Hacker News Reader

Comment by guenp | Hacker News Reader

https://gpgtools.org/ works great for Mac.

For technical folk, yeah. For nontechnical folk, nothing seems to come even close though. The great thing about HTTPS, for example, is all users need to care about is a little green lock. (And frequently, they have no idea what HTTPS is, but know that little green lock === safe)

> little green lock === safe

Which is not true. Little green lock means the site has HTTPS, being safe requires much more than that. Security is hard to explain.

Of course, but this is nonetheless the view for typical end users.

And THIS is the problem. Yeah the app is a pain to install, but security is a mindset, not just an app.

I even wonder how many people download an ISO or installer from a website, and do any sort of due diligence to find the signer's key from another 3rd party location, then verify previous builds, or require multiple signers of a key to give any semblance that the key is not fake? Or do we all just download the ISO and the .iso.asc file from the links provided and call it good? Even security minded people can be lazy in this situation.

HTTPS is easy because it only provides encryption in transit. It is analogous to opportunistic encryption of SMTP, which is already in widespread use.

Another reason HTTPS is easy is that it uses a centralized trust model, relying on CAs to vet each website.

GPG is neither. It tries to provide encryption at rest, and relies on a web of trust that we cannot reasonably expect everyone to operate securely.

It does work well, except when there's a macOS major version bump (10.9 -> 10.10 -> 10.11 etc.).

Then you update your system (maybe after a prudent 3 week wait) and everything works, except the GPG Suite, and you can't send encrypted emails for a while, nor can you read ones you receive, or old ones stored locally.

(For macOS 10.12 sierra, released 2016-09-20, there's now a beta of the GPG Suite, released 2017-01-23, 4 months later.)

There was also a bug (or feature?) a while ago where email drafts that you had open in windows would vanish after a while.

It is a good solution for the Mac, but this is something to be mindful of (and it sort of supports the main thrust of the article).

Reply on news.ycombinator.com