6 ms·

The ultimate engineer's perspective. It works so well that almost nobody uses it! Signal isn't even that popular compared to other platforms like iMessage, bu

The ultimate engineer's perspective. It works so well that almost nobody uses it! Signal isn't even that popular compared to other platforms like iMessage, but I bet more people use it than regularly PGP. I was regularly signing messages with PGP on Fidonet all the way back in '93 (and trying to find people to swap encrypted messages with). It's a bit mind blowing that the useability of the successor program today, GPG, isn't much better than what people thought was kinda wonkish and hard back in the Compuserve days.

hollander 10y ago
I sign almost all outgoing mail, hoping someone will notice. In three years I've got one question about it. Some people complain they can't open the attachment, as I use PGP/MIME to keep the message readable. If big companies like Apple and Google were behind this, it could change, but I'm afraid this won't happen unless there is a sudden need for it.
- wanderingbort 10y ago
  > If big companies like Apple and Google were behind this, it could change, but I'm afraid this won't happen unless there is a sudden need for it. Digital privacy for average consumers needs more than a brand behind it, it needs an obvious value. I don't think many average people actually suspect that email _can_ be tampered with so, what does "signing" it mean to them. Moreover, when/if it enters the mainstream it will be plagued with "hacks" which degrade the user-perceived value, causing many to abandon it if it isn't free. by "hacks" I mean the users will expose keys and then blame AES :)
- nihonde 10y ago
  If ever there were a user group that should have forced pgp adoption, it is lawyers. When I worked at a big law firm, I lobbied for it and ran into a bunch of IT managers who had never heard of anything unless Microsoft sold it to them.
- nhxu 10y ago
  > If big companies like Apple and Google were behind this, it could change, but I'm afraid this won't happen unless there is a sudden need for it. End-to-end [1] is using OpenPGP. [1]: https://github.com/google/end-to-end/ https://github.com/google/end-to-end/
tlikonen 10y ago
PGP (now GnuPG) is used more these days than in BBS (Fidonet) years, particularly in the open source community. Software releases and packages in GNU/Linux distributions are signed by the developers. All the time. It happens automatically without end-user noticing. Is this not one definition of "working well?" Lot's of people are passively using it without knowing. But for messaging it's indeed very marginal. In open source projects' techical mailing lists and version control systems there is pretty much message or commit signing but that's a marginal group who does that.
- astrodust 10y ago
  I'd believe PGP is in wider use today than Fidonet is, but not much wider. I have to laugh that Snapchat has apparently solved the identity exchange problem and PGP is still stuck with these ridiculously baroque implementations.
  - ryukafalz 10y ago
    >I have to laugh that Snapchat has apparently solved the identity exchange problem and PGP is still stuck with these ridiculously baroque implementations. Er, how? Admittedly I've only used it a few times, but the only thing that sticks out along those lines is the Snapcode system. How is that any different than scanning a QR code in OpenKeychain?
    - astrodust 10y ago
      The part where it works and millions of people use it.
matheusmoreira 10y ago
>Signal isn't even that popular WhatsApp integrated¹ Signal's secure messaging protocol. Since then, at least one government was unable to compel² the company to produce unencrypted messages from users under investigation. Given the popularity of WhatsApp, I think its safe to say a lot of people are now using a relatively secure messaging protocol. ¹ https://whispersystems.org/blog/whatsapp-complete/ https://whispersystems.org/blog/whatsapp-complete/ ² https://www.forbes.com/sites/parmyolson/2016/05/03/whatsapp-founder-brazil-shut-down-facebook/ https://www.forbes.com/sites/parmyolson/2016/05/03/whatsapp-...
- cyberpunk 10y ago
  I don't want to harp on about this again, but I really don't think you can put any sort of trust into such things as this. With GPG, you're producing an encrypted version of some text/data with a bit of code you can build yourself and run completely on your equipment, airgapped or whatever. With signal/whatsapp, there is no way of even knowing if the code you're using "in app" is the code in github or in whatever rev wherever. Yes, I know reproducable builds -- but what stops the app fetching more code from elsewhere? Wanna bet there's a webview and some JS in that app somewhere? It's nice to make things harder for the NSA to read, but this architecture seems to be just creating the illusion of safety and it's kind of weird to see how much advocacy it gets here when there are such obvious faults in it. I'm not saying there's a better alternative, and congrats to all who are working on it and I'm happy to see it succeed -- but this isn't a solved problem and there's massive danger in trusting such things. I'd love to have the time to really inspect whatsapp/signal to see what I'm sending/getting -- has anyone done this? Google isn't giving me much..
