I'm not too sure. I am skeptical about the reality of replacing email any time soon, and more skeptical that a viable alternative for end-to-end encryption for email will present itself. If those two pessimistic assumptions hold true, then we're stuck with trying to make PGP easier to use. It's easier said than done, of course (I've tried and failed) but here's one way it could work: http://davidnoel.ca/specifying-a-pgp-client-that-your-grandm...
GPG and Me
41–50 of 267 posts
Re: GPG and Me
#42I am curious as to to know what mail clients people are using with GPG. In OSX I am not a big fan of the native mail client at all but it seems thats the only approach if you want to use GPG. I am currently on a quest to find a decent mail client that looks good and works well and I am currently trialling Airmail 2 but its GPG support is buggy at best.
Thunderbird & Enigmail. 7/10 would encrypt again.
Re: GPG and Me
#43As someone who trains human rights defenders and journalists on this stuff...I couldn't agree more. Often things end up being an unfortunate tradeoff between trying to get PGP working for people and having to settle for something less. Particularly in the developing world, which lower computer literacy rates - this is a significant problem. To be fair, at least Whisper Systems and the Guardian Project are doing great…
For people like this I write a simple shell script that abstracts away all the complexities and shitty UI. Never tried working directly with libgcrypt, I just let the regular gpg application handle it. Decrypting incoming mail automatically, checking to make sure outgoing is encrypted before sending and even regenerating keys and signing them is just a few shell commands you can script away. Projects like Tails shoul…
Interesting. Are you thinking of making the script publically available? I'm sure a lot of people would benefit from it.
Re: GPG and Me
#44It seems that the biggest problem with encryption in general is that of incentives. Great UX takes lots of design and iteration, which means someone has to pay for all those designers and front end devs. However, when you want good encryption, user experience always comes after security, which means you spend the majority of your resources on the security, not the design. So, we end up with great security and terribl…
I think you're right that UX and good security are often at odds, but I wouldn't go so far as to say that they _must_.
I view the current state of security in applications a a result of two forces: 1) The human dynamics of the roles involved: The disciplines of security and user interface design overlap very infrequently, and very rarely done alongside one another, collaboratively; one always tends to drive the other. For user-friendly and secure communication software to be written in an open source environment, too many stars have to align. 2) The market value of data: Software which can be monitored, and data of its users aggregated, analyzed, acted upon, and sold is more lucrative than making something which is truly secure, even from the authors.
I believe usable encryption is possible, but I don't expect it to come from grassroots open source efforts, nor from the big market players. If anyone, I expect to see it come a collaboration between large non-profits (such as Mozilla, EFF), and universities. In the current environment, they're one of the few with sufficient resources, organization, and motivation to get it done.
Re: GPG and Me
#45This is a very interesting point, all the more interesting that it takes someone with Moxie's clout for the message to come out. I've been in and out of the "GPG everything!" group over the years, and I definitely agree that GPG is a pain to use. I always figured this was because of the lack of proper frontends, and was hoping for the major influx of funding a couple weeks back would help it make progress in usabilit…
Mailvelope has made some strong efforts in this area. Though only as an extension.
Re: GPG and Me
#46I'm not too sure. I am skeptical about the reality of replacing email any time soon, and more skeptical that a viable alternative for end-to-end encryption for email will present itself. If those two pessimistic assumptions hold true, then we're stuck with trying to make PGP easier to use. It's easier said than done, of course (I've tried and failed) but here's one way it could work: http://davidnoel.ca/specifying-a-…
There's an interesting project that tries to replace smartphone IM application with an open alternative which builds upon the email infrastructure:
That could be taken as a starting point for how to make things more smooth for users.
Re: GPG and Me
#47Earlier quoted context omitted.
Isn't IBE quite slow? And also it requires a third party for keygen and so on.
What is IBE and who said anything about it? I was talking about EdDSA.
IBE is Identity Based Encryption, and it allows you to use your identity (name, email, etc.) as your public key.
There's nothing special about EdDSA compared to other digital signature schemes.
EDIT: Oh, I realize you were saying that ECC allows much shorter public keys than most signature schemes.
Re: GPG and Me
#48A lot of the comments I've been getting are in the genre of "well... but GPG works."
Yes, GPG is a powerful tool that makes some encrypted communication possible. But is it really "working" if it's the tool we've had for the past 20 years, and we still ended up in a world where surveillance is so ubiquitous and privacy is so rare? Having used GPG, it seems more likely to me that there are only ~50k GPG users in the world because of the product, not because of weak desire or need for private communication.
I'm not suggesting that there's anything "better," but that it's really sad there isn't. GPG isn't ever going to be anything other than what it is now, and I don't think that's the future we want for ourselves.
We could try to slap a GUI on top of it, but I don't believe great products are made that way. Good UX requires thinking about interactions all the way down to the protocol. The good news is that GPG has such a small legacy install base (literally on the order of ~50k users), that there's no reason to maintain compatibility with OpenPGP. When building new products, we can start fresh with modern cryptography, a modern protocol, and a modern design philosophy.
Re: GPG and Me
#49Earlier quoted context omitted.
> However, when you want good encryption, user experience always comes after security I'm going to throw down a gauntlet: encryption design that doesn't start with designing for the human users is already fundamentally broken. Why? Because it cannot represent a solid system. This isn't machines in the Matrix talking to one another: the needs of the human users are the only thing that matters. Combine that with the pa…
If you can't even get two machines in the Matrix to talk to each other securely, how can you expect to succeed with human error thrown in the mix?
That seems to be a straw-man which misses my point. I'm not saying that cryptosystem or broader security research is without merit; that's obviously false. Rather, the major problems with cryptosystems under large-scale adoption are limited not as much by technical encryption design, but by exactly the lack of human UX design that the parent post referred to. If your thinking about "end-to-end" stops at the computer and not at the human, that's become a rather enormous issue.
Re: GPG and Me
#50GPG is an immense failure from the point of protecting person to person communications. It is largely a success in verifying the identities of the software developers. The entire Debian ecosystem relies on GPG in largely successful ways. Peter Todd suggests that PGP drop encrypted communications as a goal and focus only on identity and authentication. It appears the PGP just can't be bootstrapped into modernity from…
GPG still could be much better for those applications. For example, it is still impossible to do GPG multi-sig (e.g. have the application developer and the distribution release manager sign off on the binaries).