Hacker News Reader

Comment by mahyarm | Hacker News Reader

The UX problem with PGP is that you can't tell if some random has PGP before you send an email to them without manual effort. The amount of friction required is too much and leads to little adoption.

With OTR, if the person is 'online' you can just initiate a convo with them and passively have OTR enabled if the other client supports it. You also have forward secrecy, a critical feature PGP lacks.

PGP UX is horrible and still stuck in the 90s! It's great for people who need it and it was really necessary to be invented. But something like OTR is the real successor.

View on HN

> PGP UX is horrible and still stuck in the 90s! It's great for people who need it and it was really necessary to be invented. But something like OTR is the real successor.

As tptacek commented on an earlier post, all of the alternatives to PGP provide more or less the same UX that PGP is capable of. It's not inconceivable that my PGP client could do most of the legwork (ie, fetching keys from keyservers, encrypting automatically, etc.) for me while maintaining compatibility with PGP.

In any case, I don't really want to enter a PGP vs. OTR discussion right now, because my original point is that many self-identified hackers use neither. If people read this thread and begin to use either one or the other, I consider that to be a win for now!

> (ie, fetching keys from keyservers, encrypting automatically, etc)

No no no no no! The keyservers have no authentication for key addition. Anybody can put up a key for any email address and effectively wedge themselves man in the middle.

Also, the paranoid in me (and probably more significantly, the keyboard-activist-in-the-safety-of-my-parents-basement) suggests that it might be wise to access keyservers over TOR.

If _I_ were involved with PRISM, the pipe running to pgp.mit.edu would be one of the most monitored connections around. "Hmmm, someone just searched for a PGP key for FedRegister - lets see what else that IP address has searched for, and what's in all the gmail inboxes that have ever been accessed using that IP address…"

Yes. This is the way that hackers should be thinking from now on.

facepalm

Yes, I redact my above comment to remove that example.

However, I still stand by my statement that PGP UX is a client issue, not an inherent protocol issue (ie, it's fixable without abandoning PGP entirely).

That's pretty much the same as learning to say "parlez-vous anglais?" before traveling to France though.

On those rare occasions when I need to email "some random", I can either choose to communicate in cleartext, or the very first exchange can be "Hi, where do I find your public key?"

Reply on news.ycombinator.com