My public key is here: http://sho.ch/alexgraul.publickey and on the gpg keyserver, where's yours?
Seriously, the are few situations where someone's actually going to want to post their private key to the internet - at least if they understand what it is - so what are we imaging that they're doing with it that they need to know about it in the first place?
You're probably going to want them to have a backup, but you can have them make a backup without having them understand the difference - you just have your program back up a folder structure that the private key is hidden somewhere in and only make the public one obvious. Make them aware that if they don't backup they won't be able to access their emails - should the worst happen - but don't tell them why. Someone with a push-button understanding of computer... they just don't really need to know why.
... -sigh-
I almost wonder whether it wouldn't be easier to market public-private key crypto as a packaged solution. Buy an encrypted email address kind of thing. Send people a physical token they mentally associate with that email address and tell them not to lose it.
but maybe this is a different thing conceptually i think i would call that a stamp or a seal ..sort of like a wax imprint of a key
GPG has a sucky API and crazy CLI. It's a stack of eggs that everyone is scared to improve.
People don't even try to understand the bare basics of PKI or even security because they are fundamental lazy and not required too. No one expects them to understand the math, just the few processes required for basic usage. If you can understand the arcane rules of baseball, or how to drive a stick, or solder, or field strip a pistol or basic cooking, you can learn how to "use" encryption.
Consider https. That is very easy to use, because the user doesn't have to do anything to use it. The user doesn't need to know anything about encryption.
Doesn't this mean that many users will just click through any errors, thus making https less secure than it could be?
Consider the evolution of warnings. Padlocks were shown in different states and colours, then pop-up dialogue boxes appeared, and now Chrome has an entire red screen with a suitably stern warning.
You're right that https is the easiest form of PKI for users to understand. And they still get it wrong. And that's for encryption that could make a difference to their lives - people could steal their money or their products or whatnot.
The only problem was that the system was compromised in order to comply with US requests.
http://en.wikipedia.org/wiki/Hushmail#Compromises_to_email_p...
Good concept, but anything you rely on someone else doing can always be compromised.
Allow me to be the first. (Check your email.)
In all seriousness, I agree that it's a social problem. I think we (in the tech industry) can do a better job of making the tools easier to use. If we really want to make something like PGP take off, we'll have to provide easy tools that integrate with people's email clients and provide dead simple tutorials of how to get started.
I am talking about something like a Chrome/Firefox extension, which creates a GPG key pair for you, uploads the public to some central server and encrypts stuff like the text in your hotmail, gmail, yahoo mail, etc, after you press "send" and before the text is sent to google.
Then, at the other side, the a user with the same extension opens the new message and as soon as it appears, the extension detects that it is an encrypted message, reads the id of the sender and decrypts the message.
There are lots of details which makes this difficult to implement... but that would be the only way to make the vast majority of people use public key encryption.
Someday I'll even meet someone real in person and be able to get it signed!
Btw. It's time to upgrade the DSA signing key to longer RSA key. Soon GnuPG should have ECC support allowing much shorter keys.
I don't have one. I, a software developer, have no idea how to get one. And if that's the case, what hope does anyone else have?