Hacker News Reader

Comment by jimktrains2 | Hacker News Reader

As software developers, we can help by building easier-to-use frontends. For instance, GPG is a great program, but the front end is lacking a bit the last time I used it.

We can also build systems designed from the beginning to think about users privacy and data security.

View on HN

Front-ends for GPG (particularly: a good front-end that solely implements the 20% of GPG that regular people actually need) and for TLS certificate management are two of the most important privacy projects waiting to be done.

Is there a draft UI spec of "This is what a GPG front-end needs to look like" out there?

Start here: https://twitter.com/kennwhite/status/557618342203125762

Now invert.

Last I checked there isn't even a good UI to perform simple file encryption on most OSes. It's awful. There are huge holes in the market. I would pay for that.

Talk to @adamcaudill on Twitter -- he's working on an encrypting camera app (photos are decrypted offline) and would probably love to collaborate on, e.g. frontends for gnupg or reop.

That's because simple file encryption is really hard, and when it works well, you don't even notice that it's working. Encryption is completely invisible to common people. It's not like locking your money in a safe, where you can feel the heaviness of the door and hear the clank of the lock.

"It's not like locking your money in a safe, where you can feel the heaviness of the door and hear the clank of the lock."

I think the perfect is being the enemy of the good here.

Personally I would pay for a really good UI for doing that -- just encrypting files so I can stash them safely in cloud storage or transfer really sensitive stuff. I'd love to be able to right-click and encrypt/decrypt with a GPG public key or symmetric passphrase.

I have full disk encryption, but that's very coarse-grained. Unlock the machine and it's defeated. My hack right now is to use encrypted OS X .sparseimage files, but that's OS-specific and clunky. I also have these scripts:

https://raw.githubusercontent.com/zerotier/ZeroTierOne/maste...

They kind of suck but do the job in a platform-independent way. They could be made slightly better by trying to secure-erase the original source file, etc., but they work.

The other problem with invisible omnipresent encryption is that it lacks a quality that I call "situational awareness." I like knowing that something has in fact been encrypted. Seeing a file extension change, like gzipping a file, tells me that yes in fact something has happened.

A classic example I use of poor situational awareness in security is IPSec encryption setup between two boxes. The only way I know of to verify that the traffic is actually encrypted is to tcpdump the raw interface and look. The (piss-poor) IPSec tools do not really tell you this in a non-confusing straightforward way.

I'd argue FileVault on the Mac is a fairly solid user experience.

It's too far up the stack and too coarse-grained. If I save a file on my Mac, it is encrypted, but if I transfer it to Dropbox it is decrypted and then transferred.

Right now I solve this by using command line tools or encrypted .sparsebundle images. That sucks.

My thoughts are that we could really do with encryption being the default. If I upload a file via gmail, it should be encrypted with the recipients' public key. If I upload a file to Dropbox, it should be encrypted with my public key. Both should be overridable (e.g. public Dropbox link).

The key itself can be kept secure using hardware tokens for encryption/decryption/signing. The major problem with that seems to be access across multiple devices. Would it be possible to produce a wireless access token with a secure handshake that could be used for all devices?

I have no idea how we'd get there or how we'd convince people to go along with it.

minilock (https://minilock.io/) intends to fill that exact niche. Have you tried it?

I see Chrome, which means browser based, so that's not what I'm thinking of.

It's a Chrome app. Not exactly browser based.

File archivers like WinRAR & 7-Zip work quite well for this. You can set the compression to none and set a password for encryption.

Windows only.

Others have cited Mac options, and I know kleopatra is KDE has a context menu on every file to encrypt, which I just tried and it works fine with my pgp keys. Like three clicks. Even supports compression.

7-Zip is open source and available for most major OS

7-zip password protection is AES-256 with password strengthening I believe.

There have been various efforts to solve this problem for e-mail recently. Mailpile[1] is a great web-based mail client that you can host. It stores mail encrypted and has a very nice interface that makes handling mail encryption easier for users. Protonmail[2] is both a mail service and a nice front-end for handling encrypted e-mail. When a user sends encrypted mail through the ProtonMail interface, the e-mail is sent with a link pointing to a webpage that asks for a certain shared password. They have raised more than half million in their crowdfunding campaign.

Both are very user friendly, very promising, and still in early BETA.

1: https://www.mailpile.is/ 2: https://protonmail.ch/

This team is attempting to fix just that for email:

https://pixelated-project.org/

Clicked "Look: Try our latest demo version" and got a certificate error in Chrome :(

Not entirely sure, but I think that's because it's a self-signed certificate.

Reply on news.ycombinator.com