Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Encrypted email is still a pain

incoherency.co.uk

Post reply on HN
Print view View original

311–320 of 450 posts

Re: Encrypted email is still a pain

#311

Post by maxerickson »

cvwright wrote: post #300
maxerickson wrote: post #223

Earlier quoted context omitted.

There are mechanisms to use out of band communication to verify a key: https://github.com/WhisperSystems/Signal-iOS/wiki/FAQ#can-i-... https://support.wire.com/hc/en-us/articles/207692235-How-can...

Yup, and I've done these. But you can do similar things with PGP public keys, too.

I don't understand. You've verified a Signal key but still felt the need to ask the question With a walled garden like Signal/Wire/etc, how do you get+trust the other's key?

What cost were you talking about then?

Re: Encrypted email is still a pain

#312

Post by brightball »

DennisP wrote: post #299
anigbrowl wrote: post #272

Earlier quoted context omitted.

You know, I've been having this conversation ever since PGP first came into existence. And much as I love the idea of encryption, and despite having invested lots of time in arguing for the right to encrypt and to share encryption algorithms etc. etc. I've always had to admit that if you're not a geek who loves computing for its own sake then encrypting all your email is a massive pain in the ass, whose costs substan…

These are good points but I'll nitpick on one of them: we already maintain a collection of emails, phone numbers, etc. for everyone we know, and a public key is just one more data point in the contact list.

That's true.

Seems like a great use case for a password management company to add address book management and/or develop an email client.

Re: Encrypted email is still a pain

#313

Post by anigbrowl »

DennisP wrote: post #299
anigbrowl wrote: post #272

Earlier quoted context omitted.

You know, I've been having this conversation ever since PGP first came into existence. And much as I love the idea of encryption, and despite having invested lots of time in arguing for the right to encrypt and to share encryption algorithms etc. etc. I've always had to admit that if you're not a geek who loves computing for its own sake then encrypting all your email is a massive pain in the ass, whose costs substan…

These are good points but I'll nitpick on one of them: we already maintain a collection of emails, phone numbers, etc. for everyone we know, and a public key is just one more data point in the contact list.

Totally agree; it's just been my experience that crypto specialists don't care about UX any more than UX people care about crypto.

Re: Encrypted email is still a pain

#314

Post by alkonaut »

Using encrypted email is only a solved problem (simple enough) when it's as easy as using https for all end users.

Right now it's on par with serving https, which is still way way too painful even for tech people.

Re: Encrypted email is still a pain

#315

Post by nickpsecurity »

tptacek wrote: post #22
pmlnr wrote: post #14

Earlier quoted context omitted.

> But: why bother? Email is just one of dozens of messaging systems available to Internet users. No, it's not. It's the only widely available, decentralized system, with which you can send to anyone, if you know the address. None of the big ones is this open. XMPP tried to address this and failed; now Matrix is trying again.

WhatsApp has over a billion users. There are big places where its market share exceeds that of SMS --- another big centralized service that has a userbase comparable to that of email. My conclusion is that the people who care about "decentralized" systems are a rounding error. I care about non-technologists managing to send asynchronous messages to each other that are well-encrypted by default. That's a solved proble…

There are in fact a billion users of a closed-source product owned by a surveillance company with history of subversive activity. They chose it over free or low-cost IM with privacy focus that were usable. They're opting against private messaging for various reasons.

Not an argument for or against any privacy solution if you're citing people who don't care or make sacrifices. They're not the demand side for private messaging. The solution for such people is security professionals getting employed with or consulting those groups to embed strong security into their products with continuous monitoring for subversion at source or repo level. They mostly arent doing that.

So, the WhatsApp point is broken twice: its users dont care enough to use something better; best security people talking WhatsApp security arent there improving or maintaining it.

Re: Encrypted email is still a pain

#316

Post by 293984j29384 »

sametmax wrote: post #273
mikeyouse wrote: post #250

Earlier quoted context omitted.

Out of curiosity, I plotted first class mail delivery vs. population: https://i.imgur.com/Fp2LLCg.png Annual per-capita mail delivery is down 50% in the US since Y2K.

So 20 years of internet, the rise of mobile and hi-speed connectivity, the multiplication of communications means including emails, chats, text and social network and the paper mail is still here. I still receive all my most important communications through the mail box, including anything related to administration, voting, my landlord, invitations to major life events, bank details, etc. Now if you hope to kill emai…

Well, I think some of this can attributed to personal preference. Each of the use cases you described can be accomplished via e-mail or other electronic communications. Other than a wedding invite or two every year, I receive no other personal mail. This didn't require any special technical skills, many organizations actually encourage you to setup paperless accounting when you sign up for a new account.

Re: Encrypted email is still a pain

#317

Post by jgilpin »

tptacek wrote: post #34
patrickread wrote: post #10

If you're OK with using a third-party and would rather stick to GUI's, Virtru is a very easy solution for email encryption: https://www.virtru.com/

Where by "email encryption" we mean "mail people a link to a service they can register with and then upload messages and file to, so that SMTP is used only to relay links to messages, not the messages themselves, and email is encrypted by dint of TLS connections". That's what most F-500 companies do to solve this problem. It's a more viable approach than direct encryption of PGP. Normal people --- and eventually the…

"and email is encrypted by dint of TLS connections"

Not exactly. Virtru customer-hosted keys are PGP wrapped before they go over the wire via TLS.

Re: Encrypted email is still a pain

#318

Post by nickpsecurity »

macrael wrote: post #297
anigbrowl wrote: post #272

Earlier quoted context omitted.

You know, I've been having this conversation ever since PGP first came into existence. And much as I love the idea of encryption, and despite having invested lots of time in arguing for the right to encrypt and to share encryption algorithms etc. etc. I've always had to admit that if you're not a geek who loves computing for its own sake then encrypting all your email is a massive pain in the ass, whose costs substan…

The fact that Osama Bin Laden didn't use PGP should be the final nail in its coffin.

That the NSA said GPG was gsme over for mass collection in the Snowden lesks should be a reason for everyone to try to improve its UI.

Re: Encrypted email is still a pain

#319

Post by Psilidae »

sigjuice wrote: post #225

Most prominent mail clients have built-in S/MIME support (Outlook, iOS, Thunderbird, Mail.app on macOS). The problem is that the there is no easy and free/cheap way to get an S/MIME certificate. My hope is that Let's Encrypt or Keybase or someone will make this easier someday.

Another comment on this article actually shows this isn't true: Comodo offers free S/MIME certificates. (https://news.ycombinator.com/item?id=13635591)

I went ahead and just grabbed one for myself after learning this.

Re: Encrypted email is still a pain

#320

Post by WalterBright »

djrogers wrote: post #296
WalterBright wrote: post #285

Earlier quoted context omitted.

The way to do it is to have it be a standard feature of the email client. Your client, if it supports it, generates the public/private key automatically. Every time it sends an email, it includes the public key. Every time it receives an email, it stores the received public key if there is one. Every time an email is sent, it encrypts it automatically if the address book has the public key. Over time, it will work it…

Missing - key backup/escrow, verifiable trust (you can't just trust the first key sent to you for a specific email address), key revocation, and portability. Solve too many of those problems and you've invented PKI...

Key backup - store it unencrypted on your own hard disk. The encryption/decryption is only for transport.

Verifiable trust - if it's a recipient you care about, you can phone them and ask if the key is correct.

Key revocation - easily done using email headers.

Portability - I proposed a portable system. Make it part of the email standard, just like the "Subject:" metadata.

Post reply on HN