Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

GPG and Me

thoughtcrime.org

Post reply on HN
Print view View original

121–130 of 267 posts

Re: GPG and Me

#121

Post by ryanmarsh »

MichaelGG wrote: post #87
ryanmarsh wrote: post #77

Earlier quoted context omitted.

Back in the 90's I tried to use GPG, and I tried to pay for digital music. They both went roughly the same way. Arguably it was easier to use GPG back then than it is now. Pine was my MUA and I had an easy to find public key. Now I have an iPhone, don't use Linux on my laptop anymore, and make heavy use of messaging products. Here's what I have now that I didn't have then, 2FA. There's an app on my phone that makes i…

>Perhaps this will all change because before Snowden we were blissfully unaware Every time I see this in regards to email, I'm puzzled. Carnivore was known about in the 90s. Then there was the AT&T Room 641A in the 200s. So I don't know how people were unaware that state level actors could tap connections and record email. Second, for this threat model, just forcing and validating TLS on SMTP gets you pretty far, doe…

My mom didn't know about Carnivore. I did because I worked at an ISP. My mom knows about Snowden. Thus the general public was blissfully unaware, now they are not.

Re: GPG and Me

#122

Post by [deleted] »

danudey wrote: post #62
A_COMPUTER wrote: post #59

>When I receive a GPG encrypted email from a stranger, though, I immediately get the feeling that I don’t want to read it. >the email was written by someone who would voluntarily use GPG. >There just seems to be something particular about people who try GPG and conclude that it’s a realistic path to introducing private communication in their lives for casual correspondence with strangers. Is it just me or is the impl…

I think the implication is that GPG is so pathologically complex, awkward, cumbersome, and broken that getting GPG-encrypted e-mail means it's from someone who's so paranoid/obsessive that they encrypt all e-mail, even to strangers (when possible?) even when the tool is so awful as to discourage the average individual.

[deleted]

Re: GPG and Me

#123

Post by username223 »

ryanmarsh wrote: post #77
moxie wrote: post #48

A lot of the comments I've been getting are in the genre of "well... but GPG works." Yes, GPG is a powerful tool that makes some encrypted communication possible . But is it really "working" if it's the tool we've had for the past 20 years, and we still ended up in a world where surveillance is so ubiquitous and privacy is so rare? Having used GPG, it seems more likely to me that there are only ~50k GPG users in the…

Back in the 90's I tried to use GPG, and I tried to pay for digital music. They both went roughly the same way. Arguably it was easier to use GPG back then than it is now. Pine was my MUA and I had an easy to find public key. Now I have an iPhone, don't use Linux on my laptop anymore, and make heavy use of messaging products. Here's what I have now that I didn't have then, 2FA. There's an app on my phone that makes i…

> Surely we can figure out a way to make encrypted email nearly transparently easy with the major mail providers,

What, Gmail? Yahoo? They exist only because they can read your plain-text email and serve ads against it. Most people get their email through free webmail providers, who have every reason not to make encryption easy.

Re: GPG and Me

#124

Post by copperx »

guelo wrote: post #114
napoleond wrote: post #74

Earlier quoted context omitted.

It's the same as people who voluntarily use Windows. It says something about them, that's all.

Get out of your bubble. Windows is ubiquitous. It has 90% of the desktop market share. There is no generalization you can come up with about that many people.

I think the OP meant that, given a choice, say, of getting a Mac or a Windows PC at work, you voluntarily pick the Windows PC.

Re: GPG and Me

#125

Post by mirimir »

MichaelGG wrote: post #113
ghshephard wrote: post #102

Earlier quoted context omitted.

Re: "You're then mostly trusting your email provider. And without trusting them, we get into user-unfriendly stuff like not being able to forget your password." Nobody should trust their email provider if they are concerned about the privacy of their email. The Job To Be Done, by an email provider such as gmail/yahoo/hotmail is to act as a mail store, and mta. A user should be able to rely on a local MUA for confiden…

What your proposing is currently limited to people that are more-or-less OK putting up with PGP. For everyone and their mom to use encryption, features like "I forgot my password and now lost all my email" aren't acceptable. Nor are things like "I've got to make a separate, verified, out-of-band contact to verify that I've got the right key". I'm hoping someone comes up with a breakthrough idea here, something fantas…

I don't see any way to protect users against forgetting their encryption passphrase, or losing their private key, without offloading trust somewhere. Except for backups, anyway.

