https://theintercept.com/2014/10/28/smuggling-snowden-secret...
I'm surprised by the number of people who say that gpg is insecure. Is it disliked because it is decentralized and everything has to be owned and tracked by the four MAGA (formerly FAANG) corporations?
A bullet proof HOWTO can fix all of this.
You cannot document your way out of a usability nightmare.
The “fix” is to channel everything through google, or a government, or some third party that makes it easy and usable, but removes the main benefits of security, transparency, and independence.
I think the reason GPG is all we have and has been for 20+ years is because that’s as good as it gets and better than nothing.
It lets people who know how to use it communicate securely.
So you can document your way out of an impossible to communicate securely nightmare.
Though there is nothing inherently free or decentralized about "PKI", and given your conflation of those concepts I suspect that you're not actually aware of where the lines are drawn from.
Certainly the decentralized nature of PGP adds some challenges to good usability.
However, a large number of the problems come from the PGP spec itself (some of which is defensible in a 20+ year old spec, but not in anything in a modern system) and from GPG's poor implementation.
I use private, centralized, rather expensive PKI every day to log in for professional work. I wouldn’t want everyone to use that. And I wouldn’t trust my work for private secrets.
I am pretty interested in this topic and would love for something better. But I’ve also used GPG for a few decades now and am able to communicate with people I need to. It’s certainly hard to use, but it’s pretty good for privacy purposes.
What do you suggest we use instead?
It's shit to use and instead of improvements we see deflections like this. Sure, there are better implementations being worked on now, but where were they in the past 10, 20 years?