News for hackers. Stuff that matters.
Re:GPG is awesome; GPG is terrible by tptacek on Monday July 13, 2015 @12:28AM (#9876400)
What's so hard about GPG? People say this all the time but don't qualify it. Most people who use GPG don't use "web of trust", "revocation keys", or know anything about "key repository structure". They generate a key, give it to their peer, get a key back, and encrypt messages to each other.

It's not the easiest tool in the world, but it's not that much harder than, say, using a nonstandard compression tool.

Re:GPG is awesome; GPG is terrible by Tomte on Monday July 13, 2015 @12:49AM (#9876478)
Number one issue for common people: "I use webmail".

Another issue common people don't think about: How do you backup your key and actually restore it in such a way that you can read your old mails again?

Oh, and how long was GpgOL not working for the current Outlook version? Another big stone that lies in your way.

And I wish tech-savvy people would just "allow" the workflow you described above.

I have encountered too many discussions where people got scared off, because "the web of trust is the only acceptable way", and "check your government-issued ID cards! Yes, even if he's your best friend since kindergarten and he gave you the key in person!".

Nerds love playing the key party game. They love calling some first-level support and asking to recite the key's fingerprint. They love showing how goddamn smart they are. And that puts everyone else off.

It's another expression of the "security is binary" mindset that also hinders opportunistic encryption. Because there is something better we must not use this.

Lose the web of trust (and "marginal trust" is something only techies can come up with...), have a nice UI with only four or five buttons, make it work with all Outlook versions and make it work with webmail (at least GMail) and you may have a winner.

The last one is the big one and nearly impossible for anyone else, but Google seems to be working it (end-to-end for Chrome).

Re:GPG is awesome; GPG is terrible by eropple on Monday July 13, 2015 @01:35AM (#9876596)
>Number one issue for common people: "I use webmail".

Which is actually two issues. One, the interface; there's a GPG thingy for GMail, but it's kind of junk. Two, and no less important: how do I search my archive?

(Did you just say "download it"? You lose. Did you just say "don't use webmail"? You lose again.)

Re:GPG is awesome; GPG is terrible by mingus68040 on Monday July 13, 2015 @11:35AM (#9878775)
No, the webmail users lose because they have acclimated themselves to using a dumb terminal system which makes full confidentiality at least an order of magnitude more work to achieve. A user who is 100% unwilling to switch away from webmail will accomplish that security goal with just as little success as a steadfast fast-food patron pursing a healthy-eating goal.
Re:GPG is awesome; GPG is terrible by eropple on Monday July 13, 2015 @01:34PM (#9879615)
Yeah, sorry, that's not how this works. Y'see, you're sending emails to people using webmail (I mean, if you're a nominally functional human being). So your emails are insecure, too, because you are insisting on something that is fundamentally not compatible with how normal people use computers in 2015.

This is a community thing. You need to give to get them to give. And you're not giving.

Re:GPG is awesome; GPG is terrible by venomsnake on Monday July 13, 2015 @03:31AM (#9876843)
Architecture astronauts strive for perfection of design, engineers for getting the job done.

The workflow you described is easy and usually good enough and can be achieved with thunderbird + enigmail alone.