Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

GPG and Me

thoughtcrime.org

Post reply on HN
Print view View original

91–100 of 267 posts

Re: GPG and Me

#91

Post by mirimir »

moxie wrote: post #48

A lot of the comments I've been getting are in the genre of "well... but GPG works." Yes, GPG is a powerful tool that makes some encrypted communication possible . But is it really "working" if it's the tool we've had for the past 20 years, and we still ended up in a world where surveillance is so ubiquitous and privacy is so rare? Having used GPG, it seems more likely to me that there are only ~50k GPG users in the…

OK, GPG is crufty and hard to use, and the email protocol exposes metadata. So perhaps it is best to start fresh.

What do you think of the Dark Mail effort? And of Pond?

Re: GPG and Me

#92

Post by zobzu »

ryanmarsh wrote: post #77
moxie wrote: post #48

A lot of the comments I've been getting are in the genre of "well... but GPG works." Yes, GPG is a powerful tool that makes some encrypted communication possible . But is it really "working" if it's the tool we've had for the past 20 years, and we still ended up in a world where surveillance is so ubiquitous and privacy is so rare? Having used GPG, it seems more likely to me that there are only ~50k GPG users in the…

Back in the 90's I tried to use GPG, and I tried to pay for digital music. They both went roughly the same way. Arguably it was easier to use GPG back then than it is now. Pine was my MUA and I had an easy to find public key. Now I have an iPhone, don't use Linux on my laptop anymore, and make heavy use of messaging products. Here's what I have now that I didn't have then, 2FA. There's an app on my phone that makes i…

To be technically precise what makes 2FA easy to use is that all services are web-enabled and issue you a temporary-long-term token (ie a cookie with a session id).

If you had to open an app on your phone at each login you'd get crazy real fast :)

I do like your analogy tho. Digital music is a breeze to buy nowadays. Moxie seems to appear as covertly saying its misguided to donate money to GnuPG so that it finally gets good, because, you know, not-moxie-made.

The.. what was it called? Redphone? Whisper? and various other projects - while very cool - didnt achieve even as much popularity as GnuPG (which in itself is far from greatly useable).

I know of one tech that has a chance right now and thats U2F/Fido. It allows for building a framework (being GnuPG or otherwise) around it that's both secure and works for everyone. Why? Because fucking gmail supports it that why. It has nothing to do with the actual tech. It has to do with support. It has to do with my iphone, android, whatever, working with it seamlessly. It a lot to do with "slapping a GUI" at the right places.

Re: GPG and Me

#93

Post by scintill76 »

yellowapple wrote: post #80
moxie wrote: post #48

A lot of the comments I've been getting are in the genre of "well... but GPG works." Yes, GPG is a powerful tool that makes some encrypted communication possible . But is it really "working" if it's the tool we've had for the past 20 years, and we still ended up in a world where surveillance is so ubiquitous and privacy is so rare? Having used GPG, it seems more likely to me that there are only ~50k GPG users in the…

Do you have any specific criticisms of GPG other than "it's old and it's not popular"? What's your ideal vision of what end-to-end encryption for the common (wo)man should look like other than "not GPG"? Two questions whose answers are nonexistent in your article.

Specific criticisms of GPG:

> the working hypothesis for privacy enhancing technology was simple: we’d develop really flexible power tools for ourselves, and then teach everyone to be like us... Instead of developing opinionated software with a simple interface, GPG was written to be as powerful and flexible as possible. It’s up to the user whether the underlying cipher is SERPENT or IDEA or TwoFish

I think it's self-explanatory why it's not good that users need to know about SERPENT, IDEA, and TwoFish.

> the fundamental architecture of PGP also leaves no room for now critical concepts like forward secrecy.

> a ballooning penumbra of OpenPGP specifications and notes so prolific that the entire picture is almost impossible to grasp... Mailpile had to write 1400 lines of python code just to interface with a native GnuPG installation for basic operations, and it still isn’t rock solid.

> journalists who depend on it struggle with it and often mess up (“I send you the private key to communicate privately, right?”)

UX failure leads to user uncertainty or insecure behavior.

What a better replacement looks like (from the comment here):

> Good UX requires thinking about interactions all the way down to the protocol.

> we can start fresh with modern cryptography, a modern protocol, and a modern design philosophy

Re: GPG and Me

#94

Post by jimktrains2 »

moxie wrote: post #48

A lot of the comments I've been getting are in the genre of "well... but GPG works." Yes, GPG is a powerful tool that makes some encrypted communication possible . But is it really "working" if it's the tool we've had for the past 20 years, and we still ended up in a world where surveillance is so ubiquitous and privacy is so rare? Having used GPG, it seems more likely to me that there are only ~50k GPG users in the…

One of the biggest problems with GPG is keyex. Sure, we have key servers, but that's not really a secure way of doing things.

Secure communication is as much a cultural change as a technological one.

Re: GPG and Me

#95

Post by justinludwig »

markwakeford wrote: post #12

I am curious as to to know what mail clients people are using with GPG. In OSX I am not a big fan of the native mail client at all but it seems thats the only approach if you want to use GPG. I am currently on a quest to find a decent mail client that looks good and works well and I am currently trialling Airmail 2 but its GPG support is buggy at best.

