Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I'm giving up on PGP

blog.filippo.io

Post reply on HN
Print view View original

191–200 of 350 posts

Re: I'm giving up on PGP

#191

Post by tscs37 »

parennoob wrote: post #9

To me, Keybase ( https://keybase.io ) seems to solve the "PGP has a bad user experience" problem correctly for like 90% of the population. You post proofs of your public key to known media (Twitter, Github, your website, etc.) which you control. These can be checked by anyone. Even if the remote person doesn't know they are talking to you (as a human entity), they know they are talking to the combined online persona…

Keybase: Where I put my GPG keys which I basically only use to sign git commits for repositories that I'm most likely the only person that will ever lay eyes upon them but atleast I can verify that nobody pushed to them...

Re: I'm giving up on PGP

#192

Post by simias »

I have given up on the "web of trust" a long time ago for most of the reasons the author states. I think in order to work PGP would need to reach a critical mass of users that seems totally out of reach at the moment. Maybe if Google or Facebook starts issuing mandatory PGP keys linked with each account or something like that. Not sure why they'd want to do that though.

That being said there's still a lot of good and useful in PGP even if you ignore the WoT completely. I use it to secure my passwords, log into remote servers securely with SSH and I sign all of my emails with it, which is probably useless 99.9% of the time but at least it can be used in retrospect to prove that I did write those messages. I can also use it to sign git tags so that my code can still be trusted even if there's a breach in, say, github. I have a rather vast choice of GnuPG tokens I can purchase if I want an added layer of convenience and (hopefully) security.

Sure, WoT is simply unusable currently unless you're communicating mostly with hardcore PGP enthusiasts. That won't be enough to make me give up on PGP.

Re: I'm giving up on PGP

#193

Post by lbenes »

dom0 wrote: post #32
psiconaut wrote: post #3

I find very interesting the point about the split between what WoT was supposed to be, in theory, and what little it represents, in practice, in terms of practices about key verification. It has been said many times that the lack of adoption of pgp in mail was due to the average user not being able to grasp the concepts behind the proper operation for key management, but the article points to common practices among "…

> I wonder if pgp is fundamentally flawed, or we have a deep conceptual usability issue here. I don't think the "WoT" is conceptually flawed, and frankly, the argument that "people of average intelligence" can't grasp the concept comes from a very high horse and is also untrue. It's simply that any and all software for PGP utterly fails in the UX and functionality department when it comes to key management. Web of Tr…

I worked in IT for an engineering company that required all external emails to be PGP encrypted. Despite all engineers having Symantec PGP software installed and setup, training, and support of IT, they would often ignore this policy. The excuse, often valid, was it would require IT from both companies to setup the encrypted keys for the first time for new users. If the system is too complex for engineers, the idea of this being usable for the average users is a pipe dream.

PGP needs to be as simple as the SSL Lock in a browser if there is to ever be any hope of widespread adoption. There needs to be a single system of trusted PGP universal key servers that allow the details of key generation/management to be hidden from the user, just like SSL is with the web browser.

We'd still be using HTTP if SSL was as complex as PGP. Same ssh replacing telnet. E-mail's lack of progress on this front is primarily a UX issue, and until it's solved PGP will remain a tool for the select few.

Re: I'm giving up on PGP

#194

Post by gnuarch »

devilsavocado wrote: post #107

People who use PGP keys, can you give examples of your use? I'm genuinely curious. Who are you contacting, or who is contacting you? The author says he only receives 2 encrypted emails a year. Not only do I not have a PGP key, I don't think I've ever found myself in a situation where it was even an option to use one.

Mostly exchanging cat pictures with a good friend, keeping subject empty as it remains unencrypted. Once Enigmail is set up, it's basically harder to not encrypt.

Re: I'm giving up on PGP

#195

Post by zobzu »

it is mainly the tools that are blamed even in this post.

nobody wants to make a better sks keyserver or gpg cli. why? because you dont get no fame or money from it.

filippo show me your gpg commits.

Re: I'm giving up on PGP

#196

Post by andrey_utkin »

orblivion wrote: post #119

How is the author so seriously involved in PGP and only receive two encrypted emails a year? I'm basically just a dude who uses PGP because it's cool and I get tens of them. You just need one friend who also thinks it's cool.

Even Zimmermann, PGP author, has given up as this journal says https://www.scmagazine.com/phil-zimmermann-doesnt-encrypt-em...

Re: I'm giving up on PGP

#197

Post by Drdrdrq »

Yeah. A friend of mine said it best: "if there is a conflict between convenience and security/privacy/anything else, convenience always wins." PGP didn't stand a chance.

Re: I'm giving up on PGP

#198

Post by Steeeve »

psiconaut wrote: post #3

I find very interesting the point about the split between what WoT was supposed to be, in theory, and what little it represents, in practice, in terms of practices about key verification. It has been said many times that the lack of adoption of pgp in mail was due to the average user not being able to grasp the concepts behind the proper operation for key management, but the article points to common practices among "…

> I wonder if pgp is fundamentally flawed, or we have a deep conceptual usability issue here.

IMO, the idea, the model, and implementation are flawed.

The idea that people care about a web of trust in general is bad. The model itself relies on the assumption that it's a popular piece of software that is used in the way it's intended. PGP itself is popular, but only for the fact that viable alternatives are thin. The software implementation is confusing to technical end users, and third party front ends are just as bad.

Re: I'm giving up on PGP

#199

Post by Nadya »

andrey_utkin wrote: post #196
orblivion wrote: post #119

How is the author so seriously involved in PGP and only receive two encrypted emails a year? I'm basically just a dude who uses PGP because it's cool and I get tens of them. You just need one friend who also thinks it's cool.

Even Zimmermann, PGP author, has given up as this journal says https://www.scmagazine.com/phil-zimmermann-doesnt-encrypt-em...

A rather large misrepresentation of what was actually said.

>Zimmermann later clarified in a Motherboard article that PGP, acquired by Symantec in 2010, isn't compatible with his MacBook, and the technology never worked with any iOS device.

Re: I'm giving up on PGP

#200

Post by ihnorton »

IncRnd wrote: post #184
ihnorton wrote: post #158

Earlier quoted context omitted.

> How do you distribute the one time pad in the first place? I'm fairly naive to this area, but wouldn't video chat initiated with public keys suffice? Then confirm identities and exchange secrets. To me this seems substantially equivalent to in-person key exchange for non-Three Letter Agency threat models. 20 years ago this wouldn't really have been feasible, but today it (mostly) is -- from a quick glance at the FA…

A video chat is not enough to safeguard secrets to be used in the future. For one, if the video chat is secure enough for an otp exchange, the otp isn't needed. Secondly, if your video chat gets recorded, which may very well happen, you need to use ephemeral keys. Thirdly, since the video chat is likely recorded, at least the meta information, the effective security of your otp degrades over time, as new breaks or sp…

Interesting, thanks. Am I understanding correctly that point 2 & most of point 3 are risks because of the possibility of either future device compromise, or e.g. quantum decryption technology? These are very general risks, so why do they apply here any more than elsewhere?

I realized I probably should not have replied to the part about OTPs specifically. What I'm curious about is remote trust verification via secure video.

Post reply on HN