News for hackers. Stuff that matters.
Re:What's the matter with PGP? by unimpressive on Wednesday August 13, 2014 @03:09PM (#8174505)
>They do indeed have an advantage in deployability!

Deployability is worth more than might be immediately obvious. The question of deployment is directly related to the business of availability. If 99% of people used a crypto system that provided no real security beyond thwarting a global adversary, which also had the option for further measures to confirm identity when necessary, we would be in a much better position than we are now because it would mean that when I do have contacts I would prefer to use encryption with the software will already be on their system and I only need to instruct them in how to use it.

There's a fallacy in saying that no measures are better than imperfect measures 'because then you don't have a false sense of security'. Regardless of security measures or not the false sense of security is baked into how people use computers.

I challenge you to go explain to anyone you know who does not identify as a 'computer person' how email routing works and why it's quite possible for a 3rd party to read their mail. If they even understand what you're talking about, the response is an almost universally cool 'Oh but so many other people do it, and what am I supposed to do stop using email?'

The vast majority of people will not stop talking just because in the abstract they might be overheard.

EDIT: As a note, I think any centralized system of key distribution is fundamentally insecure.

Re:What's the matter with PGP? by Spooky23 on Wednesday August 13, 2014 @09:25PM (#8175690)
You educate them.

The way I did this in a past life:

- Explain that email is a postcard. - Give examples of information that should not belong in email. - Provide demonstration of the issues people creates for themselves by breaking the rules. - provide tools to accomplish business needs (file transfer in particular) - Tell them that their email is subject to audit. - Implement technical controls to warn/enforce suspect behavior.

People want to do the right thing, but you must set clear expectations so they know what to do! The most secure email is one that is never sent.

Re:What's the matter with PGP? by ownagefool on Thursday August 14, 2014 @03:42AM (#8176453)
As a 'computer Person' my response is much the same.

You can however get them to consider what they put in there by explaining "email is like a postcard; everyone who touches it can read it".

Re:What's the matter with PGP? by MrUnknown on Wednesday August 13, 2014 @09:16PM (#8175665)
> I challenge you to go explain to anyone you know who does not identify as a 'computer person' how email routing works

I usually use the "It's like mailing a postcard" comparison.