Comment by acdha | Hacker News Reader

Comment by acdha | Hacker News Reader

I applaud the sentiment but really wish we had something which wasn't a UX disaster. I tried to set this up on a Mac, which is what this looks like for someone who first started using PGP in the mid-90s:

GPG Tools seems to be popular and has Mail.app integration. It loads, shows the secret key as valid in the GPG Keyring app, but any attempt to decrypt a message fails with “Secret key to decrypt the message is missing”. No diagnostic information is provided.

Okay, I'll pretend it's still 1995 and run it on the command-line. "pbpaste | gpg --decrypt" needs a password, so I naively attempt to setup gpg-agent so I don't need to keep pulling my 30-character password from my password manager. "brew install gpg-agent" and it quickly turns out that it's just broken: pinentry doesn't get stdin for some reason and chews 100% CPU printing * as quickly as possible.

So much for saving time in the future; let's just see if we can open one message. Save it to a temp file, run it through gpg --decrypt and … it's HTML so the URL needs to be unescaped, so make that "gpg --decrypt encrypted.asc | urlview".

Open that URL and get … a server error from Facebook.

So … another vote for http://www.thoughtcrime.org/blog/gpg-and-me/

Hi Chris. I worked on this and want to diagnose your server error.

When you decrypted from the command line, did you notice the plaintext blob preceding the HTML message content? Look for "Content-Type: text/plain;" and see if there is an unmodified verification URL there.

You might have only noticed the HTML one, which will be a pain to cut & paste. If it's still broken, please contact me.

Incidentally, I've been using both GPGTools/Mail.app and Gmail/Mailvelope without trouble. The latter doesn't open clicked links in a new tab, though. I've had to "Copy as" and paste in another tab.

The point is that somebody shouldn't have to come in and diagnose the server error.

Yes, that's the point with all software. Everyone would love not ever getting errors and issues. But, just like with all other software out there, there will inevitably be bugs and corner cases which have to be diagnosed. I'd prefer someone from the product team actually caring about this and helping out rather than no support offered whatsoever, which is closer to the norm for big companies.

It is the first day of availability of this service, so it might be possible to find ways to improve its reliability and usefulness, even if you're kind of skeptical of PGP's design overall.

I agree with the general intent but since something broke, +1 to sweis for trying to fix it.

This is such a typical HN negative comment. Obviously the point is for there to be no bugs - any other extremely obvious things you would like to state?

People post things on here and simply get attacked, even if they're trying to do good and improve like OP for this thread is. It's people like you who drive others away from this site through your constant "this sucks, that sucks" mindset.

OP's comment is intended to tell us that This Shit Is Broken for him, and clearly for other users as well. OP is not requesting tech support. As nice as sweis is for offering support, he fails to acknowledge that solutions such as this one are simply not ready for most users from a UX perspective.

Reinforcing this point to sweis is not a negative comment. It is a comment you do not like. There is a difference.

Show me software that has been released with 0 bugs. This is part of what makes the HN community so great, being able to interact with real people who work on the topics being discussed.

The server error is turns out to be relatively simple: urlview was picking up the plain-text version, which wraps the URL in square brackets:

[https://www.facebook.com/…/publickey/verify/?e=1&fp=…&ext=…&...]

The regex which urlview uses includes the final bracket, which causes the error. Once I removed it, I successfully validated the key.

It'd probably be best to put the URL on its own line but if not, RFC 2396 recommends using angle brackets – see “Recommendations for Delimiting URI in Context” in http://www.ietf.org/rfc/rfc2396.txt.

Thanks, I noticed the square brackets as well. We'll look into it.

Great, thanks!

I just went through and installed GPGTools for mac mail, and installed the key into facebook with no issues. (Well I copied just the 'random' set of numbers and the fb site told me to include a bit more of the header/footer of the key ). ] It all seems to work (perhaps they fixed the issue?)

... the challenge now is how will my email come through on iOS!? Any recommendations for that? I saw https://ipgmail.com/

iPGmail works, but it's a somewhat cumbersome solution.

The lack of a decent iOS mail client with GPG support is somewhat of a show stopper for me.

Installing GPG Tools on Mac sets up gpg-agent automatically and has Mac Keychain support. I use the agent support all the time for signing Maven artifacts (which requires password-less entry due to the way the release plugin works).

Indeed – and yet it still doesn't work. I'm sure that it could be made to work with enough debugging, having done so multiple times over the years, but this needs to work better by default. Security software in particular needs to inspire trust to avoid incentivizing everyone not to use it.

This isn't yet at S/MIME levels, much less something like iMessage or Signal/TextSecure – and, yes, there's a ton of room to argue their respective merits but most users are simply going to switch to something which gets their message through rather than debug failures, particularly when the software doesn't give any feedback about what's wrong and, critically, what you could do to fix it.

I get what you're saying, but it took me literally less than 5 minutes to configure this on my MacBook Pro running Yosemite and the latest GPG Tools.

To copy your public key to the clipboard where it can be pasted into your Facebook profile, just do this from the command line:

    gpg --export --armor bob@example.com | pbcopy

A short time later, I received a signed and encrypted email message from Facebook. The whole thing went surprisingly smoothly; it gives me hope that using OpenGPG won’t solely belong to the neckbeard crowd and that Twitter, Google+ and other social media platforms will follow suit.

I also love the subversive nature of this; regardless of how the Patriot Act legislation turns out, Facebook is now providing email that only the recipient’s private key can decrypt and that nobody else can read.

> I get what you're saying, but it took me literally less than 5 minutes to configure this on my MacBook Pro running Yosemite and the latest GPG Tools.

That's the same config I used as well. I used the same export as you but I could have used the GPG Keyring for that step – it's only the mail integration or gpg-agent which fail, unfortunately without any explanation.

That was my real point: I can use everything from the command-line, just like the first time I used PGP in 1993, but for this to catch on the integration needs to be both seamless and reliable. All but the most dedicated privacy / security activists handle failures by disabling the crypto software.

That's been the rule since the 90s: I've seen a bunch of people use PGP/GPG or S/MIME for a few weeks and then give up when they hit a problem and realized that nobody else actually noticed or, in the case of mailing lists, that people using crypto-aware clients couldn't read legitimate messages but everyone else could.

Exceedingly few people care that the software is working correctly when the experience is unpleasant and that's really what needs to change to see popular update. People love iMessage and that's because they're confronted with the always-on strong encryption breaking the experience. It'd be harder to hit that with a decentralized, cross-platform system but that's what we should be shooting for.

Reply on news.ycombinator.com