Encrypted email is still a pain
incoherency.co.uk
Encrypted email is still a pain
1–10 of 450 posts
Re: Encrypted email is still a pain
#2https://gpgtools.org/ works great for Mac.
Re: Encrypted email is still a pain
#3https://gpgtools.org/ works great for Mac.
For technical folk, yeah. For nontechnical folk, nothing seems to come even close though. The great thing about HTTPS, for example, is all users need to care about is a little green lock. (And frequently, they have no idea what HTTPS is, but know that little green lock === safe)
Re: Encrypted email is still a pain
#4Ooh, I know this one! I think. Doesn't Apple Mail have this built in? I go to Keychain Access, choose the option to generate a key. Two clicks. Head to Mail, encryption options are there. Now, to import his key. Do some googling on that.
Wait, what? Apple Mail supports S/MIME, not GPG. Competing standards strike again.
If the other person has S/MIME, Apple Mail does have a very easy experience. I can't speak for the merits of either security-wise.
Also, I think this is the sort of thing Keybase is good for. There's a level of indirection pasting into Keybase, but it's pretty easy to set up and (for non-Snowden levels of paranoia) makes it very easy to start sending encrypted mail to somebody else. The new Keybase chat is also an option.
Re: Encrypted email is still a pain
#5https://gpgtools.org/ works great for Mac.
For technical folk, yeah. For nontechnical folk, nothing seems to come even close though. The great thing about HTTPS, for example, is all users need to care about is a little green lock. (And frequently, they have no idea what HTTPS is, but know that little green lock === safe)
> little green lock === safe
Which is not true. Little green lock means the site has HTTPS, being safe requires much more than that. Security is hard to explain.
Re: Encrypted email is still a pain
#6This article: what a shitfest.
But seriously, I was expecting some actual discussion about how GPG still isn't easy (or possible for that matter) in modern webmail clients, or even something relating to the usability of common GPG GUIs, but instead just got a guy complaining about how he was pressing enter too fast and missed a dialog box, among other nonsense complaints.
Personally, the GPG CLI acts exactly as I expect it to, being a CLI and all, and I don't expect non-advanced users to use it.
Re: Encrypted email is still a pain
#7Encrypted email is pretty much over in 2017.
The emerging consensus among experts is that it's not worth the trouble, or, worse, incapable of doing much more than generating a false sense of security. That's for a bunch of reasons:
* An enormous installed base of clients that won't do encryption, meaning that at best you're attempting to tunnel encrypted messaging over an unencrypted transport.
* A protocol that leaks metadata, including some message content, at the envelope layer.
* Hundreds of millions of users that primarily access messages through browser clients that can't meaningfully implement crypto.
* An archive-always UX that ensures that huge amounts of plaintext are scattered around the Internet by both senders and receivers.
* An unencrypted installed base that ensures encryption will be opt-in for the foreseeable future, meaning that users will routinely reveal plaintext accidentally by, for instance, quoting messages and forgetting to encrypt.
* End user demands for things like search that can only be delivered efficiently at scale by databases of plaintext (most likely at centralized servers).
All these problems are probably surmountable (with enormous, concerted effort). But: why bother? Email is just one of dozens of messaging systems available to Internet users. Better to move sensitive conversations to things like Signal, WhatsApp, or Wire --- the double ratchet construction is designed specifically to make IM-like protocols secure even when conversations are sporadic and last months.
Re: Encrypted email is still a pain
#8Earlier quoted context omitted.
For technical folk, yeah. For nontechnical folk, nothing seems to come even close though. The great thing about HTTPS, for example, is all users need to care about is a little green lock. (And frequently, they have no idea what HTTPS is, but know that little green lock === safe)
> little green lock === safe Which is not true. Little green lock means the site has HTTPS, being safe requires much more than that. Security is hard to explain.
Of course, but this is nonetheless the view for typical end users.
Re: Encrypted email is still a pain
#9I thought "GPG isn't so hard, let's send him an email!"
The key fails CRC check and doesn't import.
heh
Re: Encrypted email is still a pain
#10If you're OK with using a third-party and would rather stick to GUI's, Virtru is a very easy solution for email encryption: https://www.virtru.com/