Ask HN: Why is PGP not used widely?

#1

Post by dilithiumhe3 » Sun, Nov 03, 2013, 11:04 AM UTC

In light of the whole NSA leaks etc, I have to ask why we don't use PGP widely. Is it just because it's too difficult or is it because we never thought our emails were ever something to be kept private or just that there was never a need to produce tools to make the technology accessible.

A friend and I were discussing this over dinner and couldn't really pin point the reason. Both of us came across ideas around what could be done to make the situation better but were drawing somewhat of a blank on the question of "why is this not already done?".

Re: Ask HN: Why is PGP not used widely?

#2

Post by reiz » Sun, Nov 03, 2013, 11:49 AM UTC

PGP is great. Everybody in tech has the skills to use it. But for non tech people it is still to difficult. But since the NSA affairs many crypto parties happened, specially in Germany. On this crypto parties tech people are teaching non tech people how to crypt emails with PGP. I think that is a good start and I hope we will see more crypto parties in future.

Re: Ask HN: Why is PGP not used widely?

#3

Post by shin_lao » Sun, Nov 03, 2013, 12:24 PM UTC

The setup phase is too difficult. The complex part is the key exchange phase.

Simple and secure mail is an unsolved problem.

Re: Ask HN: Why is PGP not used widely?

#4

Post by a3_nm » Sun, Nov 03, 2013, 12:27 PM UTC

OpenPGP end-to-end encryption has to be done client-side, and the keys have to be stored client-side. This is hard to do given the current trend of using webmails. Besides, using OpenPGP means that you have to store a copy of your key on all the machines that you use to check email, and people usually do not know how to do this without entrusting a third party (Google, Dropbox, Apple, etc.) with the information.

Re: Ask HN: Why is PGP not used widely?

#5

Post by quantabytes » Sun, Nov 03, 2013, 12:32 PM UTC

I like Sneak's Law: Most users cannot or will not securely manage key material (http://www.youtube.com/watch?v=9k4GP3Evh9c @ 23:00).

Re: Ask HN: Why is PGP not used widely?

#6

Post by DanBC » Sun, Nov 03, 2013, 12:38 PM UTC

People cannot use Gmail without help. People have trouble editing wikipedia. People misunderstand some simple concepts.

Even people who have taken the time to install and use PGP, and who seem to want privacy, make weird mistakes such as "Messages encrypted to public keys, to passwords and passphrases, and PGP messages not encrypted at all!"

http://ritter.vg/blog-deanonymizing_amm.html

Usability of Security: A Case Study of PGP 5.0 User Interface http://reports-archive.adm.cs.cmu.edu/anon/1998/abstracts/98...

"Why Johnny Can't Encrypt" http://www.cs.berkeley.edu/~tygar/papers/Why_Johnny_Cant_Enc...

Re: Ask HN: Why is PGP not used widely?

#7

Post by rdxm » Sun, Nov 03, 2013, 12:38 PM UTC

The average user has no idea just how broken email is w.r.t. the concept of secure and private communication. Google's entire business is built on this broad ignorance. So for that matter is the the internet ecosystem in general if you expand the concept of use of data to include tracking of site access patterns, etc.

Moreover, it's certainly not in SV's vested interests (regardless of recent protestations to the contrary by google, facebook, etc) to see secure mail become the standard, and by extension to broadly educate and move the consuming public to a mindset of security first.

All of that said, the average end-user is/would be befuddled figuring out the use of shared pub keys, the web of trust concept, and in moreover, PKI in the bigger picture.

And even if you could get broad use of pgp going for message payload privacy/security, you don't solve the problem of metadata if you are using the current email protocol.

It's long past time for a new persistent messaging protocol that addresses metadata leakage and payload security comprehensively. There are people working on this now. Hopefully that will drive some positive steps forward on this issue.

Re: Ask HN: Why is PGP not used widely?

#8

Post by hannibal5 » Sun, Nov 03, 2013, 12:42 PM UTC

1. You don't get it integrated with your applications like browser, email software, text editor or spreadsheet by default. This leads to network effect in reverse. if you are only person to use it within your circles, signing and encrypting data and messages you send to others can't be done.

2. Encryption is extra risk for your data. If you lose the keys, you lose the data. People are bad at backing up their data, why they would be better at managing their keys? Being sloppy with your keys means that somebody can impersonate you with more credibility (what if banks would accepting PGP singed orders in email)

3. Value from widely used PGP happens mostly in society level. Encrypting any particular piece of data has negative expected value in most cases.

4. Using PGP requires understanding the basic concepts and using it well is not that easy (lots of pest practices). People don't know any of this stuff. Even public and private key is far out concept for most people.

Re: Ask HN: Why is PGP not used widely?

#9

Post by chmars » Sun, Nov 03, 2013, 12:49 PM UTC

I use GPG quite often but there are many annoying issues:

- Lacking GPG support on iOS devices, the available apps are not integrated with Mail.app (iOS).

- GPG support on OS X devices is usable with Mail.app and GPG Tools ((https://gpgtools.org/) but encrypted mails are not searchable. I use folders etc. but it is still often a pain do browse manually through mail after mail until you find the one you've been looking for …

- Webmail, for example Gmail or Outlook.com, and GPG don't fit together well – if at all.

- The public keychain is not made for use on more than one device, i.e., it's not sync-ready.

- Key verification is bothersome, i.e., you have to attend key signing parties etc.

- There are political issues, e.g., should you upload your keys to key server? If so, with or without signatures? If you upload signatures, you create not only a web of trust but you also expose at least parts of your address book.

- Key servers store long invalid keys and there is no way to remove such keys. The PGP.com key server removes keys if you don't confirm them by mail from time to time. On the other hand, the PGP.com key server only accepts one key per mail address.

- Etc.

Re: Ask HN: Why is PGP not used widely?

#10

Post by marvin » Sun, Nov 03, 2013, 12:49 PM UTC

reiz wrote: post #2

PGP is great. Everybody in tech has the skills to use it. But for non tech people it is still to difficult. But since the NSA affairs many crypto parties happened, specially in Germany. On this crypto parties tech people are teaching non tech people how to crypt emails with PGP. I think that is a good start and I hope we will see more crypto parties in future.

Won't happen unless there is a war-like situation with not only widespread surveilance, but also widespread use of surveilance. I would be willing to bet on it. Large groups of people simply have too short attention span, and the cost of not using encryption is too small (the cost of using encryption is too large).