  - nickik 10y ago
    There is a extremly large difference between passiv listening and recording everything and cleverly hacking the Signal app, or even forcing OWS to do it for them. The cost differences alone are massive, not to mention that its harder to do while remaining hidden. Yes its not perfect, but calling it a illusion of safety is just overly negative. If the NSA really wants you, they will get you, but that does not mean all your safty is illusion.
rvern 10y ago
It isn't because GnuPG doesn't work well or because it is too hard to use that people don't use it. They don't use it because other people don't use it. Why do people use Facebook instead of Diaspora? It's not because Facebook is better, works well, or is easier to use... It's because other people use Facebook. Why do people use Skype instead of XMPP? It's not because Skype is better, works well, or is easier to use... It's because other people use Skype. Why do people use WhatsApp instead of GnuPG or OTR? It's not because WhatsApp is better, works well, or is easier to use... It's because other people use WhatsApp. It's always the same standard chicken and egg adoption problem. As shown in the article, GnuPG is used for package signing, commit signing, file encryption, and all sorts of things that don't involve many people. But when it's about communication, you can only use GnuPG if the people you want to communicate with use GnuPG too... and thus the adoption problem applies. And the reason people initially used Facebook, Skype, and WhatsApp is not that they were easier to use or better. It's advertising. Notice how all of these are proprietary software made by companies with the means to advertise their software? You can bet people would use GnuPG, Diaspora, and XMPP if they had been advertised by companies like Facebook and Microsoft. So if we want people to use open source software and open protocols instead of living in walled gardens, we need to advertise them. Advertising works.
- dispose13432 10y ago
  >And the reason people initially used Facebook, Skype, and WhatsApp is not that they were easier to use or better. It's advertising. Notice how all of these are proprietary software made by companies with the means to advertise their software? You can bet people would use GnuPG, Diaspora, and XMPP if they had been advertised by companies like Facebook and Microsoft. I know quite a few non-techies who use VLC, Firefox, LibreOffice, and other OS advertising-less projects. The difference is: 1. Facebook, Skype and WhatsApp solved problems others didn't and became big. Now it's too late to fight. Had Diaspora been around before FB, and as easy to work with (put name here, picture here, password here, friend here. You're all set up. Let's go), or XMPP been around before Skype (which is a very old program in internet time), or Kontalk,Signal, etc. been around before WhatsApp (find friends by number, not by username), they probably would have taken off (at least to some degree). Google came late onto the Desktop scene (Chromebooks) and are not successful while the incumbent (MS) is good. MS came late onto the mobile scene and failed, while the incumbent (Google) is good.
cedricbonhomme 10y ago
I see more and more comparisons between Signal and OpenPGP. Signal is an application (in fact more than a simple application) that solves a more global problem (of communication solutions that uses asymmetric cryptography) which never was intended to be solved with OpenPGP. OpenPGP is a standard. GnuPG, the tool that people are comparing with Signal (I think).
- confounded 10y ago
  This applies to much of the XMPP discussion above, too. Also worth noting that GnuPG isn't even what you send the emails with. And that PGP on mobile is almost unheard of. I doubt I could explain how to send an PGP encrypted email (for example, to a doctor/lawyer/accountant) inside of 2 minutes. Strong intrinsic motivation is the only reason people use PGP. It took me ~3 months to get a critical mass of 15 or so people on to Signal as first port of call.
openplatypus 10y ago
It is surprisingly easy to use PGP/GnuPG. Check this tutorial https://emailselfdefense.fsf.org/en/ https://emailselfdefense.fsf.org/en/. It is _just_ slightly more complex than using Twitter once configured.
- confounded 10y ago
  It's the configuration that kills it, and a large part of that is loading context into the user's mind (the highest drop-out form).
- kbart 10y ago
  No, even this step-by-step tutorial is not easy for "normal" user. It's plagued with obscure terms and concepts (keypair, keyserver, public key, web of trust, revocation certificate etc.). Sure, for us, developers/engineers/geeks, it looks trivial, but try to send this link to your grandma and see how it goes.
gnipgnip 10y ago
Interesting that Moxie wishes PGP were dead (inline with his views in the LibreSignal/Websocked/Gapps PR). https://moxie.org/blog/gpg-and-me/ https://moxie.org/blog/gpg-and-me/

hollander 10y ago

I sign almost all outgoing mail, hoping someone will notice. In three years I've got one question about it. Some people complain they can't open the attachment, as I use PGP/MIME to keep the message readable. If big companies like Apple and Google were behind this, it could change, but I'm afraid this won't happen unless there is a sudden need for it.

