Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

GPG and Me

thoughtcrime.org

Post reply on HN
Print view View original

161–170 of 267 posts

Re: GPG and Me

#161

Post by lmm »

moxie wrote: post #48

A lot of the comments I've been getting are in the genre of "well... but GPG works." Yes, GPG is a powerful tool that makes some encrypted communication possible . But is it really "working" if it's the tool we've had for the past 20 years, and we still ended up in a world where surveillance is so ubiquitous and privacy is so rare? Having used GPG, it seems more likely to me that there are only ~50k GPG users in the…

HTTP is '90s tech. TCP/IP is '70s tech. There's nothing inherently wrong with that. 1400 lines of python that tries to pretend that an interactive program is a library is definitely a problem though.

How's about this: rather than a protocol-up rewrite, how about just writing a library-up rewrite? Write a ground-up implementation of (maybe a subset of) RFC 4880, with opinionated choices of default ciphers (a bit like NaCl). Make it a portable library that can be used on all the popular mobile platforms and from all the popular languages. That's a plenty big enough job, and would fix the concrete pain points with GPG without throwing out the good part.

> We could try to slap a GUI on top of it, but I don't believe great products are made that way. Good UX requires thinking about interactions all the way down to the protocol.

What kind of concrete things would have to change at the protocol level? Plenty of good products conform to existing protocol standards, and a crypto protocol that has survived years of use in a hostile environment is worth its weight in gold. The talk of "modern" seems very handwavey as a reason to throw this out.

> GPG has such a small legacy install base (literally on the order of ~50k users), that there's no reason to maintain compatibility with OpenPGP.

I find it hard to believe there are only 50k users given that OpenPGP is built into the package-management infrastructure that every Debian user uses, and is required on Maven Central which virtually every Java system uses. Yes, these aren't people who actively chose it or are even aware that they're using OpenPGP - but protocols are like that; they're infrastructure.

And as for your 50k, that may be a small number but they're the people who really care about privacy. Snowden is among them. If you're trying to spread crypto, those are the last people you want to alienate.

Re: GPG and Me

#162

Post by antihero »

I as a fairly technical person fine GPG confusing, despite being shown how to use it several times, and still have no idea whether it's working properly or if anything is actually being secured with how I've got it set up. Also, seems centric on the dwindling population of people who actually use email clients.

Re: GPG and Me

#163

Post by zvrba »

moxie wrote: post #48

A lot of the comments I've been getting are in the genre of "well... but GPG works." Yes, GPG is a powerful tool that makes some encrypted communication possible . But is it really "working" if it's the tool we've had for the past 20 years, and we still ended up in a world where surveillance is so ubiquitous and privacy is so rare? Having used GPG, it seems more likely to me that there are only ~50k GPG users in the…

Is anybody trying to implement identity-based encryption?

Re: GPG and Me

#164

Post by hueving »

na85 wrote: post #155
moxie wrote: post #48

A lot of the comments I've been getting are in the genre of "well... but GPG works." Yes, GPG is a powerful tool that makes some encrypted communication possible . But is it really "working" if it's the tool we've had for the past 20 years, and we still ended up in a world where surveillance is so ubiquitous and privacy is so rare? Having used GPG, it seems more likely to me that there are only ~50k GPG users in the…

Blaming "1990s crypto" is, IMHO, missing the point. Until we discover attacks against the ciphers there's no reason to throw them out just due to their age. If you're referring to GPG's shitty interface, then sure. But how much of that is "1990s crypto" and how much is due to the fact that it's one guy working by himself and barely being able to afford it, for years? GPG with Linux-levels of support would be an entir…

>edit: oh sorry, are we not allowed to disagree with Big Names™?

Not when it comes to cryptography and HN. Moxie, Collin, and tptacek are the only 3 people that can say anything that isn't mainstream pop-crypto. Anyone that dares to disagree with them is clearly wrong and must be punished with downvotes.

Re: GPG and Me

#165

Post by grinich »

click170 wrote: post #83
sillysaurus3 wrote: post #56

Earlier quoted context omitted.

You know you're one of only a few people in the world who is in a position to do that, right? Anyone else would (rightfully!) get torn to shreds on HN by tptacek or yourself. And I say "rightfully" because it is very likely that other people would screw up some central aspect to the security of any new product that claims security. It's not just that, though. Anyone else with your knowledge but no standing would be s…

Is there a kick starter page for this cause that I can contribute to? Because I would. I'm not going to back just any crypto project, but with the right people leading the charge I would get behind it.

https://whispersystems.org/blog/bithub/

(Unrelated to GPG, but this goes towards crypto projects by Moxie and other solid people.)

