Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

GPG and Me

thoughtcrime.org

Post reply on HN
Print view View original

21–30 of 267 posts

Re: GPG and Me

#21

Post by Nelson69 »

stadeschuldt wrote: post #14
markwakeford wrote: post #12

I am curious as to to know what mail clients people are using with GPG. In OSX I am not a big fan of the native mail client at all but it seems thats the only approach if you want to use GPG. I am currently on a quest to find a decent mail client that looks good and works well and I am currently trialling Airmail 2 but its GPG support is buggy at best.

I have been using Thunderbird (with Enigmail plugin) for over a decade now. Never had any issues.

Other than using an email client application rather than a web application.

Enigmail is good though.

Re: GPG and Me

#22

Post by obituary_latte »

decasteve wrote: post #5

I appreciate the sentiment overall but I have the exact opposite reaction when somebody emails me with a GPG signed or encrypted email. I immediately think it's great that somebody actually cares enough to voluntarily use it. That the contents of the email are deemed important enough that they don't want it sent in the clear.

Curious as to how often this happens? I suspect had I ever received email signed, I would be excited too. But I think it might be due at least in part to the novelty of it. I'd bet moxie gets more than the average user and perhaps maybe even is a bit...jaded isn't the right word, but being entrenched in crypto and knowing the importance and knowing the barrier to entry...overwhelmed. Not by the process, but by the hill yet to climb.

Re: GPG and Me

#23

Post by pakled_engineer »

secfirstmd wrote: post #2

As someone who trains human rights defenders and journalists on this stuff...I couldn't agree more. Often things end up being an unfortunate tradeoff between trying to get PGP working for people and having to settle for something less. Particularly in the developing world, which lower computer literacy rates - this is a significant problem. To be fair, at least Whisper Systems and the Guardian Project are doing great…

For people like this I write a simple shell script that abstracts away all the complexities and shitty UI. Never tried working directly with libgcrypt, I just let the regular gpg application handle it. Decrypting incoming mail automatically, checking to make sure outgoing is encrypted before sending and even regenerating keys and signing them is just a few shell commands you can script away. Projects like Tails should have this instead of big clunky GUIs.

Re: GPG and Me

#24

Post by bdamm »

diyorgasms wrote: post #4

The old adage is that perfect is the enemy of good enough, but the author is claiming that GPG isn't even good enough. I have to somewhat disagree. While the ideal product in this space would be as easy to use as clicking a 'Like' button, and just as ubiquitous, GPG works well enough for now. The most sensitive use case for GPG has to be sending correspondence that, if decrypted, could put you in severe physical dang…

Actually this is not correct. There are now situations (such as in the United States) where merely using GPG puts you on a list of suspicious people. So not only is GPG not "good enough", but using it today makes your life worse than it was before. There are places where using GPG can lead to death or torture, even if the message is simply your grocery list.

In order for GPG (or its replacement) to fulfill the dream, it needs to be the norm rather than the exception. There are some companies who could prod things in that direction. GPG acting alone is absolutely not the future.

Besides, the cryptography isn't even very good. There is no forward secrecy, for example. I believe that email has to change at the protocol level in order to fulfill the promise that GPG (PGP) makes. And with so many interested in preventing the security of email, well, it seems like secure email is a dead end. And that's a real shame, because I love the idea of being able to securely send a message between two people on the Internet, using open source software and without trusting any intermediates.

Re: GPG and Me

#25

Post by StavrosK »

Nanzikambe wrote: post #8

As a member of the encrypt-everything clique I have to say, though Moxie has a point, Gnupg is infinitely better than alternative of nothing at all. Until someone comes up with a solution that preserves its power and flexibility and marries it with a functional UX -- I shall keep using it

I kinda like the solution of embedding public keys in email addresses:

name+8znBcmtXJ2ZeSn7fWVCGfpQI9HnJH1pNBPK397SGrT8=@gmail.com

Sure, you'll never actually tell someone this, but it's short enough to copy/paste.

Re: GPG and Me

#26

Post by rlpb »

jchrisa wrote: post #11

Is there a list of credible web of trust implementations with installed bases? Is there anything on that list using new Html5 crypto plus IETF JOSE?

> Is there a list of credible web of trust implementations with installed bases?

I'm not sure if this is what you're asking, but Debian developers are required to have their keys signed by a number of other Debian developers. So there is a comprehensive web of trust amongst them.

You can get the entire set of public keys from the "debian-keyring" package, assuming you trust your OS (and you use Debian or a derivative). And if you want to be signed into the strong set, find and ask a Debian developer (you probably have one reasonably local to you).

Re: GPG and Me

#27

Post by sarciszewski »

StavrosK wrote: post #25
Nanzikambe wrote: post #8

As a member of the encrypt-everything clique I have to say, though Moxie has a point, Gnupg is infinitely better than alternative of nothing at all. Until someone comes up with a solution that preserves its power and flexibility and marries it with a functional UX -- I shall keep using it

I kinda like the solution of embedding public keys in email addresses: name+8znBcmtXJ2ZeSn7fWVCGfpQI9HnJH1pNBPK397SGrT8=@gmail.com Sure, you'll never actually tell someone this, but it's short enough to copy/paste.

With modern ECC this is actually feasible.

Re: GPG and Me

#28

Post by zmanian »

GPG is an immense failure from the point of protecting person to person communications.

It is largely a success in verifying the identities of the software developers. The entire Debian ecosystem relies on GPG in largely successful ways.

Peter Todd suggests that PGP drop encrypted communications as a goal and focus only on identity and authentication. It appears the PGP just can't be bootstrapped into modernity from a communication point of view. The only major innovation in authentication and identity has been threshold signatures which GPG could support.

Re: GPG and Me

#29

Post by Ar-Curunir »

TaylorAlexander wrote: post #20
diyorgasms wrote: post #4

The old adage is that perfect is the enemy of good enough, but the author is claiming that GPG isn't even good enough. I have to somewhat disagree. While the ideal product in this space would be as easy to use as clicking a 'Like' button, and just as ubiquitous, GPG works well enough for now. The most sensitive use case for GPG has to be sending correspondence that, if decrypted, could put you in severe physical dang…

I don't think that the author ever disputed that GPG is a highly secure system when functioning, or that it is "the best we have". Certainly it's the best we have, and that highlights the sad state of affairs. I think a lot of engineers make the mistake that regular people will be so won over by a new technology that they'll learn it as well as the engineers do. That isn't how it works. So far we still haven't gotten…

The problem is that security and crypto specifically, is a complex beast, so often it isn't possible to abstract away the details.

You cannot expect to avail of the benefits of crypto without taking some time to understand how different protocols work, how public key vs symmetric key crypto works, etc.

I agree that the situation could be much better than it currently is, but people can't expect to be given everything for free; there mist be some effort from the other side, which I don't see happening today, especially with the widespread disregard for mathematics in the general public.

Re: GPG and Me

#30

Post by kevan »

diafygi wrote: post #19

It seems that the biggest problem with encryption in general is that of incentives. Great UX takes lots of design and iteration, which means someone has to pay for all those designers and front end devs. However, when you want good encryption, user experience always comes after security, which means you spend the majority of your resources on the security, not the design. So, we end up with great security and terribl…

I think part of the solution is to get security teams to recognize that good user experience is a part of secure design. If the interface allows users to make mistakes that compromise security then the software has failed. You can blame users for making mistakes and tell them to read book-length manpages but that doesn't solve the problem. Most users don't want a swiss army knife and directions, they want a complete solution to a specific problem.
Post reply on HN