Hacker News Reader

"Nowadays is GPG/PGP-ing your emails really that hard?"

Try convincing people to not use webmail and accept the fact that they cannot just check mail on whatever random computer they come across. I speak from experience: this is the biggest hurdle.

And after that is the increasing use of smart-phone clients which don't have support.

Have them use Hush, or any number of the in-browser GPG/PGP extensions that will encrypt your gmail then! At least their webmail is encrypted then (and Hush integrates with most of the notable PKI servers). You have to start them somewhere, just lamenting about it isn't going to change anything. I've moved my family and friends into GPG over the lsat few years and now I receive GPG-encrypted mail more often than not.

Browser plugins are good, but they do not solve the problem most people have complained about to me: that they cannot check their mail on their friend's computers, at the library, etc. Hushmail is snake oil, I would not recommend it to anyone and I doubt that it is even relevant to the problem at hand (how to communicate privately in a world of NSLs).

Use a USB key with everything installed on it in a portable fashion. The Tor Browser Bundle is something like this.

Two issues with this method are that TOR is 80% funded by the us government, using a computer opens you to backdoors.

But at least that's a good start.

You can also use Countermail which provides end-to-end PGP security (unlike Hushmail). Here's my article with more info: http://www.greycoder.com/how-to-stop-the-nsa-from-spying-on-...

Speaking to that, there is a tool called Penango at https://www.penango.com that is a browser plugin that supports GMail at least.

I haven't tried it but if anyone here has, now would be an awesome time to tell us how it went.

GPG support is actually one of the very big things that has kept me using KMail even with Akonadi's rather poor support for POP3 w/ filtering. Being able to expand that web of trust even to businesses and among the tech-savvy would be wonderful, if only to increase awareness of the idea that things which need to be secret from unintended viewers (including, but not limited to, the NSA) need to be encrypted.

Why not move over to thunderbird? It supports GPG through enigmail

I don't need extensions with Kontact, it's built-in. Also I still use Akregator and the organizer/calendaring.

What I'll probably do is to switch my damn email over to IMAP at some point, apparently that's what the kdepim devs are all using... but I don't want to have to fix all my filters, and then I would have to use fetchmail and run dovecot or similar to have my email on my own computer.

Thankfully Dovecot + Sieve makes the transition pretty easy.

> they count a username AND a password as "two factor authentication"

I was so flabbergasted by that I had to look it up and it seems like you're wrong. This page[0] describes a feature called Advanced Access that sends a code to your phone whenever you do certain actions on the website.

[0] https://www.wellsfargo.com/privacy_security/online/advanceda...

That's only for things like online money transfers, and not account related. They maybe have pulled the particular document I'm referring to, but at one point they had the same / similar text to what Schneier quotes.

https://www.schneier.com/blog/archives/2007/04/bank_botches_...

Set-up can be daunting, but I always found that entering one's password every time a new mail comes in is unbearable. They should highlight that the pgp password timeout can be changed to something less intrusive.

The default timeout, at least for gpg, is 3600sec (1 hour) which should be more than enough for the majority of people's emailing habits (Sitting down and checking / emailing once or twice a day). Recently setup has become super easy[1], especially on the OSX or *nix side of things. OSX probably has the easiest flow, all you have to do is install one thing[2] and you're off. It will walk you through everything[3] and it supports the built in Mail.app.

_________

1: http://www.gnupg.org/related_software/frontends.html

2: https://gpgtools.org/

3: http://support.gpgtools.org/kb/how-to/first-steps-where-do-i...

>When you run GPG Keychain Access for the first time, the window will be empty or contain only the GPGTools Project Key (delivered via the GPGTools Installer).

>If you don't have a private key, you'll be prompted to create a new key pair.

I think most people respond to their mails pretty much as they come in. I'd add that in corporate settings a norm of near immediate response has developed. I've set my timeout at 9999sec -- mutt throws in an error if I add a digit.

I don't use OSX, but can you comment on how easy key exchange is nowadays?

I have to admit that I have it set up and ready to roll, but pretty much no one I know is willing to take the plunge.

>I think most people respond to their mails pretty much as they come in

Maybe when at work, but at home most people (Especially of the older generation) seem to check their email a few times a day.

Corporate users should never be using webmail on their work computer...If they're MS Exchange based, they should be using Outlook and their exchange policy should allow (and prefer) S/MIME. There are a variety of plugins for Outlook that support GPG and S/MIME is already signed and encrypted.

Pubkey's should always be make available through the existing online PKI services. I personally send all my keys through pgp.mit.edu to be mirrored world-wide. Key-exchange (For High to Ultimate trust scenarios) is simple and easy. Send someone your pubkey by signing it with their pubkey and email it in a signed email (with signed attachments) to them. Have them do the reverse.