Comment by Spooky23 | Hacker News Reader

Comment by Spooky23 | Hacker News Reader

I think this guy is right. Although a bigger problem is that PGP is available in two flavors: free and very expensive.

The problem with GnuPG IMO is that real obvious use cases (healthcare) are out of bounds because it isn't FIPS certified and isn't usable by mortals. Having an implementation similar to OpenSSL with an API, and use case that attracted organization willing to sponsor FIPS validation would be a big step forward. Your doctor could securely send you test results. Your credit card company could send your bill directly.

Consider: The #1 solution for email encryption in hospitals/healthcare is Zix. This is sad -- their solution amounts to attempting to transmit an email via SSL, and falling back to sending you a link to a webpage. Cheesy.

Unfortunately, that's not the way things are, and usage of PGP are generally limited to security professionals, paranoids, and crypto geeks.

So you think that one of the big problems with gpg is that it "is not usable by mortals" and that"having an implementation similar to OpenSSL...would be a big step forward"?

I have never heard anyone say it was easy for mortals to use openssl in a safe and secure manner. Between openssl and gpg, gpg is hands down the better way for mortals or professional geeks to exchange information securely. For starters take a look at what is required to generate a key in gpg:

  $ gpg --gen-key

A user can accept the defaults and have a decent crypto setup relatively easily. How do you think that compares to setting up openssl?

"having an implementation similar to OpenSSL...would be a big step forward"

That made my day.

"gpg is hands down the better way for mortals..."

Snort! How many clients/friends/coworkers have you had to explain PGP, GPG, public keys or just compressing a file with a password to?

For us semi-interested cypto/security aware geeks, it's not difficult. Easier than learning the details about git or picking up Erlang. But for the normal user/client/manager it's like speaking Latin or the understanding Alchemy economics in Skyrim. PKI/GPG is one of those things that falls outside of their give-a-shit enough to understand circle.

I use applications every day that leverage OpenSSL libraries, and would have no idea unless I felt obliged to find out. That's the whole point. GPG is an in your face security product.

I've used GPG for years and love it. But even I have to jump through hoops that are not trivial to deal with -- I use GPG smartcards for a few applications, and while its great when it works, it often doesn't. I can't use it on OSX 10.8 right now, for example.

Reply on news.ycombinator.com