>Number one issue for common people: "I use webmail".
Which is actually two issues. One, the interface; there's a GPG thingy for GMail, but it's kind of junk. Two, and no less important: how do I search my archive?
(Did you just say "download it"? You lose. Did you just say "don't use webmail"? You lose again.)
Re:GPG is awesome; GPG is terrible
by mingus68040 on Monday July 13, 2015 @11:35AM
(#9878775)
No, the webmail users lose because they have acclimated themselves to using a dumb terminal system which makes full confidentiality at least an order of magnitude more work to achieve. A user who is 100% unwilling to switch away from webmail will accomplish that security goal with just as little success as a steadfast fast-food patron pursing a healthy-eating goal.
Yeah, sorry, that's not how this works. Y'see, you're sending emails to people using webmail (I mean, if you're a nominally functional human being). So your emails are insecure, too, because you are insisting on something that is fundamentally not compatible with how normal people use computers in 2015.
This is a community thing. You need to give to get them to give. And you're not giving.
Another issue common people don't think about: How do you backup your key and actually restore it in such a way that you can read your old mails again?
Oh, and how long was GpgOL not working for the current Outlook version? Another big stone that lies in your way.
And I wish tech-savvy people would just "allow" the workflow you described above.
I have encountered too many discussions where people got scared off, because "the web of trust is the only acceptable way", and "check your government-issued ID cards! Yes, even if he's your best friend since kindergarten and he gave you the key in person!".
Nerds love playing the key party game. They love calling some first-level support and asking to recite the key's fingerprint. They love showing how goddamn smart they are. And that puts everyone else off.
It's another expression of the "security is binary" mindset that also hinders opportunistic encryption. Because there is something better we must not use this.
Lose the web of trust (and "marginal trust" is something only techies can come up with...), have a nice UI with only four or five buttons, make it work with all Outlook versions and make it work with webmail (at least GMail) and you may have a winner.
The last one is the big one and nearly impossible for anyone else, but Google seems to be working it (end-to-end for Chrome).