Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

GPG and Me

thoughtcrime.org

Post reply on HN
Print view View original

71–80 of 267 posts

Re: GPG and Me

#71

Post by fensipens »

the_af wrote: post #60
moxie wrote: post #48

A lot of the comments I've been getting are in the genre of "well... but GPG works." Yes, GPG is a powerful tool that makes some encrypted communication possible . But is it really "working" if it's the tool we've had for the past 20 years, and we still ended up in a world where surveillance is so ubiquitous and privacy is so rare? Having used GPG, it seems more likely to me that there are only ~50k GPG users in the…

Hey Moxie, it intrigues me that the first thing you mention in your post isn't technical or even about UX (which is what most people in this thread are focusing on). Instead, it's that you're starting to dislike reading emails from the kind of person who would "voluntarily use GPG". I know you said there's no unifying theme to these emails, but can you elaborate? Maybe something about security-obssessed lay people us…

To quote another commenter:

"Way to take a dump on people who make an effort."

Re: GPG and Me

#72

Post by derekja »

moxie wrote: post #48

A lot of the comments I've been getting are in the genre of "well... but GPG works." Yes, GPG is a powerful tool that makes some encrypted communication possible . But is it really "working" if it's the tool we've had for the past 20 years, and we still ended up in a world where surveillance is so ubiquitous and privacy is so rare? Having used GPG, it seems more likely to me that there are only ~50k GPG users in the…

Please do this! I'd love to be able to use encrypted communications as a matter of course, but just not enough of the folks I work with are able to get it set up. My world is filled with smart people, but only a small fraction are purely computer folks and to try and get a biologist to understand why it's interesting to have all emails encrypted is a losing task unless it's super easy.

Re: GPG and Me

#73

Post by napoleond »

moxie wrote: post #48

A lot of the comments I've been getting are in the genre of "well... but GPG works." Yes, GPG is a powerful tool that makes some encrypted communication possible . But is it really "working" if it's the tool we've had for the past 20 years, and we still ended up in a world where surveillance is so ubiquitous and privacy is so rare? Having used GPG, it seems more likely to me that there are only ~50k GPG users in the…

What do you think that looks like, though? Is it TextSecure on the desktop, with file attachments? Is it Pond? Is it just email, but with a different crypto layer?

I feel like a lot of the things GPG aims to do are fundamentally hard. It's not the technology that sucks, it's the problem. I completely agree that the answer will come from thinking about user interactions first, but I'm not sure that the solution will look much different than a better GPG client.

Re: GPG and Me

#74

Post by napoleond »

the_af wrote: post #60
moxie wrote: post #48

A lot of the comments I've been getting are in the genre of "well... but GPG works." Yes, GPG is a powerful tool that makes some encrypted communication possible . But is it really "working" if it's the tool we've had for the past 20 years, and we still ended up in a world where surveillance is so ubiquitous and privacy is so rare? Having used GPG, it seems more likely to me that there are only ~50k GPG users in the…

Hey Moxie, it intrigues me that the first thing you mention in your post isn't technical or even about UX (which is what most people in this thread are focusing on). Instead, it's that you're starting to dislike reading emails from the kind of person who would "voluntarily use GPG". I know you said there's no unifying theme to these emails, but can you elaborate? Maybe something about security-obssessed lay people us…

It's the same as people who voluntarily use Windows. It says something about them, that's all.

Re: GPG and Me

#75

Post by Ao7bei3s »

tptacek wrote: post #55

I don't want GPG to get in the way of better, newer options. But even less do I want to read more about people burned by the incompetent engineering of lesser new alternatives. Can we just declare a flag day and switch to TextSecure?

Yes, but not unless:

1. there are full-featured native clients for computers that aren't smartphones

2. it works with anonymous accounts, without needing a phone number

3. federation is open

Right now, TextSecure can't even fully replace OTR (for secure IMs), let alone GPG (for email <- real work).

Re: GPG and Me

#76

Post by eliteraspberrie »

There are a couple alternatives to GPG being developed right now.