wanderingbort 10y ago
> If big companies like Apple and Google were behind this, it could change, but I'm afraid this won't happen unless there is a sudden need for it. Digital privacy for average consumers needs more than a brand behind it, it needs an obvious value. I don't think many average people actually suspect that email _can_ be tampered with so, what does "signing" it mean to them. Moreover, when/if it enters the mainstream it will be plagued with "hacks" which degrade the user-perceived value, causing many to abandon it if it isn't free. by "hacks" I mean the users will expose keys and then blame AES :)
nihonde 10y ago
If ever there were a user group that should have forced pgp adoption, it is lawyers. When I worked at a big law firm, I lobbied for it and ran into a bunch of IT managers who had never heard of anything unless Microsoft sold it to them.
nhxu 10y ago
> If big companies like Apple and Google were behind this, it could change, but I'm afraid this won't happen unless there is a sudden need for it. End-to-end [1] is using OpenPGP. [1]: https://github.com/google/end-to-end/ https://github.com/google/end-to-end/

tlikonen 10y ago

PGP (now GnuPG) is used more these days than in BBS (Fidonet) years, particularly in the open source community. Software releases and packages in GNU/Linux distributions are signed by the developers. All the time. It happens automatically without end-user noticing. Is this not one definition of "working well?" Lot's of people are passively using it without knowing. But for messaging it's indeed very marginal. In open source projects' techical mailing lists and version control systems there is pretty much message or commit signing but that's a marginal group who does that.

astrodust 10y ago
I'd believe PGP is in wider use today than Fidonet is, but not much wider. I have to laugh that Snapchat has apparently solved the identity exchange problem and PGP is still stuck with these ridiculously baroque implementations.
- ryukafalz 10y ago
  >I have to laugh that Snapchat has apparently solved the identity exchange problem and PGP is still stuck with these ridiculously baroque implementations. Er, how? Admittedly I've only used it a few times, but the only thing that sticks out along those lines is the Snapcode system. How is that any different than scanning a QR code in OpenKeychain?
  - astrodust 10y ago
    The part where it works and millions of people use it.

matheusmoreira 10y ago

>Signal isn't even that popular WhatsApp integrated¹ Signal's secure messaging protocol. Since then, at least one government was unable to compel² the company to produce unencrypted messages from users under investigation. Given the popularity of WhatsApp, I think its safe to say a lot of people are now using a relatively secure messaging protocol. ¹ https://whispersystems.org/blog/whatsapp-complete/ https://whispersystems.org/blog/whatsapp-complete/ ² https://www.forbes.com/sites/parmyolson/2016/05/03/whatsapp-founder-brazil-shut-down-facebook/ https://www.forbes.com/sites/parmyolson/2016/05/03/whatsapp-...

cyberpunk 10y ago
I don't want to harp on about this again, but I really don't think you can put any sort of trust into such things as this. With GPG, you're producing an encrypted version of some text/data with a bit of code you can build yourself and run completely on your equipment, airgapped or whatever. With signal/whatsapp, there is no way of even knowing if the code you're using "in app" is the code in github or in whatever rev wherever. Yes, I know reproducable builds -- but what stops the app fetching more code from elsewhere? Wanna bet there's a webview and some JS in that app somewhere? It's nice to make things harder for the NSA to read, but this architecture seems to be just creating the illusion of safety and it's kind of weird to see how much advocacy it gets here when there are such obvious faults in it. I'm not saying there's a better alternative, and congrats to all who are working on it and I'm happy to see it succeed -- but this isn't a solved problem and there's massive danger in trusting such things. I'd love to have the time to really inspect whatsapp/signal to see what I'm sending/getting -- has anyone done this? Google isn't giving me much..
- nickik 10y ago
  There is a extremly large difference between passiv listening and recording everything and cleverly hacking the Signal app, or even forcing OWS to do it for them. The cost differences alone are massive, not to mention that its harder to do while remaining hidden. Yes its not perfect, but calling it a illusion of safety is just overly negative. If the NSA really wants you, they will get you, but that does not mean all your safty is illusion.

