'.

Why not go a step further and call one ‘key’ and the other ‘lock’? So you can share (copies of) your lock freely with others, and if they want to send encrypted email to you, they take your ‘lock’ and put it on that email. It then becomes obvious that you shouldn’t share the private key (after all, anybody could then unlock the locks) and that you have to make absolutely sure that you get the correct public key from others (as putting a ‘false’ lock on a letter doesn’t help).

Sure, this falls somewhat apart if you also want to consider signing…

The answer is Usability. It's a pain in the butt for someone like my Mom, Dad or most of my Friends to setup. Most digital security measures have a pretty high usability tax. I used to build out PKI systems and that was a nightmare to build correctly. It was costly to setup, develop and maintain, but it was secure.