Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: Why is PGP not used widely?

news.ycombinator.com

Post reply on HN
Print view View original

41–50 of 74 posts

Re: Ask HN: Why is PGP not used widely?

#41

Post by tomwhipple »

Root cause: Usability. It's difficult to quickly set up. But there are (at least) two components to this:

1. Portability. How do I manage keys across my computers, phones & tablets?

2. Ease of use. What do I do to set this up? Most common clients don't support PGP out of the box. Even once plugins are added, they are complicated to use.

As a result, no one uses it. So, if you want to start, you need to convince your friends/colleagues to also use it.

I've recently started signing email from my home computer as a hint to others to do the same. So far no takers.

Re: Ask HN: Why is PGP not used widely?

#43

Post by Sami_Lehtinen »

I'm using PGP with all my friends, as well as we have secured our normal SMTP transport with SMTPS and SSL certificate pinning. So everything is now double encrypted. Of course PGP key finger prints as well as SMTPS SSL fingerprints have been verified using alternate communication channel & personal verification. Many people think that SMTP is problematic, but SMTPS with certpin is actually quite good. Messages are only delivered over secure encrypted channel, and only to server which got right SSL cert. So even fake CA attacks won't help in this case, you'll need to have cert with exactly right fingerprint. Uh, yeah, don't use MD5 fingerprints.

Re: Ask HN: Why is PGP not used widely?

#44

Post by schoen »

I have taught PGP, find that at least some communities are increasingly interested in it, and hope more people will use it, though I think the forward secrecy issue alone shows the value of trying to replace it with a more modern design.

I think the logistical and conceptual parts of key exchange and verification are probably the most difficult for new PGP users. There are some ideas to make this more convenient; I know people who've produced some nice educational materials, and a colleague has a nice idea for making key exchange faster and easier among people on a LAN.

But I think the biggest obstacle in the long run may be just how fond many Internet users have become so fond of webmail and of being able to read their e-mail from any device. Having to use one particular desktop e-mail client on one particular machine to read encrypted e-mail is normal to me but may seem like a huge sacrifice if that's not what you're used to.

Re: Ask HN: Why is PGP not used widely?

#45

Post by pinaceae »

a) 99.9% of the population does not give a shit. oh great, now you're reading my emails with boring, meaningless stuff in them. exciting!

b) google would LOVE it. no more context sensitive ads. let's shut down free gmail then.

c) a and b intersect - if you're using gmail or ANY other big webmail provider, you just. don't. care.

Re: Ask HN: Why is PGP not used widely?

#46

Post by Pinckney »

I think one problem that's mostly overlooked is the difficulty of getting people to use desktop email clients. Particularly in my younger generation, we've grown up with webmail, and switching to desktop clients is a major switch.

I've also always found them to be very difficult to configure. I use one SMTP server on campus, and need to use my ISP's SMTP server elsewhere? What if I'm on public wifi? And how do I authenticate on that server when my credentials are from someone else? How do I get Gmail to play nicely with my folders?

PGP, in contrast, was not hard to set up.

Re: Ask HN: Why is PGP not used widely?

#47

Post by scrrr »

It's a pain in the ass, thats why. It's hard to explain and it's hard to implement. And don't forget about mobile: If your locked down phone is compromised (and I wouldn't assume it's not), then even if you have PGP running you can forget about security.

Heck, even your desktop can be completely compromised. I think there's a big chance it is. If not by the NSA then by some malware.

Re: Ask HN: Why is PGP not used widely?

#48

Post by a3n »

kintamanimatt wrote: post #20
dalek_cannes wrote: post #14

I think it's because there still isn't a good metaphor that covers up the complexity of public key encryption. Such a metaphor is a prerequisite for a UI that the average user can comprehend. First, I think we should rename the keys to 'locking key' and 'unlocking key'. I've had people still scratch their heads at 'public/private' a few days after I've completely explained the concept to them. They find it easier to…

The problem with the key exchange mechanism you've described is it's untrustworthy. The software would be essentially asking "is this initial email from the person you think it is?" which is a tough question to answer given the fact that emails can be readily spoofed. Granted, Bob's key will differ from Mallory's key, but there may be just enough time to do bad things before detection. Key exchange between people sho…

> Key exchange between people should always require some kind of offline verification. If you don't do this, you can't really trust that the person you're communicating with is who they say they are.

I know a lot of people who I've never met IRL and likely never will. When you think about it, I already don't know that they are who they say they are.

Many of them live far from me. I don't see a practical way to exchange keys with them offline. You have to travel and do it face to face, or trust that USPS, UPS or FEDEX haven't been compromised. Sure, that's very unlikely for Joe Blow, but still, you're doing it offline for security.

Lastpass and probably others have an online secure exchange tool, but then you have to trust Lastpass (which I currently do, if very uneasily).

Re: Ask HN: Why is PGP not used widely?

#49

Post by hollerith »

csandreasen wrote: post #26
betterunix wrote: post #11

In my experience it is mostly due to annoyance. PGP is seamless until someone tries to check their mail on their friend's computer and discovers that encryption works as intended . Then all of a sudden they start begging you not to send them encrypted messages. I have yet to see any other reason for why PGP is not even used by people for whom it would be easy. Even within the security and cryptography research commun…

I know some folks in the Air Force - all of their ID cards have public/private keys stored on them. They use them (plus a pin) for logging onto their computers at work, all of their e-mails are digitally signed, and the computer is locked just by removing the card from the card reader. Most personnel don't know a thing about public key encryption/two factor authentication, and likely wouldn't care if you offered to e…

>I know some folks in the Air Force . . .

Interesting. Do all of their work computers run Windows?

Re: Ask HN: Why is PGP not used widely?

#50

Post by a3n »

I think as long as PGP or any encryption is an add-on to internet apps like email and the web, it's doomed for general adaptation and for effectiveness.

It needs to be a fundamental part of the individual apps' (email, web, etc) specs, or more ideally part of the underlying internet (tcp?) that apps are built on.

Post reply on HN