Hacker News Reader

Comment by 1337biz | Hacker News Reader

The big issue is usability/convenience. Gmail and Facebook are just so much more comfortable to use than open source alternatives. In my opinion the whole open source movement is way too much focused on features and not on easy functionality. Otherwise PGP emails would have become a universally adopted standard.

Unfortunately my only hope is on services such as Mega and their ambition to venture out in something such as becoming a paid email provider. Maybe they are able to combine privacy and convenience in an appropriate way.

View on HN

  | In my opinion the whole open source movement is
  | way too much focused on features and not on
  | easy functionality.

Even if there was an open-source version of Gmail, it would still mostly be a centralized solution. Even if there were millions of email providers running this OSS Gmail, the government would just knock on their door, point to (e.g.) the PATRIOT Act, and surveillance would begin. All it would do is remove the idea of "one stop shopping," but the government would still get access. It would just be slightly more work.

  | Otherwise PGP emails would have become
  | a universally adopted standard.

That's a poor example, because security software is the one place where you do want attention to technical detail over user interface. If the UI to PGP was good, but any script kiddie could break the encryption, then what would be the point?

I think it's more like, look at openssl, the crypto Swiss army knife. How is a regular person going to use that?

But if someone did just asymmetrical key encryption with one algorithm and then spent time engineering it so that a normal person could use it without taking Dan Boneh's Coursera class, there might be more people using PGP.

| Even if there were millions of email providers running this OSS Gmail, the government would just knock on their door, point to (e.g.) the PATRIOT Act, and surveillance would begin.

Having some servers abroad would make that much more complicated.

Open source does not do anything about surveillance of specific individuals the government is interested in. If they can't ask Google for your data, they'll come into your house (or datacenter) and read it off your hard drive.

I think part of the point is that if it was in your house it would be more difficult, and require more steps for the government. You've got:

1. Government can just go to one of 3 top email providers (Yahoo / Google / Hotmail) to get access to surveil most people.

2. Government can do surveillance, but must deal with hundreds or thousands of email providers.

3. Government must get a warrant (or at least have someone physically infiltrate your house) to start surveillance on you.

The point here is ramping up the cost / difficulty, so that the government adopts a more conservative approach to using these tools.

1,000 physical searches is not exactly unreasonable for the federal government, given that it's responsible for more than 300 million citizens. The New York Police Department in one year alone served almost 3,000 warrants to actually invade people's homes and search for narcotics. And that was 1997[1].

I would also point out that GMail has more than 400 million users. Investigation of 2,000 of them does not constitute mass surveillance or evidence that it's too easy to get people's data. Is it really outrageous for 0.0006% of the population to be persons of legitimate interest in investigations?

[1]http://www.nytimes.com/1998/05/26/nyregion/raids-and-complai...

There are technical solutions to this [1]. They just run counter to Google's business model. Why do you think they have not rolled out integrated PGP support, even in Labs?

[1] http://en.wikipedia.org/wiki/Deniable_encryption

How could gmail support PGP? The whole point of PGP is that the infrastructure can't read your mail. Even of Gmail wanted to, they couldn't, except maybe in the android/iphone app. But even then, you would be insane to trust them to do it right, even if they tried.

That is exactly my point.

Your point doesn't really make sense, though. As is often brought up in this discussion: see the example of Hushmail[1]. If you don't provide your own encryption mechanism, you cannot trust it, which is what Evbn is saying, I think. That's why it makes no sense as a Lab offering (and I'm not sure which is the worst option: encrypting the email in a browser via javascript or encrypting it after it's on the mail server and out of your control).

And of course you can use PGP with almost any email system right now. Just download thunderbird and enigmail (or whatever is the good one these days) and use gmail through IMAP.

[1] http://en.wikipedia.org/wiki/Hushmail#Compromises_to_email_p...

Order your residential ISP to set up port mirroring, receive all your encrypted email, then go into your house and plant a keystroke logger to get the key. Or just put you in jail until you provide it. Good luck convincing a judge that you download random noise from your IMAP server for fun.

PGP could make it very difficult to surveil the whole population, but that's not what's going on here. There's not really a way to stop a sovereign government from getting data on individuals of interest.

> "but that's not what's going on here."

Not with the NSLs, no. But when you consider the not-so-secret rooms at all the ISPs: that is what's going on there.

Not without a warrant, which is presumably useless against good encryption. Moreover, the dominant view is that a judge can't compel you to disclose the encryption key unless the authorities have already seen what was encrypted.

They can get a warrant to pick your lock and install a keystroke logger, or bust in while you're using your computer, forcibly separate you from it, and download the encryption key from memory.

Right, I'm not arguing that. My point is that it's considerably more difficult for them to go this route; they need to convince a judge to affix his signature (and his credibility) to a warrant by demonstrating the existence of probable cause.

Reply on news.ycombinator.com