Hacker News Reader

Comment by chimeracoder | Hacker News Reader

> Start using encryption to make your communication harder to snoop. GPG for email and OTR for instant messaging are great places to start.

I am oftentimes surprised by how few self-identifying hackers use end-to-end encryption like PGP/GPG.

Many of us use clients like Thunderbird already, which make GPG setup and use rather simple. I set up GPG on Thunderbird for my dad (who is a complete Luddite) - it took me <15 minutes, and he's been using it to email with me for over a year.

I encourage everyone reading this to set aside 15 minutes to set up GPG encryption and send a GPG-signed/encrypted email to a friend[0]. You'll see it's not so scary, and this is one of the single biggest things you can do to protect your privacy online.

[0] If you don't have any friends with PGP keys, feel free to email me. :)

View on HN

The UX problem with PGP is that you can't tell if some random has PGP before you send an email to them without manual effort. The amount of friction required is too much and leads to little adoption.

With OTR, if the person is 'online' you can just initiate a convo with them and passively have OTR enabled if the other client supports it. You also have forward secrecy, a critical feature PGP lacks.

PGP UX is horrible and still stuck in the 90s! It's great for people who need it and it was really necessary to be invented. But something like OTR is the real successor.

> PGP UX is horrible and still stuck in the 90s! It's great for people who need it and it was really necessary to be invented. But something like OTR is the real successor.

As tptacek commented on an earlier post, all of the alternatives to PGP provide more or less the same UX that PGP is capable of. It's not inconceivable that my PGP client could do most of the legwork (ie, fetching keys from keyservers, encrypting automatically, etc.) for me while maintaining compatibility with PGP.

In any case, I don't really want to enter a PGP vs. OTR discussion right now, because my original point is that many self-identified hackers use neither. If people read this thread and begin to use either one or the other, I consider that to be a win for now!

> (ie, fetching keys from keyservers, encrypting automatically, etc)

No no no no no! The keyservers have no authentication for key addition. Anybody can put up a key for any email address and effectively wedge themselves man in the middle.

Also, the paranoid in me (and probably more significantly, the keyboard-activist-in-the-safety-of-my-parents-basement) suggests that it might be wise to access keyservers over TOR.

If _I_ were involved with PRISM, the pipe running to pgp.mit.edu would be one of the most monitored connections around. "Hmmm, someone just searched for a PGP key for FedRegister - lets see what else that IP address has searched for, and what's in all the gmail inboxes that have ever been accessed using that IP address…"

Yes. This is the way that hackers should be thinking from now on.

facepalm

Yes, I redact my above comment to remove that example.

However, I still stand by my statement that PGP UX is a client issue, not an inherent protocol issue (ie, it's fixable without abandoning PGP entirely).

That's pretty much the same as learning to say "parlez-vous anglais?" before traveling to France though.

On those rare occasions when I need to email "some random", I can either choose to communicate in cleartext, or the very first exchange can be "Hi, where do I find your public key?"

May I suggest (at least for people who aren't trying to remain anonymous/pseudo-anonymous here), PGP/GPG key IDs and fingerprints in your profiles?

(Perhaps anonymous accounts could set up anonymous email accounts and single purpose generated GPG keys? A Gamil/Yahoo/Hotmai/Live email accunt in which you can spamfilter everything that's not GPG encrypted?)

> May I suggest (at least for people who aren't trying to remain anonymous/pseudo-anonymous here), PGP/GPG key IDs and fingerprints in your profiles?

PGP fingerprints should be verified out-of-band (ie, in person) before being signed.

However, that's not a bad idea as long as people understand what the fingerprints do and do not imply.

I, for one, put my PGP fingerprint on my business cards. Most people don't even notice it (it's light grey text on white, easy to miss), but a few have caught on.

> If you don't have any friends with PGP keys, feel free to email me

This (everyone has to use it or it's pointless), Gmail, and other webmail clients are why PGP doesn't get used.

I read mail with 2 clients, Thunderbird at home, and Roundcube anywhere else. Roundcube doesn't support PGP.

> This (everyone has to use it or it's pointless)

First, "everyone" does not have to use PGP for signing to be worthwhile. And I'm not saying that everyone already does; I'm saying that we should start.

Furthermore,

> Gmail, and other webmail clients are why PGP doesn't get used.

Gmail presents inherent problems with privacy and data access from the get-go. It's not a coincidence that Gmail's web interface will never be compatible with PGP.

Fortunately, Gmail still allows IMAP access, which means that people who use clients like Thunderbird and Outlook (yes, Outlook) can use PGP with their Gmail-hosted email addresses.

Maybe you're not one of those people, but a large number of people on HN are.

Reply on news.ycombinator.com