Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

GPG and Me

thoughtcrime.org

Post reply on HN
Print view View original

111–120 of 267 posts

Re: GPG and Me

#111

Post by fensipens »

A_COMPUTER wrote: post #103
danudey wrote: post #62

Earlier quoted context omitted.

I think the implication is that GPG is so pathologically complex, awkward, cumbersome, and broken that getting GPG-encrypted e-mail means it's from someone who's so paranoid/obsessive that they encrypt all e-mail, even to strangers (when possible?) even when the tool is so awful as to discourage the average individual.

>someone who's so paranoid/obsessive that they encrypt all e-mail, even to strangers That's pretty much what I meant, clearly somebody didn't like me bringing it up. I wonder why. I have to use PGP every day for my job, I don't feel like a paranoid/obsessive, so I resent the implication a little bit. It's a clunky piece of software, but it hasn't caused me nearly as much suffering as Lotus Notes.

Don't bother. While I have much sympathy for the average user and see several problems with PGP, the gen-pop here is creating way too much buzz around a tool that is working reasonably well.

And with respect to the PGP-user / character link.. this is just beyond stupidity.

Re: GPG and Me

#112

Post by dasil003 »

napoleond wrote: post #108
nothrabannosir wrote: post #98

Earlier quoted context omitted.

I can guess why you're being downvoted, but your comment is ironically correct. It /does/ say something about them! But what that is depends on who you ask. And that, again, says something about /them/. Which says something about the downvoters. Irony everywhere.

People are getting offended, but I could have replaced Windows with almost anything. Our choices say things about us. Getting back to the subject at hand, though, I assume 'moxie meant that people who choose to use GPG for casual conversation must be slightly masochistic and therefore slightly less likely to have something interesting to say. ... just like Windows users ;)

Yes, of course, but I'm very curious about moxie's interpretation of what using GPG says about the people who randomly email him; certainly more curious than constructing my own stereotype.

Re: GPG and Me

#113

Post by MichaelGG »

ghshephard wrote: post #102
MichaelGG wrote: post #87

Earlier quoted context omitted.

>Perhaps this will all change because before Snowden we were blissfully unaware Every time I see this in regards to email, I'm puzzled. Carnivore was known about in the 90s. Then there was the AT&T Room 641A in the 200s. So I don't know how people were unaware that state level actors could tap connections and record email. Second, for this threat model, just forcing and validating TLS on SMTP gets you pretty far, doe…

Re: "You're then mostly trusting your email provider. And without trusting them, we get into user-unfriendly stuff like not being able to forget your password." Nobody should trust their email provider if they are concerned about the privacy of their email. The Job To Be Done, by an email provider such as gmail/yahoo/hotmail is to act as a mail store, and mta. A user should be able to rely on a local MUA for confiden…

What your proposing is currently limited to people that are more-or-less OK putting up with PGP. For everyone and their mom to use encryption, features like "I forgot my password and now lost all my email" aren't acceptable. Nor are things like "I've got to make a separate, verified, out-of-band contact to verify that I've got the right key".

I'm hoping someone comes up with a breakthrough idea here, something fantastic that enables real privacy with no inconvenience. But in 20 years, there's been essentially zero progress on that front. All proposals either violate Most Users' required features, or boil down to offloading trust to the email provider.

Re: GPG and Me

#114

Post by guelo »

napoleond wrote: post #74
the_af wrote: post #60

Earlier quoted context omitted.

Hey Moxie, it intrigues me that the first thing you mention in your post isn't technical or even about UX (which is what most people in this thread are focusing on). Instead, it's that you're starting to dislike reading emails from the kind of person who would "voluntarily use GPG". I know you said there's no unifying theme to these emails, but can you elaborate? Maybe something about security-obssessed lay people us…

It's the same as people who voluntarily use Windows. It says something about them, that's all.

Get out of your bubble. Windows is ubiquitous. It has 90% of the desktop market share. There is no generalization you can come up with about that many people.

