I wrote a blog post on using mailvelope to send/receive encrypted emails via existing mail providers such as Google mail ... Linked into my post about getting a private/public key pair using keybase.io I'd like to think they explain it fairly well but I hadn't considered the implications of people believing they're more secure than they actually are ... Until I read the comments here - disclaimer: not claiming encrypted email is super secure or even necessarily that using mailvelope is super secure but just wanted to make it look less scary to the uninitiated
Encrypted email is still a pain
221–230 of 450 posts
Re: Encrypted email is still a pain
#222It is indeed a pain. That's why I made https://cryptup.org/ For some of my users, using Gmail itself is already challenging. Yet they are sending around PGP encrypted messages, attachments, etc. Even my mom is using this. For encryption software, moms count double.
theres something screwy with the images on the testimonials part of the page: http://i.imgur.com/RFoqpKwl.png
Re: Encrypted email is still a pain
#223Earlier quoted context omitted.
>How do you get+trust the other's key? Snail mail + several other out of band methods. Or you can exchange a one time pad, physically.
This also raises the question: With a walled garden like Signal/Wire/etc, how do you get+trust the other's key? Their convenience comes at a cost.
There are mechanisms to use out of band communication to verify a key:
https://github.com/WhisperSystems/Signal-iOS/wiki/FAQ#can-i-...
https://support.wire.com/hc/en-us/articles/207692235-How-can...
Re: Encrypted email is still a pain
#224Keybase.io brah. Simple!
Re: Encrypted email is still a pain
#225Most prominent mail clients have built-in S/MIME support (Outlook, iOS, Thunderbird, Mail.app on macOS). The problem is that the there is no easy and free/cheap way to get an S/MIME certificate. My hope is that Let's Encrypt or Keybase or someone will make this easier someday.
Re: Encrypted email is still a pain
#226It is indeed a pain. That's why I made https://cryptup.org/ For some of my users, using Gmail itself is already challenging. Yet they are sending around PGP encrypted messages, attachments, etc. Even my mom is using this. For encryption software, moms count double.
theres something screwy with the images on the testimonials part of the page: http://i.imgur.com/RFoqpKwl.png
(edit: it's fixed now)
First time I see it like that, I assume one of your plugins is blocking it (direct links to google profiles). I'll store the images & serve them directly. Thanks!
Re: Encrypted email is still a pain
#227Encrypted email is pretty much over in 2017. The emerging consensus among experts is that it's not worth the trouble, or, worse, incapable of doing much more than generating a false sense of security. That's for a bunch of reasons: * An enormous installed base of clients that won't do encryption, meaning that at best you're attempting to tunnel encrypted messaging over an unencrypted transport. * A protocol that leak…
> The emerging consensus among experts "conseunsus"? a few blog posts about some bad user experience with GnuPG / the PGP ecosystem is, at best, just an (re)emerging topic on HN, not the end of email encryption. OpenPGP implementations may not be the easiest encryption software out there (its usability issues have been discussed for two decades now) but that's simply because PGP was not designed to be used by the lai…
> "consensus"? a few blog posts about some bad user experience with GnuPG / the PGP ecosystem is, at best, just an (re)emerging topic on HN, not the end of email encryption.
Well, tptacek is himself an expert. As he's the founder of a successful security consultancy who has friends among academic cryptographers, I took his comment to mean the belief among himself and his peers.
It's ultimately an appeal to authority, but it's a useful data point. Maybe there are different "circles" of security/cryptography experts, and tptacek runs in a different one from others who haven't given up on email, but I suspect he would have said that if that's the case.
Re: Encrypted email is still a pain
#228Do any of these keyservers perform email verification? It would go a good way towards some kind of verification that a user's GPG key corresponds to their email. Otherwise, anyone can generate a key with any email address and push it up to the servers. The standard way of verifying it (key-signing parties) is somewhat difficult.
FWIW, although everybody talks about their new chat system, key verification is one thing keybase.io does well.
Looking forward to the mobile client, which is only showed on blog post, already announced from a year or so, but never seen on the stores...
Re: Encrypted email is still a pain
#229Earlier quoted context omitted.
The hardest problem, IMHO, has been key management. How do you get+trust the other's key? I think a combination of keybase + a useful client can help, but the reasons listed in parent are pretty convincing.
If you care about the physical identity of someone: web of trust. At some point, you'll have to ideally meet at least one person in the flesh to exchange keys and verify their identity. After that point, it's possible that others you are trying to communicate with might be within your web of trust. If not, you'll have to go through your keysigning procedure again. https://www.gnupg.org/gph/en/manual/x334.html Some or…
> After that point, it's possible that others you are trying to communicate with might be within your web of trust.
The problem with the web of trust is that it simply doesn't work: the fact that I know you means nothing about whether I trust you to vouch for others. The fact that I trust you to vouch for employees of Acme Widgets means nothing about whether I trust you to vouch for members of the a political party.
PGP's usable despite the fact that the Web of Trust is kinda a misfeature.
Re: Encrypted email is still a pain
#230Earlier quoted context omitted.
Harder to prevent access to, harder to wire-tap. As other people pointed out WhatsApp has been blocked in countries before. Not to mention that with WhatsApp having a central location all messages are routed through we really don't have any guarantee that there isn't a compromised actor in there intercepting everything. Even if WhatsApp's crytpo is as flawless in implementation as we'd like FB still has access to all…
> Even if WhatsApp's crytpo is as flawless in implementation as we'd like FB still has access to all that metadata. Note that this argument is even more problematic for OpenPGP-encrypted email, as such email sends all metadata and some message data in plaintext.
I'm not advocating for WhatsApp or PGP encrypted email, I'm pointing out that people who make the line in the sand at "decentralized vs centralized" are boiling the problem too far down.