3 ms·

> go out of your way to use Signal With that mindset we will never get secure communications to the masses but will repeat the PGP dilemma again and again. UX

by aw3c2 11y ago

> go out of your way to use Signal With that mindset we will never get secure communications to the masses but will repeat the PGP dilemma again and again. UX is of utmost importance. We would still be on 99.99% HTTP websites if HTTPS required going out of one's way.

tptacek 11y ago
That's what the Cryptocat people said.
- aw3c2 11y ago
  Is it? It is also what Edward Snowden said.
  - tptacek 11y ago
    In fact, he may have even said it on Cryptocat; Poitras and Greenwald used it to collaborate with him. Snowden also used Lavabit to send email. Why? Because Lavabit had superior UX to his other options --- because Lavabit handled all the crypto serverside. NSA has presumably read everything he sent on both of those systems. Despite the extreme ease of use both systems boasted, they were both so badly designed that they enabled retroactive decryption. So I think, if that was an attempt at a rebuttal, it was not a very effective one.
    - mynewtb 11y ago
      So they used bad products because their UX was good. That seems to be grandparent's point?
      - tptacek 11y ago
        Secure messaging products with good UX and bad security should wait to launch until they can have good security; the alternative puts people at risk, as it did to Snowden.
        mynewtb 11y ago
        They should but they don't. That's why have competitive UX is important for the good tools or people won't even consider using them. We have seen that happen countless times.
mapgrep 11y ago
Signal is an order of magnitude easier to use than PGP. It's not even close. The GP was comparing two apps that are actually both very easy to use, one maybe slightly moreso. (That said, PGP isn't THAT hard either.)
- treve 11y ago
  I've been actively using PGP for about 2 years with a few friends that all use keybase, but I still don't feel like I really know what I'm doing, or if I'm really doing the right thing. A lot of the terminology and best practices I learned while first setting it up are lost on me now. It still works though! Well, somewhat... since I switched to KDE thunderbird no longer remembers my pgp password. I miss the gnome keyring.
  - tptacek 11y ago
    70% of the UX complaints people have about PGP stem from the huge number of options it has and the lack of guidance it gives you for which options matter. Which is a shame, because none of the options actually matter. If you're encrypting messages to a public key, and not with a passphrase, and you're signing the messages you encrypt, you're getting 98% of the value PGP has to offer. If you want to do things more advanced than that, you probably shouldn't use PGP. PGP has lots of advanced options, but it lacks a lot of fundamental features you'd want from a secure messaging system. But for the basic use case it supports without options, PGP is just fine.

by aw3c2 11y ago

tptacek 11y ago

That's what the Cryptocat people said.

aw3c2 11y ago
Is it? It is also what Edward Snowden said.
- tptacek 11y ago
  In fact, he may have even said it on Cryptocat; Poitras and Greenwald used it to collaborate with him. Snowden also used Lavabit to send email. Why? Because Lavabit had superior UX to his other options --- because Lavabit handled all the crypto serverside. NSA has presumably read everything he sent on both of those systems. Despite the extreme ease of use both systems boasted, they were both so badly designed that they enabled retroactive decryption. So I think, if that was an attempt at a rebuttal, it was not a very effective one.
  - mynewtb 11y ago
    So they used bad products because their UX was good. That seems to be grandparent's point?
    - tptacek 11y ago
      Secure messaging products with good UX and bad security should wait to launch until they can have good security; the alternative puts people at risk, as it did to Snowden.
      - mynewtb 11y ago
        They should but they don't. That's why have competitive UX is important for the good tools or people won't even consider using them. We have seen that happen countless times.

mapgrep 11y ago

Signal is an order of magnitude easier to use than PGP. It's not even close. The GP was comparing two apps that are actually both very easy to use, one maybe slightly moreso. (That said, PGP isn't THAT hard either.)

treve 11y ago
I've been actively using PGP for about 2 years with a few friends that all use keybase, but I still don't feel like I really know what I'm doing, or if I'm really doing the right thing. A lot of the terminology and best practices I learned while first setting it up are lost on me now. It still works though! Well, somewhat... since I switched to KDE thunderbird no longer remembers my pgp password. I miss the gnome keyring.
- tptacek 11y ago
  70% of the UX complaints people have about PGP stem from the huge number of options it has and the lack of guidance it gives you for which options matter. Which is a shame, because none of the options actually matter. If you're encrypting messages to a public key, and not with a passphrase, and you're signing the messages you encrypt, you're getting 98% of the value PGP has to offer. If you want to do things more advanced than that, you probably shouldn't use PGP. PGP has lots of advanced options, but it lacks a lot of fundamental features you'd want from a secure messaging system. But for the basic use case it supports without options, PGP is just fine.