Hacker News Reader

Comment by Ixiaus | Hacker News Reader

It's called GPG and it surprises me how many people, even computer professionals, don't use GPG to encrypt their email.

Also encrypt your hard drive, preferably with hardware encryption that requires a physical key.

Not fool proof, but it is likely to deter the vast majority of invasive attempts.

The problem with GPG is the chicken-and-egg situation, along with user apathy. I literally don't know anyone I regularly email who uses it, so I can't use it either. Then there's the fact that virtually no email client supports it by default. If email providers like google actively supported and promoted it and provided public key management in the contact list along with a browser plugin for the private key management and actual encryption/decryption, we might even stand a chance of it happening, but google of all people will never directly support it as it'll prevent their full text search from working. (I'm aware of FireGPG - changes to GMail typically break it, so you can't rely on it)

I digitally signed all my outgoing email for a while, which did get some people asking why they couldn't read the attachment, (the signature is an ascii file but fairly useless to a human reader) but explaining email encryption and signing didn't cause any uptake ("nobody is interested in my email", "I have nothing to hide") so I gave up. I do still digitally sign important correspondance such as invoices and payment reminders.

I agree, it is difficult, but my close friends and important correspondents do use email encryption (as per my request) for sensitive topics.

I won't put anything sensitive in an email unless it is encrypted; that is generally the way a I break my friend's apathy to using it. It doesn't necessarily work, however, for corporations &c...

Anytime I have a feeling I will be discussing sensitive materials with someone, I start signing my messages so they know I am good to go. If they don't know what it is, I take the opportunity to introduce security.

I understand the technology- but my qualms is with the process and the time-lines mentioned with regards to the interception. Why cannot the sanction process be 24 x 7? Also, why should a sanction of such a critical action like reading someone's email go unreviewed for two months?

We are in 2009 and not in 1984, right?

I feel this has misuse written all over it. And unfortunately, I feel GPG is not really the answer here for 99% of the email users (unless gmail and yahoo decide to turn it on by default).

Reply on news.ycombinator.com