31–40 of 51 posts
What is so terrible for people about using an email client? I find using the Gmail web interface to be frustrating because they've removed the ability to pop out the compose view into it's own window, so I can't easily reference information in another browser tab while writing an email for instance. Meanwhile, Gmail has excellent IMAP support, which lets me use Thunderbird + Enigmail to get excellent PGP support.
HAHAHAHAHA good one
Earlier quoted context omitted.
I really don't mean the email address but the real name. People normally verify real names when they sign someone else's key anyway. Of course there is the problem that real names are often not unique. Email address spoofing is too easy, I don't think that "owning" an email address is reasonably verifiable. I wasn't aware that people sign each others uid. What happens if someone's name legally changes? Does he/she ha…
"Signing a key" really means signing the binding of a uid to a public/private key pair. I had to look at the Open PGP spec to figure that out ;-) The question is, how to do verify that a particular person is exclusive owner of a uid? Because the uid is just a piece of text, there is no general way that will work every time. It depends on what the uid is. Someone could put their Passport number in the uid and you coul…
Why not just name + email? I don't think putting anything like a passport number is a wise idea. It's just putting one more semi-secret information on the internet.
I think the encryption and signing+trust gets mixed here. If I know someone only by email address, I don't trust their key very much. But I'm still going to use it to encrypt messages to them, because it's better than nothing. I'm going to trust it if it's got a track record of reasonable messages on mailing lists or git commits over some period of time.
But back to the main topic: email-only, and passport number are two extremes and the second one is even hard to verify. Most people actually just use name+email combination in uids. And that's what gpg invites you to do when generating keys. Why didn't you mention it?
Earlier quoted context omitted.
My main issue is that search and labels just don't work as well as in gmail webapp. Also, I'm sending 90% of emails from my phone anyway and I don't know of any good client that works both with gmail (with transparent caching of recent/viewed messages) and gpg.
Did you try K-9 mail with APG?
What is so terrible for people about using an email client? I find using the Gmail web interface to be frustrating because they've removed the ability to pop out the compose view into it's own window, so I can't easily reference information in another browser tab while writing an email for instance. Meanwhile, Gmail has excellent IMAP support, which lets me use Thunderbird + Enigmail to get excellent PGP support.
Nothing is terrible, I suppose, but in the web client I personally enjoy the fast search, filtering, labeling, split pane smart inboxes, integration with Calendar, modal keyboard shortcuts (they aren't operative when you're typing in a text box but are active otherwise) and non-intrusive threading (conversation-view). The fact that all this is the same on my Macbook Pro, on my Arch Linux desktop, or when I reboot to…
That beeing said, I wouldn't mind running my own webmailer as long as it has most of the google apps/office 365 features.
I'm hoping for mailpile myself even if it still takes some time.
What is so terrible for people about using an email client? I find using the Gmail web interface to be frustrating because they've removed the ability to pop out the compose view into it's own window, so I can't easily reference information in another browser tab while writing an email for instance. Meanwhile, Gmail has excellent IMAP support, which lets me use Thunderbird + Enigmail to get excellent PGP support.
Nothing is terrible, I suppose, but in the web client I personally enjoy the fast search, filtering, labeling, split pane smart inboxes, integration with Calendar, modal keyboard shortcuts (they aren't operative when you're typing in a text box but are active otherwise) and non-intrusive threading (conversation-view). The fact that all this is the same on my Macbook Pro, on my Arch Linux desktop, or when I reboot to…
At the moment, end-to-end is NOT production ready, and will likely undergo further hardening in the coming months. Use at your own risk.
> end-to-end is NOT production ready This sounds wrong, given that "end-to-end encryption" as a concept is very much production ready.
Proper capitalization would help; Google choosing a less overloaded name in the first place would have helped more.
It's worth mentioning Mailvelope ( https://www.mailvelope.com/ ) - Free - Supported in FF / Chrome - Supports Gmail, Yahoo, Outlook and GMX I've been using it extensively for about 12 months now. It's solid, unobtrustive, and just .. works. Decryption of attachments would be nice, but it's definitely not a deal breaker.
Signing of encrypted messages is not supported at the moment. Unfortunately that's a deal breaker for me :-( But it does look very nice.
Earlier quoted context omitted.
One of the developers here: Yes, the Keyring reimplementation is in progress and ends very soon. After the redesign, applications built on top of E2E library will be able to use different sources of both public and private keys (so it's easy to do integrations with GnuPG, hardware keys HKP, or e.g. Facebook). The API will be similar to what's in https://github.com/google/end-to-end/wiki/Keyring .
One thing that is currently missing from E2E (as far as I can tell having played with it a little in the last month) is any kind of web of trust. When I import a key, I can't tell if it has been signed by me or someone I trust. Is this on the radar for the UI after the Keyring reimplementation is finished? At the moment, what we've suggested at our work is that people manage keys in GPG and then only export keys into…
Earlier quoted context omitted.
> end-to-end is NOT production ready This sounds wrong, given that "end-to-end encryption" as a concept is very much production ready.
For better or worse, "End-To-End" is the specific Google Chrome extension being discussed in the article: https://github.com/google/end-to-end/ Proper capitalization would help; Google choosing a less overloaded name in the first place would have helped more.
We're going to have a very hard time talking about end-to-end crypto to consumers without at least one person confusing this with googles addon. (Thanks google)