Why Johnny Still Can't Encrypt: Evaluating the Usability of a Modern PGP Client

Re:Why Johnny Still Can't Encrypt: Evaluating the Usability ... by jakejake on Saturday November 07, 2015 @01:46PM (#10525748)

I agree that some terminology could make it easier. I think "key" is an ok choice for the private key, but for the public key I think there could be a better analogy. Calling them the same thing is a bit confusing and people don't understand that one of them you give away, while the other is confidential.

When I explain it to people I tell them that their public key is like an unlocked lockbox that you give people into which they can put a private message. They can close the box to lock it, but once they shut the box only you have the key to open it.

It's not a great analogy but it seems to me that the public key does not make sense as a "key" to the average person.

[ Parent | on HN ]

Re:Why Johnny Still Can't Encrypt: Evaluating the Usability ... by maxerickson on Saturday November 07, 2015 @01:55PM (#10525789)

I think if it can be made to work, a better framing is in terms of establishing a secure channel and then communicating/sharing something over that channel.

Don't make the user think about the underlying mechanism at all.

The hardest part is probably getting the public key distributed, but that can just be "Check if Bill can receive over a secure channel."

[ Parent | on HN ]

Re:Why Johnny Still Can't Encrypt: Evaluating the Usability ... by c22 on Saturday November 07, 2015 @02:42PM (#10525936)

I like this line of thinking. It seems that the word "key" is not the problem so much as the terms describing the respective key's status as opposed to their function. Perhaps something along the lines of "locking" and "unlocking" keys, or "encryption" key and "decryption" key (and, of course, "signing" key, no one has to know this is the same thing as your "decryption" key).

[ Parent | on HN ]