upvote

points

by dylan6044 hours ago |
comments
upvoteby upofadown3 hours ago|
next
[-]
One big usability issue these days is that PGP identities come in the form of a file. Lots of people don't have the concept of that anymore.

Dunno that things have gotten much better over the years. End to end encryption is still fairly unusable to most. I think that rather than spending so much time on the cryptography we should instead work on a E2EE usability standard. Having everyone doing their own thing with respect to usability is not working out.

reply
upvoteby boomlinde1 hours ago|
parent|
next
[-]
ASCII armored exports suitable for plain text copying and pasting and inclusion in other documents and messages seem to be the norm for sharing. Keys are referred to by keyid or email. To the key database, files seem more like an implementation detail.

It provides the tools necessary to implement a simpler workflow.

reply
upvoteby dylan60455 minutes ago|
parent|
prev|
[-]
The term E2EE has been subverted. Apps like WhatsApp claiming to be E2EE, but only if you actually enable it, so that people think they are being encrypted when they are not does not help. ProtonMail falls into this as well where allowing email to non-encrypted addresses means there is no encryption. It's obvious to some, but not so for the majority. Very few people read the caveats that WhatsApp and ProtonMail provide.
reply
upvoteby __MatrixMan__3 hours ago|
prev|
next
[-]
There were (are? it's been a while) many PGP users on the various darkweb markets. It was great fun teaching people to use it and actually having a community to use it with.

It was pretty awkward to later emerge as the PGP expert at work. I was at that time a bit shy about explaining how I got so comfortable with it.

reply
upvoteby serbuvlad3 hours ago|
parent|
[-]
The fundamental idea of technology such as PGP is that the percentage of stuff worth finding for the authorities needs to be really low. Ie. an incredible amount of "legitimate" innocent traffic needs to be flowing through the technology.

Otherwise, anyone who is using it at all will get court ordered and then, with our current system, you just lose.

Tor solves this by making traffic entirely homogenous such that any "it could be anyone" and by making nodes extraordinarily easy to host (such that any nerd can just leave one running 24/7). Even so there are way too few nodes.

But PGP-over-email is way too metadata leaky, and if you're doing anything that actually has a threat model, you need PGP-over-email to be itself common.

reply
upvoteby dylan60449 minutes ago|
parent|
[-]
Even today, you still need an external program to your email app to enable encrypted messages with in the email app. With that, the number of encrypted emails will be extremely low relatively. Even looking at Tor, the amount of users is still much lower than the internet in general. To the point, I doubt a very high amount of traffic is "regular" traffic to raise the noise floor.
reply
upvoteby oger3 hours ago|
prev|
[-]
To be honest: I keep hearing that PGP was / is difficult to use. That couldn‘t be further from the truth - but somehow it has become an urban myth. From the very first versions that I used on my first Mac up to GPG Mail or Proton Mail I never encountered any significant difficulties and could successfully exchange messages with my peers - both in business and private contexts.
reply
upvoteby jcranmer3 hours ago|
parent|
next
[-]
I once had a chat with a security professor who had decided to try to get his group to use encrypted email for all of their communications. And they just couldn't get mailing lists working right with encrypted email.
reply
upvoteby datas2 hours ago|
parent|
[-]
The sender has to encrypt with everyones individual key wonder why he couldn't get it to work.
reply
upvoteby 2 hours ago|
parent|
next
[-]
deleted
reply
upvoteby Joel_Mckay1 hours ago|
parent|
prev|
[-]
In general, a session/thread ephemeral key pair is exchanged with the participants, and only each users private origin signing validates each sender sections. Since the signatures are passively checked, it does not need redone after each append operation.

Thus, participants are pooled under 1 time constrained key exchange, participants sections origins are signed/time-stamped, and the ciphertext expires on a schedule.

Why? so at some future time side-channel key exfiltration can't be used to data mine the entire history of past tapped conversations/ciphertext. Even if a private signing key is stolen, it is difficult to rebuild the lost ephemeral key session.

Have a nice day. =3

reply
upvoteby sire-vc1 hours ago|
parent|
[-]
My eyes glazed over reading that. I feel like 30 years of internet has proven one thing: the simplest solution always wins. PGP is many things, but simple and obvious are not among them.
reply
upvoteby Joel_Mckay8 minutes ago|
parent|
[-]
Mozilla Thunderbird e-mail client, and Android k9 mail makes pgp/gpg public key handling fairly trivial.

Depends what you do, and if your organization has a persistent clown infestation. Some big business folks still use email as a human to API interface.

Running out-of-band public keychains is not something most people will ever need. =3

reply
upvoteby dylan60453 minutes ago|
parent|
prev|
[-]
Please, enlighten me on how you used PGP where calling it hard to use is so far from the truth. ProtonMail only works if you send messages to another ProtonMail user. It does not protect you when you email someone else.
reply