I mean using (Keybase) https://keybase.io/ is pretty easy
this is specifically the problem they are trying to solve, too
One click encryption is one click too many
Why Johnny Still Can't Encrypt: Evaluating the Usability of a Modern PGP Client
71–80 of 165 posts
Re: Why Johnny Still Can't Encrypt: Evaluating the Usability of a Modern PGP Client
#72I mean using (Keybase) https://keybase.io/ is pretty easy
I have a keybase account that I used it the other day to have a few secrets sent to me from various sources. I have to say, even as a complete geek, I wasn't that thrilled with the experience.
I have a new machine so I had to go through the setup process. First I had to install node/npm, and then their stuff, and then some other PGP apps. The whole thing felt really clumsy.
I'm a bit of encryption novice, but for what I get, it feels like the openssl tools on my mac should be able to do everything without having to jump through all the hoops.
Then there's the user experience on the other side. I had to send people to the keybase page to get them to generate the message and then email / send that to me. That's annoying and probably verges on terrifying for non-geeks.
Afterwards I thought to myself, why can't I sent up an html / js page with my public key in? It would have a single box called "Send something to me" and it could do the encryption client side and then fire me an email, or stick it in firebase, or whatever.
I know this doesn't solve all of the issues (trust etc) but when I'm just trying to give customers a way of getting me a password or something without them sending it via email it goes a long way and removes a lot of the friction.
Re: Why Johnny Still Can't Encrypt: Evaluating the Usability of a Modern PGP Client
#73Earlier quoted context omitted.
SMTP with TLS doesn't leak any metadata except the connecting IP address. And with DMARC you can mandate it. Calls for whole new protocols for email are usually made by people who don't understand the email ecosystem as it currently stands.
Can the TLS be enforced by the sender all the way through the chain to the destination mailbox?
No, it can't. The receiver could be using a non secure SMTP server.
Re: Why Johnny Still Can't Encrypt: Evaluating the Usability of a Modern PGP Client
#74PGP does have a legitimate use case, namely Edward Snowden: he's technical, the NSA is his main threat vector, and it makes sense for him to spend lots of time reasoning about the web of trust, signing keys, double-checking fingerprints, and creating 12-minute explainer-videos for people he needs to communicate with (for reference: https://vimeo.com/56881481).
Here's the problem: not everyone needs the stringent encryption guarantees that Snowden needed. There is value in crypto systems that are less demanding than PGP, especially if they come with vast increases in usability.
iMessage, I think, is what most people need in their everyday life. It's end-to-end encrypted, and although it has a central key-server, it is backed by Apple, which has publicly announced their commitment to user privacy. Yes, a central key-server means that you can't verify the fingerprints Apple gives you, but again, that's not what iMessage's encryption was designed for. If you need that level of certainty, use Signal.
Re: Why Johnny Still Can't Encrypt: Evaluating the Usability of a Modern PGP Client
#75Backwards compatibility is the killer. The whole design of PGP is to be the envelope to make email private, versus the plaintext postcard that everybody can read. It works with existing servers and existing mail clients. The biggest Snowden revelation is the importance of metadata. Just knowing whom you talk to, when, is frequently enough to compromise the parties involved. You might be doing something legal now, but…
> In practice, I heard someone say that the biggest improvement in people’s privacy has been use of Gmail. In practice, until Snowden happened, NSA was able to access all the Google's internal data as Google replicated in plaintext its whole datacenters through the links snooped by the NSA or the GCHQ. http://www.slate.com/blogs/future_tense/2013/10/30/nsa_smile...
Correct. And now they encrypt all the inter-data center traffic.
Question: Is that done on an end-to-end basis? Or do they encrypt the links between data centers?
I want to encrypt a 10g ethernet and all the solutions look quite expensive.
Has anyone done high speed encryption (i.e. 10gbps/1500 byte packets) with strongswan or similar?
Re: Why Johnny Still Can't Encrypt: Evaluating the Usability of a Modern PGP Client
#76i'm not entirely sure this is worthy of a paper... its pretty much a common sense conclusion to reach if you've ever tried to use these things that the UX is usually terrible - even by the standards of a technical user.
too many manual efforts need to be made, even after setting up software that is purely designed to make this sort of thing easier.
mailvelope is a good example though - i've tried using it, but its not very clear what to do with it, and even once you get to the point of having the button appear in your gmail or whatever you have to then go and do even more things before you can actually send something that is encrypted. optimising this workflow should be trivial... a lot of this stuff can be done for you, e.g. by automatically enabling for common webmail sites, automatically generating some keys for you etc.
Re: Why Johnny Still Can't Encrypt: Evaluating the Usability of a Modern PGP Client
#77I see two major barriers to mass adoption of any crypto system that requires a UI. 1. Abstraction. For the non-expert, the only metaphor that works for PKI is that of physical security. The concept of a "key" as a series of characters or a file that must be protected must be replaced by an abstraction that allows users to protect it in the same way they understand how to protect a key or a wallet. So long as the "key…
I agree that some terminology could make it easier. I think "key" is an ok choice for the private key, but for the public key I think there could be a better analogy. Calling them the same thing is a bit confusing and people don't understand that one of them you give away, while the other is confidential. When I explain it to people I tell them that their public key is like an unlocked lockbox that you give people in…
I like this line of thinking. It seems that the word "key" is not the problem so much as the terms describing the respective key's status as opposed to their function. Perhaps something along the lines of "locking" and "unlocking" keys, or "encryption" key and "decryption" key (and, of course, "signing" key, no one has to know this is the same thing as your "decryption" key).
Re: Why Johnny Still Can't Encrypt: Evaluating the Usability of a Modern PGP Client
#78If someone could use your public SSH from say Github and send you a private message that would be great. From my understanding that is not possible. You need to generate and exchange PGP keys before, a major UX issue. Allow SSH public keys to be used and we'll be a lot closer to fixing the secure email issue.
Re: Why Johnny Still Can't Encrypt: Evaluating the Usability of a Modern PGP Client
#79PGP does have a legitimate use case, namely Edward Snowden: he's technical, the NSA is his main threat vector, and it makes sense for him to spend lots of time reasoning about the web of trust, signing keys, double-checking fingerprints, and creating 12-minute explainer-videos for people he needs to communicate with (for reference: https://vimeo.com/56881481 ). Here's the problem: not everyone needs the stringent enc…
What a non-sense.
We live in the information era, information nowadays is the ultimate power. Democracy depends on the balance of power between the people and the government. If the government has all the data, it has all the power.
Re: Why Johnny Still Can't Encrypt: Evaluating the Usability of a Modern PGP Client
#80If someone could use your public SSH from say Github and send you a private message that would be great. From my understanding that is not possible. You need to generate and exchange PGP keys before, a major UX issue. Allow SSH public keys to be used and we'll be a lot closer to fixing the secure email issue.
But they can, it's just not PGP.