-----BEGIN PGP SIGNED MESSAGE----- 
    Hash: SHA1

Very few people verify signatures. Most implementations are impossible for most people. Including a signature may increase risk by leading to false sense of security.

    -----BEGIN PGP SIGNATURE----- 
    Version: PGPfreeware 6.5.8

    iQA/AWuBP8e2M4NxG4rj7+GnEQKyPQCfaOxVJCSfv1Ej0W1Leo/FNC+zBSsAoNrC 
    vkPIrX6tsLdCT/uG0zGN06fP 
    =vqQX 
    -----END PGP SIGNATURE-----

Hey, I recognize that gobbledygook. Those random letters and numbers mean I can trust whatever you say, right?

No, it means that there is a way with which you can verify whether you can trust or not.

Yes, I understand how you meant it. By I really can't understand ordinary people can even come to "your" conclusion. How can people be so stupid (sorry for my harsh wording) not to be able to understand that a digital signature just means that there exists a possibility to check whether the message is authentic (and this has to be done if necessary) instead of being authentic?

Because its just noise to non-tech people.

It's the same reason why email accounts have 2,000 unread inbox messages or 30 notifications at the top of their phone. You get so used to seeing the notification that you begin to ignore it. In this case, you see a string of non-readable text that makes up some weird "signature" at the bottom. The conclusion? "Oh. The signature is there. It's been authentic every other time I checked. Why wouldn't it be authentic on the 101st check?"

Humans are the hardest vector to defend in an attack. Never underestimate the laziness of people - even when a simple solution exists to combat the problem at hand.

But shouldn't one's email program handle all that in the background, so you get the equivalent of a browser's padlock icon showing whether authentication has been successful rather than getting the PGP (or whatever). Yes, there will still be ways around people but this seems like it should be a standard and basic part of all email programs now.

This is probably the most elegant solution to a PGP signature.

> this seems like it should be a standard and basic part of all email programs now

I can't speak with authority on this, but it feels like this would be adding overhead to something that doesn't necessarily need it. Email is supposed(!) to be relatively simple. I can think of many cases where you would definitely want to have PKI integrated into your emails, but I can think of just as many cases where it's unnecessary overhead in email clients as a standard. However, I admit that I could be wrong.

I agree that it would make sense to add this functionality to the core of the email program. But this is a UI problem (i.e. it makes things that have been understood more comfortable), but does not change whether or not you have understood what a signature means.

Just the other day there was an article on Kevin Mitnick, this kind of attack is a malicious version of what he used to do ("Social Engineering")

https://news.ycombinator.com/item?id=10796950

http://henrikwarne.com/2015/12/27/social-engineering-from-ke...

GnuPG tells me that it's gobbledygook :)