It can be very hard to know whether you have the right public key, especially for people that you know only from online activity. And it's not uncommon to find multiple unrevoked keys, with the same email address.

But check out https://keybase.io/mirimir. You can easily get a GnuPG key that signed proofs in my profile here, on GitHub, and on reddit. Also, the email address in my key is linked to a Gravatar that StackExchange and other sites use. So whoever I am, you can be confident that I control that GnuPG key.

Re: GPG and Me

#126

Post by GigabyteCoin »

moxie wrote: post #48

A lot of the comments I've been getting are in the genre of "well... but GPG works." Yes, GPG is a powerful tool that makes some encrypted communication possible . But is it really "working" if it's the tool we've had for the past 20 years, and we still ended up in a world where surveillance is so ubiquitous and privacy is so rare? Having used GPG, it seems more likely to me that there are only ~50k GPG users in the…

>We could try to slap a GUI on top of it, but I don't believe great products are made that way.

I'm right there with you on that one. So is most of HN I imagine.

But the Apple ][ really brought the PC home for so many more people than it's competitors purely because of it's relatively simple GUI.

Command prompts scare the average user.

Re: GPG and Me

#127

Post by snowwrestler »

yellowapple wrote: post #80
moxie wrote: post #48

A lot of the comments I've been getting are in the genre of "well... but GPG works." Yes, GPG is a powerful tool that makes some encrypted communication possible . But is it really "working" if it's the tool we've had for the past 20 years, and we still ended up in a world where surveillance is so ubiquitous and privacy is so rare? Having used GPG, it seems more likely to me that there are only ~50k GPG users in the…

Do you have any specific criticisms of GPG other than "it's old and it's not popular"? What's your ideal vision of what end-to-end encryption for the common (wo)man should look like other than "not GPG"? Two questions whose answers are nonexistent in your article.

Apparently it's so hard to use properly that even Snowden screwed it up in the course of communicating during his leaks.

> The frustrating and ironic thing about GPG is that even experts make mistakes with it. Even, as it turns out, Edward Snowden.

> I now had Poitras’ permission to send Snowden her encryption key, but in his first email to me, Snowden had forgotten to attach his key, which meant I could not encrypt my response. I had to send him an unencrypted email asking for his key first.

https://firstlook.org/theintercept/2014/10/28/smuggling-snow...

Re: GPG and Me

#129

Post by molo »

markwakeford wrote: post #12

I am curious as to to know what mail clients people are using with GPG. In OSX I am not a big fan of the native mail client at all but it seems thats the only approach if you want to use GPG. I am currently on a quest to find a decent mail client that looks good and works well and I am currently trialling Airmail 2 but its GPG support is buggy at best.

mutt has excellent GPG support.

Re: GPG and Me

#130

Post by pakled_engineer »

secfirstmd wrote: post #43
pakled_engineer wrote: post #23

Earlier quoted context omitted.

For people like this I write a simple shell script that abstracts away all the complexities and shitty UI. Never tried working directly with libgcrypt, I just let the regular gpg application handle it. Decrypting incoming mail automatically, checking to make sure outgoing is encrypted before sending and even regenerating keys and signing them is just a few shell commands you can script away. Projects like Tails shoul…

Interesting. Are you thinking of making the script publically available? I'm sure a lot of people would benefit from it.

It's a hacky shell script for OSX to make the process almost invisible to the user without using in-house mail servers or writing network facing daemons. When users launch their mail app it also launches the script (and mail console applescript) that command line fetches mail, decrypts and inserts into mail.app db, looks through msgs for new public keys and extracts them, updates contacts automatically with GoogleCL and gpgtools, then starts offline mail client to view/reply as they normally would. The script then fetches outgoing mail, gpgtools encrypts it according to destination, verifies it and sends.

GPG key ID is automatically inserted into contacts https://code.google.com/p/googlecl/ so when the user deletes a contact the script reads the KeyID and removes it from the keyring as well. It had to be Google contacts it wasn't my decision. Nobody wanted to change their mail app workflow and they couldn't figure out gpgtools/gpg suite so this poor scheme was devised but it works.

The janky part comes when the script checks mail console logs to detect no connection errors when users req to fetch new mail (and suppress popup notifications of this) so they don't have to push a second button to do it outside set intervals that fetch automatically. For some reason it was important that no other buttons existed to fetch new mail. There's probably a Claws Mail plugin that can be written to accomplish all this too if users were willing to switch apps, mutt will do most of it automatically and can be abstracted to make it invisible, or script OpenSMTPD to do this.

Post reply on HN