Re: GPG and Me

#166

Post by vetler »

napoleond wrote: post #73
moxie wrote: post #48

A lot of the comments I've been getting are in the genre of "well... but GPG works." Yes, GPG is a powerful tool that makes some encrypted communication possible . But is it really "working" if it's the tool we've had for the past 20 years, and we still ended up in a world where surveillance is so ubiquitous and privacy is so rare? Having used GPG, it seems more likely to me that there are only ~50k GPG users in the…

What do you think that looks like, though? Is it TextSecure on the desktop, with file attachments? Is it Pond? Is it just email, but with a different crypto layer? I feel like a lot of the things GPG aims to do are fundamentally hard. It's not the technology that sucks, it's the problem . I completely agree that the answer will come from thinking about user interactions first, but I'm not sure that the solution will…

> It's not the technology that sucks, it's the problem.

This is my feeling as well. To optimize for security and privacy, it seems like it needs to be difficult by design. If it's too easy, it's probably less secure.

I'm not sure if anyone has given it seriuos attempts to make it more user friendly, though? Would be surprised if no one has, there should be a great opportunity here. Escpecially now that it has so much focus.

Re: GPG and Me

#167

Post by dnet »

lmm wrote: post #161
moxie wrote: post #48

A lot of the comments I've been getting are in the genre of "well... but GPG works." Yes, GPG is a powerful tool that makes some encrypted communication possible . But is it really "working" if it's the tool we've had for the past 20 years, and we still ended up in a world where surveillance is so ubiquitous and privacy is so rare? Having used GPG, it seems more likely to me that there are only ~50k GPG users in the…

HTTP is '90s tech. TCP/IP is '70s tech. There's nothing inherently wrong with that. 1400 lines of python that tries to pretend that an interactive program is a library is definitely a problem though. How's about this: rather than a protocol-up rewrite, how about just writing a library-up rewrite? Write a ground-up implementation of (maybe a subset of) RFC 4880, with opinionated choices of default ciphers (a bit like…

> Write a ground-up implementation of (maybe a subset of) RFC 4880, with opinionated choices of default ciphers (a bit like NaCl).

That's what PBP does:

- Code: https://github.com/stef/pbp

- A short (9:03) talk by the author: https://www.youtube.com/watch?v=Kl_gLMef1mI

Re: GPG and Me

#168

Post by 59nadir »

moxie wrote: post #48

A lot of the comments I've been getting are in the genre of "well... but GPG works." Yes, GPG is a powerful tool that makes some encrypted communication possible . But is it really "working" if it's the tool we've had for the past 20 years, and we still ended up in a world where surveillance is so ubiquitous and privacy is so rare? Having used GPG, it seems more likely to me that there are only ~50k GPG users in the…

Perhaps it would be better to leverage your position and your knowledge and come up with something before you write up a post like this? As other commenters have pointed out, you're in a prime position to actually come up with a working concept instead of just writing your opinion about it.

I don't open a link to Paul Graham's site to read "Shit's bad, guys, and here are some fairly shallow reasons why I feel I can make that statement". I go there to read something that's been thought out by someone 'in the know'. Same goes for when your name is on a post about crypto. This was just whining.

That may be totally acceptable to you, but I don't think I'm alone in expecting more than just an opinion.

Re: GPG and Me

#169

Post by alkonaut »

markwakeford wrote: post #12

I am curious as to to know what mail clients people are using with GPG. In OSX I am not a big fan of the native mail client at all but it seems thats the only approach if you want to use GPG. I am currently on a quest to find a decent mail client that looks good and works well and I am currently trialling Airmail 2 but its GPG support is buggy at best.

For encryption to be pervasive, it has to support all clients, on all platforms, without explicit user action. We can talk all day about the UX of tools like PGP but the bottom line is that the UX for email are mail client(s), and nothing else.

Strong crypto for emails has to work like https does for web browsing. Picture if people had to use some command line tool to generate and keep keys in order to do online shopping in their web browser. Compared to just using a (any) browser with https built in.

The amount of people that would want to use some native desktop email client for ALL their email work is likely even smaller than the number that use GPG today! If I couldn't read my email on my phone or on any computer it would have lost most of its value already.

Re: GPG and Me

#170

Post by oskarth »

59nadir wrote: post #168
moxie wrote: post #48

A lot of the comments I've been getting are in the genre of "well... but GPG works." Yes, GPG is a powerful tool that makes some encrypted communication possible . But is it really "working" if it's the tool we've had for the past 20 years, and we still ended up in a world where surveillance is so ubiquitous and privacy is so rare? Having used GPG, it seems more likely to me that there are only ~50k GPG users in the…

Perhaps it would be better to leverage your position and your knowledge and come up with something before you write up a post like this? As other commenters have pointed out, you're in a prime position to actually come up with a working concept instead of just writing your opinion about it. I don't open a link to Paul Graham's site to read "Shit's bad, guys, and here are some fairly shallow reasons why I feel I can m…

In case you didn't know, Moxie is already doing that https://whispersystems.org/

In any case, your point still stands, generally speaking.

Post reply on HN