News for hackers. Stuff that matters.
Re:Creating the perfect GPG keypair by ytjohn on Sunday December 13, 2015 @09:28AM (#10726415)
I think for gpg and encrypted communications to take off, it has to come in the form of an easy to use app combined with a service offering, similar to how TextSecure/Signal works. Though it should use GPG and have a variant for Android, iOS, and native desktop clients.

The cloud service offering should be email and instant messaging, email, and some levels of sync (but not the private key).

It should be/do:

  - Open source
  - Generate a private key as part of the setup
  - Upload your public key to the public key servers
  - Access camera to read a key (qr code) from another device
  - Display QR code of your private key (so you can sync it
    to another device)
  - Display a QR code of your public key (so someone you meet in
    public can copy it and you can then trust that key)
  - Show confidence levels based on how trusted a key is. Help bubbles can explain the confidence level.
  - Import your contacts
  - Periodically query public key server to see if your contacts have uploaded a public key.
Advanced options like importing your own key, adding "Trusted keys", and using your own email provider should also be a thing. I suppose keys could be exchanged using NFC as well, but I think that's still beyond most people.

For the most part, this should be presented as a secure communication app/service. If you want to start communicating securely with someone, you ask them to install the app. You should be able to do it while grabbing lunch together(which results in trusted keys exchanged between the both of you). Or you can invite them to use the app, which results in them getting an encrypted email address and IM system.

Finally, encrypted emails and messages could be synchronized between devices, maintaining state.

The goal of the app and service is that Johnny will see this app as their secure communication. They will know that until the other person sets up their copy of the app, that they can't send a secure message to them. And since it relies on public gpg servers, if they come across an advanced person out there that setup GPG on their own, it will be able to email that person just as easily (and that advanced person can email the app user).

Re:Creating the perfect GPG keypair by everfree on Sunday December 13, 2015 @01:37PM (#10727279)

   - Open source
   - Generate a private key as part of the setup
   - Upload your public key to the public key servers
   - Access camera to read a key (qr code) from another device
   - Display QR code of your private key (so you can sync it
    to another device)
   - Display a QR code of your public key (so someone you meet in
    public can copy it and you can then trust that key)
^ Keybase [1] has a mobile app in the works that will theoretically be able to do all of this. I'll be curious to see how it comes along.

- [1] https://keybase.io/

Re:Creating the perfect GPG keypair by 616c on Sunday December 13, 2015 @02:01PM (#10727390)
I am merely a user, not a contributor yet. But I would say a solid base, and not a full implementation of your wanted features list, is in OpenKeychain.

http://www.openkeychain.org/

Projects like this are why I continue to use Fdroid, Cyanogen AOSP, and believe the open source movement on mobile is worth the hassle. Oh yea, that and Password Store.

https://github.com/zeapo/Android-Password-Store/

Re:Creating the perfect GPG keypair by sufficient on Monday December 14, 2015 @04:20AM (#10730082)
Yup, we are working on the remaining points, see https://www.openkeychain.org/k-9/

- Dominik