Hacker News Reader

Comment by LinuxBender | Hacker News Reader

Adding to the happy medium is to teach your friends and family to use Thunderbird so they can easily GPG encrypt [1] their emails keeping the nosey email providers off the email body. Also teach them to use the IMAPS (TLS) endpoint for their mail provider, usually port 993. There are probably simpler how-to's with pictures, I just do not have any of them handy.

[1] - https://support.mozilla.org/en-US/kb/openpgp-thunderbird-how...

View on HN

I'm sorry to say, that's nowhere near a medium stance or ask.

It could be we have different circles of acquaintances. I have managed to get non technical friends to GPG encrypt their emails. I also talked 2 lawyers into using this and the two lawyers are not only non technical but have nearly zero patience.

I guess a lawyer might know a thing or two about confidential messages.

I think you’d be very surprised at how much lawyers don’t know or care about any of that. They store stuff in the cloud without ever having heard of the Third Party Doctrine (which allows the US government warrantless access to those documents).

> store stuff in the cloud without ever having heard of the Third Party Doctrine (which allows the US government warrantless access to those documents)

Or because they know the third-party doctrine doesn’t apply to attorney work product and privileged materials.

After doing work for lawyers for years, they really are the worst when it comes to understanding computers.

It does no such thing, that’s absurd. See carpenter v. United States (among many, many others).

They do. Most of them use proprietary https web interfaces that usually have "secure email" or "secure messaging" in the description but they are just fancy web portals. I despise those systems. The content is not encrypted at rest and can be leaked. With OpenGPG the emails are only decrypted on the recipients end points and can be deleted by request.

Not all of them. I keep seeing lawyers sending photos of sensitive documents using their cellphone and Whatsapp (before encryption), and most of them don't even care about all those documents still residing on their cellphone, at the mercy of whoever steals it since all the security they have in place is that swipe thing that anyone with good eyes spots in 2 seconds straight.

ok, this is the text book definition of "out of touch"

Yep. On any other site I’d assume that comment was satire. Nothing’s changed in the last decade:

https://moxie.org/2015/02/24/gpg-and-me.html

https://blog.cryptographyengineering.com/2014/08/13/whats-ma...

My canned response to the second article/rant:

* https://articles.59.ca/doku.php?id=pgpfan:wtmwp

even zimmeman says it's too complicated for the unwashed masses and was meant for the techy crowd of the time he came up with it.

Most of my friends and family don’t own computers, only phones and sometimes tablets.

there is definitely software to help with pgp on ANY tablet, phone, or PC your friends and family have access to. The universal problem is no one cares to encrypt except a few computer nerds, spooks, and journalists.

It means you now have to worry about key management or else lose access to all your old mail, it possibly complicates logging in on new devices or via webmail, partially breaks server-side (spam) filtering, breaks server-side full-text search… so there are some definitive trade-offs there to be made.

K-9 Mail is an app available for Android which supports PGP (if clunkily).

<https://k9mail.app/>

I'm not going to remotely pretend that this would make PGP attractive or viable for the greater public. I do want to address your valid point that the general-purpose computer seems to be a dying breed, but that there are still options for mobile devices.

I've used K-9 Mail, though rarely do these days (it went poorly-maintained for a while).

There seem to be some options for iOS as well, such as iPG Mail, though I've no experience at all with it.

<https://www.openpgp.org/software/ipgmail/>

Most of my friends and family don't have Android devices.

Perhaps you might care to share with us what types of devices they do have, seeing as my mental telepathy transgizmatron happens to be in the shop presently.

Note that I also listed an iOS option, and mentioned that there are others.

Again: PGP-enabled email apps are available on many platforms, though, again, this addresses only a small part of the larger challenge at encouraging adoption.

Not a single member of my friends or family is going to use GPG encryption, not even my mother who loves me dearly. I had a computer geek "penpal" for a while and we did monthly emails to each once a month to catch up via gpg, and even that died off lol

Apple supports encryption on Mail:

https://support.apple.com/en-gb/guide/mail/mlhlp1180/mac

protonmail also has nice tools for it if you use them. I suspect tutanota probably does as well.

Apple mail support GPG easily. No need to use Thunderbird.

Can you please provide a few references to that claim?

They might be talking about S/MIME.

I use https://github.com/Free-GPGMail/Free-GPGMail which is a plugin for GNUPG, without the "support" plan.

https://gpgtools.org

GPG Mail is a paid for add-on, but it works and it works well.

It's not a paid add-on... GnuPG is open source. They are selling a support plan in case you need help with open source.

Here is the same thing, without the paid support. https://github.com/Free-GPGMail/Free-GPGMail

- GPG Suite was released under an Open Source license in the past. Is that stil the case?

You GPG Suite including GPG Mail is still going to be released under an Open Source license.

- Am I still allowed to compile my own version of GPG Mail / GPG Suite removing any code regarding the trial or activation?

You absolutely are, the GPL makes sure of that. You will find the source code on this website next to the download link for GPG Suite.

We would kindly like to ask you not to use our names or icons if you plan to publish a binary for others to use. Also please do not release any complete installers as that may suggest that they are official releases.

https://gpgtools.org/faq

To be pedantic, the version I linked to is a paid addin. However, you are correct - there is/are unofficial unpaid and unsupported versions available that I was unaware of, per the FAQ and the repository that you linked, which has nothing to do with GPGTools GmbH; from the repo, “This does not constitute any endorsement or promotion of our releases by the respective copyright or trademark holders.” Thanks for sharing this.

Reply on news.ycombinator.com