rvern 10y ago

It isn't because GnuPG doesn't work well or because it is too hard to use that people don't use it. They don't use it because other people don't use it. Why do people use Facebook instead of Diaspora? It's not because Facebook is better, works well, or is easier to use... It's because other people use Facebook. Why do people use Skype instead of XMPP? It's not because Skype is better, works well, or is easier to use... It's because other people use Skype. Why do people use WhatsApp instead of GnuPG or OTR? It's not because WhatsApp is better, works well, or is easier to use... It's because other people use WhatsApp. It's always the same standard chicken and egg adoption problem. As shown in the article, GnuPG is used for package signing, commit signing, file encryption, and all sorts of things that don't involve many people. But when it's about communication, you can only use GnuPG if the people you want to communicate with use GnuPG too... and thus the adoption problem applies. And the reason people initially used Facebook, Skype, and WhatsApp is not that they were easier to use or better. It's advertising. Notice how all of these are proprietary software made by companies with the means to advertise their software? You can bet people would use GnuPG, Diaspora, and XMPP if they had been advertised by companies like Facebook and Microsoft. So if we want people to use open source software and open protocols instead of living in walled gardens, we need to advertise them. Advertising works.

dispose13432 10y ago
>And the reason people initially used Facebook, Skype, and WhatsApp is not that they were easier to use or better. It's advertising. Notice how all of these are proprietary software made by companies with the means to advertise their software? You can bet people would use GnuPG, Diaspora, and XMPP if they had been advertised by companies like Facebook and Microsoft. I know quite a few non-techies who use VLC, Firefox, LibreOffice, and other OS advertising-less projects. The difference is: 1. Facebook, Skype and WhatsApp solved problems others didn't and became big. Now it's too late to fight. Had Diaspora been around before FB, and as easy to work with (put name here, picture here, password here, friend here. You're all set up. Let's go), or XMPP been around before Skype (which is a very old program in internet time), or Kontalk,Signal, etc. been around before WhatsApp (find friends by number, not by username), they probably would have taken off (at least to some degree). Google came late onto the Desktop scene (Chromebooks) and are not successful while the incumbent (MS) is good. MS came late onto the mobile scene and failed, while the incumbent (Google) is good.

cedricbonhomme 10y ago

I see more and more comparisons between Signal and OpenPGP. Signal is an application (in fact more than a simple application) that solves a more global problem (of communication solutions that uses asymmetric cryptography) which never was intended to be solved with OpenPGP. OpenPGP is a standard. GnuPG, the tool that people are comparing with Signal (I think).

confounded 10y ago
This applies to much of the XMPP discussion above, too. Also worth noting that GnuPG isn't even what you send the emails with. And that PGP on mobile is almost unheard of. I doubt I could explain how to send an PGP encrypted email (for example, to a doctor/lawyer/accountant) inside of 2 minutes. Strong intrinsic motivation is the only reason people use PGP. It took me ~3 months to get a critical mass of 15 or so people on to Signal as first port of call.

openplatypus 10y ago

It is surprisingly easy to use PGP/GnuPG. Check this tutorial https://emailselfdefense.fsf.org/en/ https://emailselfdefense.fsf.org/en/. It is _just_ slightly more complex than using Twitter once configured.

confounded 10y ago
It's the configuration that kills it, and a large part of that is loading context into the user's mind (the highest drop-out form).
kbart 10y ago
No, even this step-by-step tutorial is not easy for "normal" user. It's plagued with obscure terms and concepts (keypair, keyserver, public key, web of trust, revocation certificate etc.). Sure, for us, developers/engineers/geeks, it looks trivial, but try to send this link to your grandma and see how it goes.

gnipgnip 10y ago

Interesting that Moxie wishes PGP were dead (inline with his views in the LibreSignal/Websocked/Gapps PR). https://moxie.org/blog/gpg-and-me/ https://moxie.org/blog/gpg-and-me/