Comment by dfc | Hacker News Reader

Comment by dfc | Hacker News Reader

Parent Full thread

So you think that one of the big problems with gpg is that it "is not usable by mortals" and that"having an implementation similar to OpenSSL...would be a big step forward"?

I have never heard anyone say it was easy for mortals to use openssl in a safe and secure manner. Between openssl and gpg, gpg is hands down the better way for mortals or professional geeks to exchange information securely. For starters take a look at what is required to generate a key in gpg:

  $ gpg --gen-key

A user can accept the defaults and have a decent crypto setup relatively easily. How do you think that compares to setting up openssl?

"having an implementation similar to OpenSSL...would be a big step forward"

That made my day.

"gpg is hands down the better way for mortals..."

Snort! How many clients/friends/coworkers have you had to explain PGP, GPG, public keys or just compressing a file with a password to?

For us semi-interested cypto/security aware geeks, it's not difficult. Easier than learning the details about git or picking up Erlang. But for the normal user/client/manager it's like speaking Latin or the understanding Alchemy economics in Skyrim. PKI/GPG is one of those things that falls outside of their give-a-shit enough to understand circle.

I use applications every day that leverage OpenSSL libraries, and would have no idea unless I felt obliged to find out. That's the whole point. GPG is an in your face security product.

I've used GPG for years and love it. But even I have to jump through hoops that are not trivial to deal with -- I use GPG smartcards for a few applications, and while its great when it works, it often doesn't. I can't use it on OSX 10.8 right now, for example.

Reply on news.ycombinator.com