Why Johnny Still Can't Encrypt: Evaluating the Usability of a Modern PGP Client

I think we should start with an EXTREMELY simple app that does not attempt to do any fancy e-mail client integration, but is aimed at making it possible for non-nerds to send one-off secure mails and files in a way that is at least SLIGHTLY fun.

Keybase, GPGTools, and all of these things have different features and menus and all kinds of stuff which makes them EXTREMELY intimidating.

My mom is a teacher of computers, she is an expert at Excel and basic Windows things and Twitter and mail and she's even somewhat into Bitcoin, but crypto makes her instantly freeze into "oh my god what is happening I am terrified and confused" mode.

Today she needed to send some encrypted JPGs to verify her identity for some Bitcoin wallet thing. The support asked her to please encrypt her stuff with our public key.

When she opened that public key it came up in Notepad++ as a huge intimidating block of random characters. That was probably enough to put her in a bad mood. After that she wasn't very receptive and I guarantee that every single guide or tutorial or program would be WAY too nerdy, boring, and complicated for her to follow step one.

Anyway I just did it for her on my Mac and I explained my thoughts as I did it and she said "see I understand the concepts but it's just too much stuff to know about to actually do it myself."

I said "yeah, that's what Snowden keeps saying, these things are just too difficult for normal people. Even Glenn Greenwald, that journalist you know, apparently he sucks at computers and it took him months to even install the crypto app."

So I wish I could have said "just go to crypto.express" (random made up available memorable domain) and follow the easy steps and you can encrypt your zip file pretty easily with just drag and drop and it's totally made for newbies but still Snowden-level secure.

I don't really think people in general relate to the paranoid wish to encrypt all your mail. They probably think more in terms of specific secrets that they care about protecting. So you could get them started on use cases like sending passport photos, passwords, codes, credit card numbers, or dick pics or whatever it may be.

Once they have some tiny bit of successful experience with using private/public keys that one time, and it wasn't super impossible like they thought, they might be more open to learning more sophisticated ways of using crypto, such as automatically encrypting and signing mail.

I just tried it and it seems like a pretty good start!

It doesn't seem to have launched publically yet but I hope they will have a landing page with utterly clear copy in a large font written with the mindset that for example this sentence

"Once you have entered your email address, SC4 will automatically provision you with a set of random keys."

is terrifyingly incomprehensible gobbledygook.

...actually I might be confused right now but even I (a total smartypants guy) can't seem to figure out how to paste in somebody else's public key in there. The default option is to encrypt for myself, and I see no way to input another key, only a text box for the message...

Edit: oh, maybe the text box is for the keys, and the thing I want to encrypt should be drag and dropped? Either way, the UI as it is right now is difficult to understand, but I suppose it is a prototype.

Thanks! "They" is me :-) And yes, you can paste anything into the text box and the app should automagically do the "right thing" with it.

PGP's UX is so dismal I could almost believe the whole project operates under an NSA false flag.

Most "users" don't care about end-to-end encryption and instant messaging has already become the "better e-mail" on phones. The only way I see of breaking into this space is to make something for companies, because they still have reasons for a "better e-mail" and value encryption.