One is reop (https://github.com/tedu/reop). The cryptography is done by libsodium and it is well-written.

Another is NetPGP (http://www.netpgp.com/). The cryptography is done by the OpenPGP SDK. The NetPGP code is well-written but the OpenPGP SDK code looks like OpenSSL.

Both are promising and deserve everyone's support.

Re: GPG and Me

#77

Post by ryanmarsh »

moxie wrote: post #48

A lot of the comments I've been getting are in the genre of "well... but GPG works." Yes, GPG is a powerful tool that makes some encrypted communication possible . But is it really "working" if it's the tool we've had for the past 20 years, and we still ended up in a world where surveillance is so ubiquitous and privacy is so rare? Having used GPG, it seems more likely to me that there are only ~50k GPG users in the…

Back in the 90's I tried to use GPG, and I tried to pay for digital music. They both went roughly the same way.

Arguably it was easier to use GPG back then than it is now. Pine was my MUA and I had an easy to find public key. Now I have an iPhone, don't use Linux on my laptop anymore, and make heavy use of messaging products.

Here's what I have now that I didn't have then, 2FA. There's an app on my phone that makes it super easy so I use it. If I had to still carry around a separate RSA code generator I probably wouldn't.

Surely we can figure out a way to make encrypted email nearly transparently easy with the major mail providers, and the default mail apps on our laptops and and phones. Surely we can figure out a way to make a trustworthy distributed keystore.

Perhaps this will all change because before Snowden we were blissfully unaware and GPG was a cool toy unless your life was in real danger, post Snowden we're residents of a vast internet police state and my Mom knows how Target was hacked.

I have a strong suspicion we will figure this out, and soon. I wonder, are VC's are looking into funding easy to use consumer encryption?

Re: GPG and Me

#78

Post by rubyfan »

moxie wrote: post #48

A lot of the comments I've been getting are in the genre of "well... but GPG works." Yes, GPG is a powerful tool that makes some encrypted communication possible . But is it really "working" if it's the tool we've had for the past 20 years, and we still ended up in a world where surveillance is so ubiquitous and privacy is so rare? Having used GPG, it seems more likely to me that there are only ~50k GPG users in the…

Don't you think the time is right to build such a system?

Public awareness of privacy especially wrt mass government surveillance, identity theft and high profile corporate breaches seems that such an thing is ripe.

I am naively optimistic given the right implementation a consortium of stakeholders could do something meaningful.

Re: GPG and Me

#79

Post by stormbrew »

eliteraspberrie wrote: post #76

There are a couple alternatives to GPG being developed right now. One is reop ( https://github.com/tedu/reop ). The cryptography is done by libsodium and it is well-written. Another is NetPGP ( http://www.netpgp.com/ ). The cryptography is done by the OpenPGP SDK. The NetPGP code is well-written but the OpenPGP SDK code looks like OpenSSL. Both are promising and deserve everyone's support.

Reop looks exciting, perhaps as being exactly what a "fresh start" should look like.

I see the section on not supporting key revocation at all and it worries me, because it seems to me there should be some way to do so. But perhaps the key here is that this particular tool is not trying to solve the key distribution problem, which is a whole other kettle of fish? It is possible that PGP fails partly because it tries to do both.

But that does mean that a solution still needs to be found for that problem, even if you switch to reop.

Re: GPG and Me

#80

Post by yellowapple »

moxie wrote: post #48

A lot of the comments I've been getting are in the genre of "well... but GPG works." Yes, GPG is a powerful tool that makes some encrypted communication possible . But is it really "working" if it's the tool we've had for the past 20 years, and we still ended up in a world where surveillance is so ubiquitous and privacy is so rare? Having used GPG, it seems more likely to me that there are only ~50k GPG users in the…

Do you have any specific criticisms of GPG other than "it's old and it's not popular"?

What's your ideal vision of what end-to-end encryption for the common (wo)man should look like other than "not GPG"?

Two questions whose answers are nonexistent in your article.

Post reply on HN