3 ms·

I intentionally left out key exchange to see if anyone would ignore my points on ease of messaging to focus on something else. Nice taking the bait. ;) Yes, we

I intentionally left out key exchange to see if anyone would ignore my points on ease of messaging to focus on something else. Nice taking the bait. ;) Yes, we can do a front end improvement on that part, too. What you think about my greater claim that one can use it effectively exchanging text files after learning a handful of commands? It's more important because it refutes the GPG is too hard argument.

tedunangst 9y ago
Not that I use GPG, but that is exactly how I would. write text, encrypt, paste base64 nonsense into email, verify I'm sending nonsense, send. So many failures result from trying to make things "easy" and so you get people full quoting in plaintext, cc to the wrong person (transparently encrypted with their key, so they can read it, etc.). I disagree that GPG is easy, and I think telling people to use it will mean they screw it up. But I also think efforts to make it easier are likely to automate failure.
- u801e 9y ago
  > paste base64 nonsense into email, Why would people paste the text into the composer rather than attaching the file? > I disagree that GPG is easy, and I think telling people to use it will mean they screw it up. We can tell people to zip up files (possibly encrypting them with a password) and attach them to an email, but I've never heard anyone argue that telling people to do that would mean that they would screw it up. What makes GPG different (other than the public/private key thing)? Maybe one way to introduce people to GPG would be to have them use symmetric encryption at first to send messages and files (as an alternative to a password protected zip or other archive format). Then tell them that if they create keypairs, they only need to give the other person their public key and the other person does not need to tell them the password of the day anymore to securely send the message.
- nickpsecurity 9y ago
  "paste base64 nonsense into email" Note that Im telling them to attach a text file they encrypted rather than mess with encodings and stuff. They just encrypt a file, attach it, done. Alternatively, the front end has a built in editor that outputs an encrypted file with the name they pick. Far as failure automation, you could say that about anything. Ive reduced the problem of communicating to two steps. Most things aren't that easy centralized or decentralized.

tedunangst 9y ago

Not that I use GPG, but that is exactly how I would. write text, encrypt, paste base64 nonsense into email, verify I'm sending nonsense, send. So many failures result from trying to make things "easy" and so you get people full quoting in plaintext, cc to the wrong person (transparently encrypted with their key, so they can read it, etc.). I disagree that GPG is easy, and I think telling people to use it will mean they screw it up. But I also think efforts to make it easier are likely to automate failure.

u801e 9y ago
> paste base64 nonsense into email, Why would people paste the text into the composer rather than attaching the file? > I disagree that GPG is easy, and I think telling people to use it will mean they screw it up. We can tell people to zip up files (possibly encrypting them with a password) and attach them to an email, but I've never heard anyone argue that telling people to do that would mean that they would screw it up. What makes GPG different (other than the public/private key thing)? Maybe one way to introduce people to GPG would be to have them use symmetric encryption at first to send messages and files (as an alternative to a password protected zip or other archive format). Then tell them that if they create keypairs, they only need to give the other person their public key and the other person does not need to tell them the password of the day anymore to securely send the message.
nickpsecurity 9y ago
"paste base64 nonsense into email" Note that Im telling them to attach a text file they encrypted rather than mess with encodings and stuff. They just encrypt a file, attach it, done. Alternatively, the front end has a built in editor that outputs an encrypted file with the name they pick. Far as failure automation, you could say that about anything. Ive reduced the problem of communicating to two steps. Most things aren't that easy centralized or decentralized.