Re: GPG and Me

#115

Post by TheCondor »

moxie wrote: post #48

A lot of the comments I've been getting are in the genre of "well... but GPG works." Yes, GPG is a powerful tool that makes some encrypted communication possible . But is it really "working" if it's the tool we've had for the past 20 years, and we still ended up in a world where surveillance is so ubiquitous and privacy is so rare? Having used GPG, it seems more likely to me that there are only ~50k GPG users in the…

If it's not weak desire or need for privacy then why hasn't the market successfully solved this? Moreover, where is the outrage at the lack of privacy.

Re: GPG and Me

#116

Post by [deleted] »

napoleond wrote: post #108
nothrabannosir wrote: post #98

Earlier quoted context omitted.

I can guess why you're being downvoted, but your comment is ironically correct. It /does/ say something about them! But what that is depends on who you ask. And that, again, says something about /them/. Which says something about the downvoters. Irony everywhere.

People are getting offended, but I could have replaced Windows with almost anything. Our choices say things about us. Getting back to the subject at hand, though, I assume 'moxie meant that people who choose to use GPG for casual conversation must be slightly masochistic and therefore slightly less likely to have something interesting to say. ... just like Windows users ;)

[deleted]

Re: GPG and Me

#117

Post by pdkl95 »

moxie wrote: post #48

A lot of the comments I've been getting are in the genre of "well... but GPG works." Yes, GPG is a powerful tool that makes some encrypted communication possible . But is it really "working" if it's the tool we've had for the past 20 years, and we still ended up in a world where surveillance is so ubiquitous and privacy is so rare? Having used GPG, it seems more likely to me that there are only ~50k GPG users in the…

Consider a separating the goals.

OTR is much more successful because it allows ad-hoc connections instead of trying to make authenticity guarantees. It encourages authentication, but the decision of when to invest that extra effort is left with the user. Fundamentally, OTR just offers privacy from eavesdroppers, and it does that well. Every other feature is extra. Even better, these new features (e.g. authentication) don't have to start from nothing. A big benefit of separating features is that is added later can leverage the existing infrastructure.

I personally believe the "killer crypto app" that will actually be adopted is a tool that is the opposite of OTR. It should only promise ad-hoc authenticates and do it in an generic style. I mean something that is somewhere between "gpg --clearsign" and 2channel/4chan style tripcodes[1]. In an ideal world, this needs to have a clearsign-style mode, so it can be used on existing forums. If the browser simply offers a "sign this" button next to textareas (no password, auto-gen they key and stuff it on a keyserver, just make it happen), it will be used. On the decode side, any blocks of text the browser sees that look like a signature get check, with the key pinned. That's it. Any features that allow nicer integration with email, forum software, etc, are nice but optional.

This provides a minimum, anonymous level authentication (forgery prevention), and the only UX the user should have to see is the "sign this" button and a loud "possible forgery" warning if a signature doesn't match the pinned key. It even works regardless of who is transporting the message (different websites, email, gopher, avian carriers) without needing an "identify provider". Upgrading this infrastructure of pinned keys into something more interesting can happen later on, if desired.

Would this work? I believe it's worth trying. It is clear that trying to solve all of the security needs in a single tool has not worked, and the one tool that got any adoption at all (OTR) has a much more narrow set of goals.

[1] http://en.wikipedia.org/wiki/Imageboard#Tripcodes

Re: GPG and Me

#119

Post by [deleted] »

A_COMPUTER wrote: post #59

>When I receive a GPG encrypted email from a stranger, though, I immediately get the feeling that I don’t want to read it. >the email was written by someone who would voluntarily use GPG. >There just seems to be something particular about people who try GPG and conclude that it’s a realistic path to introducing private communication in their lives for casual correspondence with strangers. Is it just me or is the impl…

[deleted]

Re: GPG and Me

#120

Post by [deleted] »

A_COMPUTER wrote: post #59

>When I receive a GPG encrypted email from a stranger, though, I immediately get the feeling that I don’t want to read it. >the email was written by someone who would voluntarily use GPG. >There just seems to be something particular about people who try GPG and conclude that it’s a realistic path to introducing private communication in their lives for casual correspondence with strangers. Is it just me or is the impl…

[deleted]
Post reply on HN