GPG is awesome; GPG is terrible

Re:GPG is awesome; GPG is terrible by sigsergv on Monday July 13, 2015 @12:15AM (#9876349)

GPG/PGP is a VERY hard tool, conceptually hard. Yes, you can run through these “quick-starts” but they give you zero understanding what exactly you are doing.

GPG requires a deep understanding of things it's based on: web of trust, public key, private key, revokation key, keys repository structure etc. And these things are really really hard.

[ Parent | on HN ]

Re:GPG is awesome; GPG is terrible by tptacek on Monday July 13, 2015 @12:28AM (#9876400)

What's so hard about GPG? People say this all the time but don't qualify it. Most people who use GPG don't use "web of trust", "revocation keys", or know anything about "key repository structure". They generate a key, give it to their peer, get a key back, and encrypt messages to each other.

It's not the easiest tool in the world, but it's not that much harder than, say, using a nonstandard compression tool.

[ Parent | on HN ]

Re:GPG is awesome; GPG is terrible by Tomte on Monday July 13, 2015 @12:49AM (#9876478)

Number one issue for common people: "I use webmail".

Another issue common people don't think about: How do you backup your key and actually restore it in such a way that you can read your old mails again?

Oh, and how long was GpgOL not working for the current Outlook version? Another big stone that lies in your way.

And I wish tech-savvy people would just "allow" the workflow you described above.

I have encountered too many discussions where people got scared off, because "the web of trust is the only acceptable way", and "check your government-issued ID cards! Yes, even if he's your best friend since kindergarten and he gave you the key in person!".

Nerds love playing the key party game. They love calling some first-level support and asking to recite the key's fingerprint. They love showing how goddamn smart they are. And that puts everyone else off.

It's another expression of the "security is binary" mindset that also hinders opportunistic encryption. Because there is something better we must not use this.

Lose the web of trust (and "marginal trust" is something only techies can come up with...), have a nice UI with only four or five buttons, make it work with all Outlook versions and make it work with webmail (at least GMail) and you may have a winner.

The last one is the big one and nearly impossible for anyone else, but Google seems to be working it (end-to-end for Chrome).

[ Parent | on HN ]

Re:GPG is awesome; GPG is terrible by eropple on Monday July 13, 2015 @01:35AM (#9876596)

>Number one issue for common people: "I use webmail".

Which is actually two issues. One, the interface; there's a GPG thingy for GMail, but it's kind of junk. Two, and no less important: how do I search my archive?

(Did you just say "download it"? You lose. Did you just say "don't use webmail"? You lose again.)

[ Parent | on HN ]

Re:GPG is awesome; GPG is terrible by mingus68040 on Monday July 13, 2015 @11:35AM (#9878775)

No, the webmail users lose because they have acclimated themselves to using a dumb terminal system which makes full confidentiality at least an order of magnitude more work to achieve. A user who is 100% unwilling to switch away from webmail will accomplish that security goal with just as little success as a steadfast fast-food patron pursing a healthy-eating goal.

[ Parent | on HN ]

Re:GPG is awesome; GPG is terrible by eropple on Monday July 13, 2015 @01:34PM (#9879615)

Yeah, sorry, that's not how this works. Y'see, you're sending emails to people using webmail (I mean, if you're a nominally functional human being). So your emails are insecure, too, because you are insisting on something that is fundamentally not compatible with how normal people use computers in 2015.

This is a community thing. You need to give to get them to give. And you're not giving.

[ Parent | on HN ]

Re:GPG is awesome; GPG is terrible by venomsnake on Monday July 13, 2015 @03:31AM (#9876843)

Architecture astronauts strive for perfection of design, engineers for getting the job done.

The workflow you described is easy and usually good enough and can be achieved with thunderbird + enigmail alone.

[ Parent | on HN ]

Re:GPG is awesome; GPG is terrible by VMG on Monday July 13, 2015 @12:35AM (#9876422)

As the author points out, GPG makes it unnecessarily complex on top of that because it prioritizes backwards-compatibility over of ease of use.

Why not have sane defaults instead of asking for all these parameters?

There are apps that use crypto which have a much nicer interface. Telegram and Schildbach Bitcoin Wallet come to mind. Even BitMessage is easier to use.

[ Parent | on HN ]

Re:GPG is awesome; GPG is terrible by hlieberman on Monday July 13, 2015 @12:22AM (#9876375)

Yes, it is. But that's a fault of the tool, not a fault of the world; while many of these problems are very difficult, and solutions are not easy to come by, some of them we do have good strategies for. And even for GPG itself, it could be far more forgiving than it is. Without fundamentally changing the protocol, we could eliminate a large portion of GPGs configurability, and streamline it to make the "correct" choices. We as a tech industry are slowly coming around to the idea that secure systems are ones with less choices, not more.

[ Parent | on HN ]

Re:GPG is awesome; GPG is terrible by wglb on Monday July 13, 2015 @04:04PM (#9880674)

You really only need to understand public key and private key, and the rest of that is not necessary for most of the use cases. If someone has any familiarity with the command line, then can pick it up quite quickly.

[ Parent | on HN ]