Hacker News Reader

Comment by Jach | Hacker News Reader

When will "does not give the option to encrypt all outgoing correspondence with my PGP public key" become as embarrassing for an important website as "doesn't have an SSL cert" or "emails/stores passwords in plaintext"?

Edit: added word "outgoing" for pedant below. ;) Of course it'd be nice to get their public key too if you had to correspond back without going through say their https website.

View on HN

It'll happen only when PGP isn't just used by .001% [1] of email users.

It needs some really good integration with an email client somewhere, where addresses are picked up from a public key server and automatically encrypted. I'm picturing an iMessage style thing where as you're typing someones email address, the keyserver is getting pinged and the address turns a different color and a lock icon appears by it. Now all your correspondence with that person is encrypted. PGP purists might not like it ("but you're automatically trusting some random key!! The web of trust, the web of trust!") but it would be a step in the right direction.

[1] Statistic I just made up.

I think a better solution is identity based encryption, so that the sender can encrypt the message before the receiver has their private key. Senders should have multiple IBE services to choose from, and we should have standards that allow or even require threshold IBE (so that no single party can decrypt all messages). IBE services may fail to take verification seriously, but the sender of a message could simply refuse to use services with a reputation for being lazy or malicious. It might also make sense to create a hybrid system, combining IBE with PGP.

https://en.wikipedia.org/wiki/Identity_based_encryption

[Edit: it pains me to say this, of course; I am not a fan of systems where some other party or coalition of parties can decrypt messages. However, it would be better than what we have now, and it is closer to the "putting a letter in an envelope" abstraction.]

If you want to encrypt something with my public key. You would run the following command (email address obfuscated):

gpg --auto-key-locate pka -ear mike(dot)cardwell(at)grepular(dot)com

gpg then automatically looks up the TXT record for "mike.cardwell._pka.grepular.com" in the DNS. Which gives it:

"v=pka1\;fpr=35BCAF1D3AA21F843DC3B0CF70A5F5120018461F\;uri=http://grepular.com/0018461F.pub.asc

It then automatically fetches my public key from the URL in that record, checks it matches the fingperint, and then imports it.

For extra goodness, the DNS for "grepular.com" is secured with DNSSEC also.

The technology exists for sharing public keys and using PGP. The major mail providers couldn't care less about providing user interfaces for it though.

Yeah but you still had to generate and publish that key before I could send you an encrypted message. If I need to communicate with someone who has not done so, what I am supposed to do? Nag at them to do it? Try to explain the important of encryption? I have tried it, and I still try, and it is basically not going to work: people generally do not see the point, and they hate the fact that they cannot check their mail from arbitrary systems (smartcards help here, but now you need to get reliable smartcard readers deployed all over the place).

We need a system that lets people encrypt messages without having to wait for the receiver to do anything. That's the point of IBE: your public key is your email address, you get your private key from the service of the sender's choice. The service clearly needs to do something to verify your identity, which is the weakness -- but it is still better than what we do now, and it does not require us to wait for everyone to upgrade their email clients.

Yeah, what you say is true. That would be better than what we have now. Re your comments about smart card readers. You can have smartcard functionality on any machine with a USB port if you use one of these:

https://www.crypto-stick.com/

I received one a couple of weeks ago and it works great. I also have an OpenPGP v2 smart card, a USB smart card reader, and a reader built into my Thinkpad.

If you want to send someone a message, you have to use their public key. If a message is encrypted with your public key, it can only be decrypted by your own private key.

Edit: ok your edit makes more sense now :)

Yes, he meant if he gives his email out to a website (amazon.com, say) he wants to give them his PGP public key as well so that all correspondence to him will be encrypted through PGP.

I would like this, too. Internet, please get on that.

It's not that long since PGP was considered weapons-grade munitions and could not be exported.

We may yet return to that stage.

It wouldn't surprise me if various enforcement agencies viewed encryption as sufficiently suspicious behaviour to arrest/investigate you for some kind of "terrorism" charge anyway.

Reply on news.ycombinator.com