Mailpile (https://www.mailpile.is/). It's pretty bare-bones as far as a mail client goes, but it gets the job done.

Re: GPG and Me

#96

Post by droopyEyelids »

the_af wrote: post #60
moxie wrote: post #48

A lot of the comments I've been getting are in the genre of "well... but GPG works." Yes, GPG is a powerful tool that makes some encrypted communication possible . But is it really "working" if it's the tool we've had for the past 20 years, and we still ended up in a world where surveillance is so ubiquitous and privacy is so rare? Having used GPG, it seems more likely to me that there are only ~50k GPG users in the…

Hey Moxie, it intrigues me that the first thing you mention in your post isn't technical or even about UX (which is what most people in this thread are focusing on). Instead, it's that you're starting to dislike reading emails from the kind of person who would "voluntarily use GPG". I know you said there's no unifying theme to these emails, but can you elaborate? Maybe something about security-obssessed lay people us…

It might be people who miss the forest for the trees. Right now Moxie is working on bringing encryption to the masses. That involves a whole-product view, with empathy for the unsophisticated (think about a kid who's only computing device is a phone).

I know stereotypes often treat people unfairly, but the kind of person who has the dedication required to use PGP seems, to me, to often coincide with the people who find fault with everyone who hasn't had the dedication or focus to learn sophisticated software techniques.

And, if I were Moxie, that would be a source of constant frustration to me. The very people who have the ability to make things better -at best- don't empathize with the people they could help, and at worst harbor a bit of contempt for them.

Considering Moxie seems to be dedicating a large part of his life's work to helping average people, I believe the attitude I described could play foil to the inspirational messages he also receives. But I don't pretend to know him or anything.

Re: GPG and Me

#97

Post by ketralnis »

diyorgasms wrote: post #4

The old adage is that perfect is the enemy of good enough, but the author is claiming that GPG isn't even good enough. I have to somewhat disagree. While the ideal product in this space would be as easy to use as clicking a 'Like' button, and just as ubiquitous, GPG works well enough for now. The most sensitive use case for GPG has to be sending correspondence that, if decrypted, could put you in severe physical dang…

> The old adage is that perfect is the enemy of good enough, but the author is claiming that GPG isn't even good enough

That's something you say while building it, so that you get something working built instead of debating what should built, or instead of adding so much stuff that you never finish. It's not something you say to discourage people from improving something that's already shipped.

Re: GPG and Me

#98

Post by nothrabannosir »

napoleond wrote: post #74
the_af wrote: post #60

Earlier quoted context omitted.

Hey Moxie, it intrigues me that the first thing you mention in your post isn't technical or even about UX (which is what most people in this thread are focusing on). Instead, it's that you're starting to dislike reading emails from the kind of person who would "voluntarily use GPG". I know you said there's no unifying theme to these emails, but can you elaborate? Maybe something about security-obssessed lay people us…

It's the same as people who voluntarily use Windows. It says something about them, that's all.

I can guess why you're being downvoted, but your comment is ironically correct. It /does/ say something about them! But what that is depends on who you ask. And that, again, says something about /them/.

Which says something about the downvoters.

Irony everywhere.

Re: GPG and Me

#99

Post by csoghoian »

zobzu wrote: post #92
ryanmarsh wrote: post #77

Earlier quoted context omitted.

Back in the 90's I tried to use GPG, and I tried to pay for digital music. They both went roughly the same way. Arguably it was easier to use GPG back then than it is now. Pine was my MUA and I had an easy to find public key. Now I have an iPhone, don't use Linux on my laptop anymore, and make heavy use of messaging products. Here's what I have now that I didn't have then, 2FA. There's an app on my phone that makes i…

To be technically precise what makes 2FA easy to use is that all services are web-enabled and issue you a temporary-long-term token (ie a cookie with a session id). If you had to open an app on your phone at each login you'd get crazy real fast :) I do like your analogy tho. Digital music is a breeze to buy nowadays. Moxie seems to appear as covertly saying its misguided to donate money to GnuPG so that it finally ge…

You say "Redphone? Whisper? and various other projects - while very cool - didn't achieve even as much popularity as GnuPG"

The Axolotl protocol that was created for Whisper System's TextSecure is now used, by default, by Cyanogenmod (10 million users) and the Android version of WhatsApp (more than 500 million installs from the play store).

I'd say Moxie's tech has been pretty widely adopted.

Re: GPG and Me

#100

Post by yuhong »

chralieboy wrote: post #68
Uhhrrr wrote: post #15

>When I receive a GPG encrypted email from a stranger, though, I immediately get the feeling that I don’t want to read it. This is an interesting case where a barrier to entry makes discourse less valuable. Perhaps the barrier makes people feel like they have to prepare a short speech in order to make the effort worthwhile. I certainly would rather converse with most people than listen to one minute speeches from the…

If you ready on, you'll see that his gripe isn't with the effort put into decrypting, but the subset of people who voluntarily use GPG.

Still, I don't think people should stop using it.
Post reply on HN