MEGAChat now includes end-to-end encryption

Re:MEGAChat now includes end-to-end encryption by c22 on Saturday January 23, 2016 @11:23AM (#10958828)

I think before you even tackle the ui issue there's a general knowledge hurdle you have to cross. Most people are unable to reason about or manipulate uis around keys because they fail to understand the purpose and basic mechanism of them. I spent roughly 5 hours explaining the general concepts behind public key cryptography to my girlfriend and this was only possible after making a compelling argument that everyone should use encryption even if they have "nothing to hide". She works as a technical writer, I can only imagine the barriers to instilling these concepts in someone with less technical vocabulary.

[ Parent | on HN ]

Re:MEGAChat now includes end-to-end encryption by yaur on Saturday January 23, 2016 @12:24PM (#10959060)

This can't be overstated. Even if we got the general public to sort of understand PGP and PKI there is going to be a significant number of users that don't understand the difference between a password and a password protected key. The expectation is going to be that when they move to a new computer that their "password still works" and are going to be extremely angry when it doesn't.

[ Parent | on HN ]

Re:MEGAChat now includes end-to-end encryption by zanny on Saturday January 23, 2016 @12:40PM (#10959121)

Thats why you cannot expect them to understan PGP and PKI. You want a sane default that can secure 99% of people and expose the guts to the last 1% through options menus.

The perfect PGP secure email client would be cross platform and provide its own email server. The client has included trusted keys to communicate with upstream, but when you first start it you make your account and that generates you a signing and encryption key based off your password, backs it up on their server (remember, its password protected, they cannot access it despite backing it up) and then whenever you sign in on other device your keys are downloaded and just work.

This basically turns PGP into username / password, but the only alternative is to use wifi to send your keys between devices when you first start your client of choice - IE, you start it for the first time, it says "do you already have an account? You say yes and it simply asks which PC on the lan has your keys, it communicates with it, you confirm on the other computer to send the keys, and it synchronizes your keys cross-device peer to peer.

And I worry even that is too complicated for my grandmother to be willing to put up with to stop the NSA from reading her emails.

[ Parent | on HN ]

Re:MEGAChat now includes end-to-end encryption by c22 on Saturday January 23, 2016 @03:47PM (#10960027)

> The perfect PGP secure email client would be cross platform and provide its own email server. The client has included trusted keys to communicate with upstream, but when you first start it you make your account and that generates you a signing and encryption key based off your password, backs it up on their server (remember, its password protected, they cannot access it despite backing it up) and then whenever you sign in on other device your keys are downloaded and just work.

> This basically turns PGP into username / password, but the only alternative is to use wifi to send your keys between devices when you first start your client of choice - IE, you start it for the first time, it says "do you already have an account? You say yes and it simply asks which PC on the lan has your keys, it communicates with it, you confirm on the other computer to send the keys, and it synchronizes your keys cross-device peer to peer.

Or you could carry your keys around with you on a physical smart device that communicates over usb or nfc. This ux already seems to work well in corporate environments, it's just a matter of convincing consumers it's worthwhile and vendors to bake support into their products.

[ Parent | on HN ]

Re:MEGAChat now includes end-to-end encryption by Freak_NL on Saturday January 23, 2016 @04:51PM (#10960273)

If the FIDO U2F standard takes off, we may just see this happen. U2F keys do not include the functionality to hold OpenPGP keys, but they could help in having people understand the notion of a keychain for security.

[ Parent | on HN ]