3 ms·

Do you actually "require" PGP, or is it just a preference? I ask because as Bruce Schneier pointed out, his email security's only as good as that of the people

Do you actually "require" PGP, or is it just a preference? I ask because as Bruce Schneier pointed out, his email security's only as good as that of the people he messages. With so many people using gmail, outlook, yahoo, etc., striving for total privacy is expensive. Thus, I politely wonder whether you've set unrealistic expectations.

criddell 11y ago
It's required by my employer. Almost all email I get is encrypted and/or signed. For services we have running that send email but don't know how to encrypt (like Redmine and Jenkins), I wrote a little smtp proxy that all it does is look at the from and to addresses, select appropriate keys, construct a new encrypted email and forward it to the real smtp server. It's written in Python and is super-simple but has worked for years now.
- dcposch 11y ago
  That's really interesting. I care a lot about email encryption -- I want to make something better and easier to use than current PGP programs. One major hurdle is apathy. Talking to potential users, even if we could wave a magic wand and make end-to-end encryption effortless, many people just don't care. A few companies (and their associated governments) have vast central databases containing most of the world's mail. At one point that would've been considered dystopian, but today many people just take it for granted. I've previously worked in financial technology, and even financial advisors dealing with sensitive client info would always just use plain email. -- If you're comfortable telling me: what country and industry are you in? Is it the norm to require PGP use on the job, or is your employer an exception?
robryk 11y ago
If the OP uses PGP only for signing and signature verification, it's not privacy he's after. If the OP uses PGP for encryption, then his conversation partners use it too, and thus can't use gmail, outlook or yahoo (I am under the impression that desktop outlook has no support for PGP).
- criddell 11y ago
  I don't know about GPG, but Outlook Desktop works with PGP Desktop for encryption and signing.

criddell 11y ago

It's required by my employer. Almost all email I get is encrypted and/or signed. For services we have running that send email but don't know how to encrypt (like Redmine and Jenkins), I wrote a little smtp proxy that all it does is look at the from and to addresses, select appropriate keys, construct a new encrypted email and forward it to the real smtp server. It's written in Python and is super-simple but has worked for years now.

dcposch 11y ago
That's really interesting. I care a lot about email encryption -- I want to make something better and easier to use than current PGP programs. One major hurdle is apathy. Talking to potential users, even if we could wave a magic wand and make end-to-end encryption effortless, many people just don't care. A few companies (and their associated governments) have vast central databases containing most of the world's mail. At one point that would've been considered dystopian, but today many people just take it for granted. I've previously worked in financial technology, and even financial advisors dealing with sensitive client info would always just use plain email. -- If you're comfortable telling me: what country and industry are you in? Is it the norm to require PGP use on the job, or is your employer an exception?

robryk 11y ago

If the OP uses PGP only for signing and signature verification, it's not privacy he's after. If the OP uses PGP for encryption, then his conversation partners use it too, and thus can't use gmail, outlook or yahoo (I am under the impression that desktop outlook has no support for PGP).

criddell 11y ago
I don't know about GPG, but Outlook Desktop works with PGP Desktop for encryption and signing.