Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I'm giving up on PGP

blog.filippo.io

Post reply on HN
Print view View original

61–70 of 350 posts

Re: I'm giving up on PGP

#61

Post by mixedCase »

CoryG89 wrote: post #11
mixedCase wrote: post #2

Dark Mail seems to be dead. Are there any efforts to make e-mail secure by default and e2e encrypted?.

There is a reason they mostly don't exist, at least in the US. After Lavabit was so publicly shut down, it's going to be a losing proposition for anyone to put so much time and effort into it, just to then be given a choice between providing a backdoor or shutting down as soon as the government realizes they can't break your service. If your going to start such a service, it needs to be in a country that will respect…

Lavabit didn't do E2E or at least stored the user's keys; since the owner did in fact have the keys needed to unencrypt the Snowden e-mails (and sent them to the FBI in paper using infinitely small character size, apparently).

Re: I'm giving up on PGP

#62

Post by nickik »

Nadya wrote: post #25
jgrahamc wrote: post #15

Earlier quoted context omitted.

This has been my experience. The only "good" experience I've had with encrypted messages through email was a back and forth exchange I had with a fellow Keybase user where I manually copy and pasted blocks of encrypted text into/out of their web interface.

From my experience - the only PGP users I've spoken to were all on Keybase or interested in a Keybase invite. It was about 6 people for the entirety of last year - and 3 people this year...it certainly has a problem of "almost nobody uses it" but Keybase seems to have eased things slightly - or at least made it easier to discover people who also use PGP. I see the two problems being "People don't bother with the clun…

Keybase has clearly moved away from PGP. They want to use Saltpack whenever possible, NaCl based encryption. They want to solve the problem of multiple devices and not having to share the private key between all of them.

As far as I know they are working on a messaging app as well.

Re: I'm giving up on PGP

#63

Post by mtgx »

psiconaut wrote: post #3

I find very interesting the point about the split between what WoT was supposed to be, in theory, and what little it represents, in practice, in terms of practices about key verification. It has been said many times that the lack of adoption of pgp in mail was due to the average user not being able to grasp the concepts behind the proper operation for key management, but the article points to common practices among "…

> I wonder if pgp is fundamentally flawed, or we have a deep conceptual usability issue here.

Why not both? PGP is definitely flawed with its lack of perfect forward secrecy.

Re: I'm giving up on PGP

#64

Post by smhost »

dom0 wrote: post #32
psiconaut wrote: post #3

I find very interesting the point about the split between what WoT was supposed to be, in theory, and what little it represents, in practice, in terms of practices about key verification. It has been said many times that the lack of adoption of pgp in mail was due to the average user not being able to grasp the concepts behind the proper operation for key management, but the article points to common practices among "…

> I wonder if pgp is fundamentally flawed, or we have a deep conceptual usability issue here. I don't think the "WoT" is conceptually flawed, and frankly, the argument that "people of average intelligence" can't grasp the concept comes from a very high horse and is also untrue. It's simply that any and all software for PGP utterly fails in the UX and functionality department when it comes to key management. Web of Tr…

The standard for adoptability isn't the average person at their peak hours of attention and focus. It's the drunk teenager at 2 in the morning fumbling around in the dark.

Re: I'm giving up on PGP

#65

Post by mtgx »

milge wrote: post #14

I've been thinking a lot about PGP and other encrypted messengers lately. It's incredibly hard to get a lot of people to agree on one messaging app besides default SMS. I wish there was an open source suite of tools for mobile/desktop that easily layered PGP on top of SMS/email experience and would fall back in the absence of keys. Perhaps bluetooth for swapping keys with friends. It's something that needs to be seam…

That's pretty much how TextSecure used to work for SMS, but you still needed to get people to use it for SMS.

Re: I'm giving up on PGP

#66

Post by ritonlajoie »

On a related thought, using a 'secure' (or so they say ?) email provider à là protonmail is just secure if you send your email to another protonmail user.

Problem with services like that is they omit to tell their users that email is not E2E, and sending from protonmail to gmail will just disable the benefits of using protonmail.

So yes, if you are trying to send encrypted email to a GMAIL user, your only way is to use GPG. Or to get them onboard of protonmail and the likes. It's... impossible.

Re: I'm giving up on PGP

#67

Post by kkl »

Freak_NL wrote: post #33
kkl wrote: post #8

Earlier quoted context omitted.

Most interesting e2e projects have abandoned email, specifically SMTP, as a secure messaging platform. I would look outside SMTP-based solutions if I were to start using a different project (assuming doing so is an option... I hope it is!). My recommendation here is Signal: https://whispersystems.org/

The author of the article mentions Signal as well, but how do you handle communication from a laptop or desktop computer and/or with people who don't own an Android or IOS smartphone?

Signal does have a desktop application. I believe you can also register a Signal account using a phone number from a service like Twilio. I'm not 100% sure that will work with Signal desktop though.

https://whispersystems.org/blog/signal-desktop/

Re: I'm giving up on PGP

#68

Post by mtgx »

45h34jh53k4j wrote: post #20
mtgx wrote: post #16

Earlier quoted context omitted.

Google's End-To-End also seems dead. https://github.com/google/end-to-end I would say ProtonMail or the miniLock-based Peerio.com are now the most interesting projects for encrypted email. EDIT: https://minilock.io/ https://github.com/PeerioTechnologies/peerio-client

Private keys accessible to the browser is the worst model. I don't think this was ever taken seriously at Google either...

It's not the worst model. It's still significantly better than what Google/Microsoft/Yahoo are offering.

And at least it's a model that can scale. When we'll get 10% of the email users to use (real) PGP, then we can talk about about switching everything else to it, too.

But I assume that's never going to happen. The only way PGP would reach those numbers is if Google actually finishes the End-to-End tool, and not only that, but then it actually makes it part of the Chrome browser and automatically asks all Gmail users at sign-in if they want to set-up End-to-End, too. That's the only way I can see PGP reach 10% of the email market. But even then I assume you'd argue it's still "browser-based" encryption. So I guess it's pointless.

Re: I'm giving up on PGP

#69

Post by nickik »

45h34jh53k4j wrote: post #20
mtgx wrote: post #16

Earlier quoted context omitted.

Google's End-To-End also seems dead. https://github.com/google/end-to-end I would say ProtonMail or the miniLock-based Peerio.com are now the most interesting projects for encrypted email. EDIT: https://minilock.io/ https://github.com/PeerioTechnologies/peerio-client

Private keys accessible to the browser is the worst model. I don't think this was ever taken seriously at Google either...

Private key required in the browser is bad. However if we had a system where those people that want or care can key their keys offline (or on a Smartcard) while those that don't want.

Protonmail with SRP and 2FA where a attack has to pretty tricky stuff but you still get a e2e system is far better then what we have now. Its a far more involved attack to just look at your old emails, and its easier to detect.

We will never have a useable experience for all user if we do not accept compromises. I would prefer if everybody of my family was on some system like that, compared to gmx or yahoo.

There is a lot more you can do to protect the client from the server as well. Keybase is doing some interesting stuff in that direction.

We just have the change our assumption of what it means if a email arrives encrypted with GPG.

GPG is already not perfect and we should move away from it anyway, again, Keybase is offering some interesting steps in the right direction.

Steps on a long road.

Re: I'm giving up on PGP

#70

Post by nickik »

epistasis wrote: post #53
qrbLPHiKpiux wrote: post #36

9/10 end users just don't understand that security and convenience are inversely related.

Systems like Signal and WhatsApp show that that's not necessarily true to the degree of previous solutions.

They only manage that by compromising on other fronts. That is not an option with E-Mail.
Post reply on HN