Years ago, working at a friend's security company everyone used Apple Mail with GPG. That is the only time anyone insisted on using encrypted email. Fast forward to the present: I support and like ProtonMail, but I can't talk anyone else into using it. I don't understand why more small companies, wanting to protect their intellectual property, don't use ProtonMail (or something like it).
Well, AFIAK ProtonMail doesn't have business accounts yet, they say they will be adding them soon though.
Totally agree; it's just been my experience that crypto specialists don't care about UX any more than UX people care about crypto.
Whoah. Hang on there. Crypto specialists aren't the people lobbying loudly for PGP-encrypted email in 2017. They're the ones who made the world's most popular messaging application double-ratchet deniably encrypted by default without the userbase even noticing.
> Nobody has completely nailed the UX for long-term long-form conversations, but services like Signal are designed with those kinds of conversations in mind. No, they're actually not designed with any kind of "long termness" in mind! Case in point - one cannot move to a new device and still have access to conversations that happened on the older device with Signal. All old conversations just have to die with the old…
Also, no way to have multiple separate conversations with the same person, or threaded conversations. These may just be app problems -- there may be protocol support for future applications to provide these (this is where Matrix stands today). But the lack of interest in these things doesn't look good.
I got a group of about 30 non-technies using Signal, not because they knew what what perfect forward secrecy is, but because they grew vaguely suspicious of the motivations of governments and Facebook, and people/Google-results they trusted were positive.
The details don't matter to ordinary people, but our approval matters much more than you think. I have very high hopes for Matrix.org.
Whoah. Hang on there. Crypto specialists aren't the people lobbying loudly for PGP-encrypted email in 2017. They're the ones who made the world's most popular messaging application double-ratchet deniably encrypted by default without the userbase even noticing.
Wait: which one is that?
Singal, nee TextSecure, I'd assume.
Edit: Crap, I mean WhatsApp, which _uses_ Signal's protocol now.
Encrypted email is pretty much over in 2017. The emerging consensus among experts is that it's not worth the trouble, or, worse, incapable of doing much more than generating a false sense of security. That's for a bunch of reasons: * An enormous installed base of clients that won't do encryption, meaning that at best you're attempting to tunnel encrypted messaging over an unencrypted transport. * A protocol that leak…
Every time I'm thinking of random side projects to work on, "make GPG easier to use" is always one of them. There are good things that can be done there, especially with things like keybase. Even a simple web-based (but completely offline) client would make it very easy for me to share encrypted text with colleagues and family, since they don't need to install something just to talk with me the 1% of the time I want to use encryption.
Each time I realize that Signal/Whatsapp/Wire are already doing much more here, and much better than I could do on my own. Sure, they're not email (sadface), but they've effectively solved this problem, by capitalizing on the paradigm shifts brought by phones -- there finally is a device on which to store keys locally (as opposed to on a server) that everyone has.
Forgive my ignorance, but what caused XMPP to fail? Simply the lack of uptake or is there some other reason?
Google, Apple, Facebook, WhatsApp. Everyone[0] is using one of these. None are XMPP or compatible with XMPP. [0] I don't technically mean the entire planet.
Curious why you tossed Apple in there. In worldwide usage it's a fraction compared to the other three. (I feel compelled to state I use an iPhone in order to avoid this comment being interpreted incorrectly).
thats a pretty terrible argument. And how it follows for your own logic is beyond me.
That the NSA cracked, backdoored, or intercepted most providers people trusted but couldnt beat GPG isnt an argument for GPG being secure? I think it's quite an endorsement for GPG given most people's adversaries will be weaker than NSA.
1) I don't take the snowden leaks as gospel, sorry.
2) Even if i did, "most peoples adversary" is a meaningless phrase at this point, and also used quite often as a rhetorical feint to take down someones arg. And given the profound unification of the security state across seemingly all lines, its also dead wrong. Technically everyones adversary is the NSA, as long as data is shared surreptiously and , more and more, openly and legally between TLA's, state, and local LEAs.
3) GPG may be an excellent tool, the first time you use it, but if you transmit anything encrypted you are automatically targeted, another point directly from the snowden docs, no? And since virtually no one is going to use one time devices and farraday cages unless your model of communication is "I just have to get this one message out, then I'm good" its worse than useless, given that it will only make you more of a target.
Let me contrast the author's experience with my own. Note that I had a brain injury during this process that made me forget scripting and GPG plus hard to learn. I'm a nice test case for how hard things are. :) So, I looked into GPG. Holy shit there's a ton of options and complexity. High-assurance security says subset to minimal thing that works for increased trustworthiness. I noticed it could encrypt files with ot…
I made this pretty quickly: http://kuuv.io/i/L4rZomr.png Slower than if I just used Python with tkinter since I wanted to learn a new UI framework with Clojure at the same time... But it's literally just a dropdown and some buttons wrapping some system calls to 'gpg'. I never bothered with the 'decrypt file' since I can remember 'gpg --decrypt' easily enough. :) So I agree using GPG isn't very hard, it's easy to make…
A GUI that wraps some system calls is how you end up using "p" for all your passwords. One of the many symptoms of OpenPGP not getting the investment it deserves and sorely needs is that there is no production-quality library implementation going.