To be honest: I keep hearing that PGP was / is difficult to use. That couldn‘t be further from the truth - but somehow it has become an urban myth. From the very first versions that I used on my first Mac up to GPG Mail or Proton Mail I never encountered any significant difficulties and could successfully exchange messages with my peers - both in business and private contexts.

▲

tgsovlerkhgsel 15 hours ago | parent | next [-]

At least the versions I remember had a really bad UX for marking keys as trusted.

The correct operation for (even locally) marking "this key belongs to person X" is signing the key. Marking it as "trusted" indicates "this key is a CA that can create statements who other keys belong to", but it's easier to find/"understand".

So if you haven't first studied the details of the security model and terminology, you just start increasing the trust level on the key of your communication partner until the warnings go away, not realizing that by doing this, you've made that key a CA and the reason the warnings disappeared is because you now trust the self-signature (in addition to all other signatures the key issued).

▲

alkonaut 6 hours ago | parent | prev | next [-]

It's still extremely difficult.

If we assume that the threshold of what is "difficult" is for example 1) installing a desktop application, or even running a deskop OS.

2) Running an email provider other than what you are already doing (gmail, hotmail, yahoo mail, ...), or switching email providers

3) Copying and pasting text or using files.

This was perhaps a viable thing to do for users in 2005 because if you were on the internet, chances are you at least had a desktop computer, and if you used email chances are you already had to struggle with an email client.

But now? Anything that isn't as easy as installing an app on your device (a device that isn't a full computer) is "difficult".

It's not that it's harder today, it's that everything else is easier (Like telegram/signal and other privacy-minded services), and that there are now 6 billion internet users and most never used a computer and never will.

▲

zikduruqe 5 hours ago | parent [-]

> It's still extremely difficult.

I don't see how. You just type "gpg -e -r receipient@domain.com filename.txt". It doesn't get much simpler than that. It's not like you are using ffmpeg, imagemagick, or other programs with a hundred switches in it.

Also PGP/GnuPG is not only for email. I encrypt and decrypt hundreds and hundreds of payloads per day, programmatically between trusted and untrusted networks.

And it is mandatory for each employee to upload their public key to our keystore so that we can deliver private information to them securely over Slack, Teams, or other communication channels.

▲

alkonaut an hour ago | parent | next [-]

> You just type "gpg -e -r receipient@domain.com filename.txt".

I assure you it is not that simple. For example, I'm a HN user, developer since 30 years. I know that you referred to what's known as a "terminal" or "shell" here, but that's already way WAY too difficult for 99.9% of users.

And even in my terminal I can assure you it won't work: "'gpg' is not recognized as an internal or external command, operable program or batch file."

I could install it. It would be a right pain though. and it doesn't help if the recipient of my email can't install it without me sending a long list of instructions!

Meanwhile my dad had zero problems installing signal. There's a difference to how easy it gets.

	▲	an hour ago \| parent [-]
		[deleted]

▲

dylan604 an hour ago | parent | prev [-]

Tell me you're a nerd without telling me you're a nerd. Maybe you've moved the goalposts to "it's easy for tech dorks" vs "it's a total pain in the arse for your mom to use'. If the goal is to have encrypted email everywhere, running anything in via command line is out. If you can't recognize that, then you're clearly just trolling

▲

jcranmer 19 hours ago | parent | prev | next [-]

I once had a chat with a security professor who had decided to try to get his group to use encrypted email for all of their communications. And they just couldn't get mailing lists working right with encrypted email.

▲

datas 19 hours ago | parent [-]

The sender has to encrypt with everyones individual key wonder why he couldn't get it to work.

▲

18 hours ago | parent | next [-]

[deleted]

▲

Joel_Mckay 18 hours ago | parent | prev [-]

In general, a session/thread ephemeral key pair is exchanged with the participants, and only each users private origin signing validates each sender sections. Since the signatures are passively checked, it does not need redone after each append operation.

Thus, participants are pooled under 1 time constrained key exchange, participants sections origins are signed/time-stamped, and the ciphertext expires on a schedule.

Why? so at some future time side-channel key exfiltration can't be used to data mine the entire history of past tapped conversations/ciphertext. Even if a private signing key is stolen, it is difficult to rebuild the lost ephemeral key session.

Have a nice day. =3

▲

sire-vc 17 hours ago | parent [-]

My eyes glazed over reading that. I feel like 30 years of internet has proven one thing: the simplest solution always wins. PGP is many things, but simple and obvious are not among them.

	▲	Joel_Mckay 16 hours ago \| parent [-]
		Mozilla Thunderbird e-mail client, and Android k9 mail makes pgp/gpg public key handling fairly trivial. Depends what you do, and if your organization has a persistent clown infestation. Some big business folks still use email as a human to API interface. Running out-of-band public keychains is not something most people will ever need. =3

▲

dylan604 17 hours ago | parent | prev [-]

Please, enlighten me on how you used PGP where calling it hard to use is so far from the truth. ProtonMail only works if you send messages to another ProtonMail user. It does not protect you when you email someone else.

▲

traceroute66 3 hours ago | parent [-]

> ProtonMail only works if you send messages to another ProtonMail user.

Your wording is not entirely accurate.

ProtonMail works perfectly well with external PGP. You can import third-party keys and IIRC it also supports WKD.

So its not "only another ProtonMail user".

IN ADDITION .... you can also send an encrypted, password protected message to a non-Proton Mail email address. The recipient can read it in the browser: https://proton.me/support/password-protected-emails

▲

dylan604 an hour ago | parent [-]

Your use of ProtonMail+PGP is not how people expect ProtonMail to work when it is claimed to be encrypted email. ProtonMail+PGP is no different than GMail+PGP or AOL+PGP or FastMail+PGP or $coolNameMail+PGP. So what's your point?

Anything+PGP can be encrypted. You still have to use PGP which means creating public/private key pairs, store them correctly, and understand when to use the public key and when to use the private key. You still then need to know how to exchange keys in a trustworthy manner, but that's after you convince someone else to do all of that on their end as well.

So yeah, it's dead simple <facepalm>

	▲	KAMSPioneer 18 minutes ago \| parent [-]
		What GP likely means is that a Protonmail user can exchange encrypted emails with a non-Protonmail user without doing anything except importing the non-Protonmail user's keys once. This could allow a single technical user with an elaborate PGP key and email setup to convince his or her social circle (or at least email circle) to switch to Protonmail and follow a set of (comparatively) simple steps to get Proton to recognize the key to their non-Proton address. Thereby having PGP-encrypted conversations with users who don't know how PGP works, but followed their friends' instructions to use a slightly different webmail interface. Meanwhile the technical user can use a smartcard, a self-hosted email server, or other madness that a normal user would never tolerate.