Hacker News Reader

Comment by grandinj | Hacker News Reader

Except that the tool itself is so painful to use, and has such a shallow integration with things like email clients, that using it requires a considerable degree of self-discipline.

I think I installed it once, and then when my machine required rebuilding, I just couldn't bring myself to install it again.

I wish it weren't so, but a new website is not something that is going to speed the adoption of GnuPG.

View on HN

I started using GPG seriously once the "easypg" integration landed in Emacs 23. When you open a .gpg file it prompts for your passphrase and decrypts transparently, and when saving a new .gpg file it prompts you with a list from which you can select recipients to encrypt to.

The integration with Emacs mail clients is fantastic too; just M-x mml-secure-sign or M-x mml-secure-encrypt when composing, and incoming messages with signatures are typically checked for you.

This totally changed the way I used GPG. (from "not at all" to "every day")

I'm working through the irony of your finding GPG easier to use once it landed in emacs. I mean... Emacs for God's sake.

In all honesty, however, part of the "difficulty" of GPG is really by design. You need to be deliberate about signing and encrypting because security should be a careful and deliberate act. If you're hoping for the program to take care of it transparently, you're probably not being safe enough. At least Emacs requires you to go through an explicit process. As you have to do with everything in Emacs.

> You need to be deliberate about signing and encrypting because security should be a careful and deliberate act.

Why? You don't have to be 'deliberate' about encrypting when you're using SSH or HTTPS.

True, but we're putting a lot of trust in third parties in that situation, no? HTTPS requires us to say "sure Verisign [or insert authority here], I believe you." If I'm doing that, why not just trust Google? Why use email encryption at all?

SSH is more in our control, but it's still trusting a third party (a server) and it still requires a deliberate act to set up and use (unlike HTTPS).

If you use Mail.app on OS X, GPGmail comes as close as anything to providing transparently usable email encryption. Admittedly, "as close as anything" does not mean "within a mile of it", but if you're deliberate about keeping your mail secure, GPGmail is usable.

If you haven't used Enigmail with Thunderbird, then you wouldn't know how easy it is to use GPG.

Although Enigmail still has some rough edges to be honest!

Agreed. Its simply not easy enough to use so I could recommend it to my friends with lesser it knowledge. However I have hopes for projects like MailPile (https://www.mailpile.is/)

This page explains what the money is going towards:

  http://goteo.org/project/gnupg-new-website-and-infrastructure/needs

They are looking for funding to:

- Release GnuPG 2.1 - Create a new web site

According to the descriptions, the new web site is not only about a new theme, but also about creating and collecting content that explains how to use GnuPG and encryption, in general.

Integration and ease of use is what the GP is looking for, not another website.

I find it trivial to use for email, because I use OS X, Apple Mail, and GPGTools' GPGMail plugin [0].

[0]: https://gpgtools.org/

So do you actually use it? What is the rate of adoption among your friends and colleagues? How pleasant do you find introducing and explaining the whole process to a nontechnical person?

I do and it's an awful experience. The rate of adoption is 0% for the most part, there's no easy way to make it usable for non-technical people.

Same experience here. It's just barely good enough to claim the space of 'technically correct OS crypto implementation', thereby discouraging alternative efforts.

Reply on news.ycombinator.com