4 ms·
E-Mail needs better tools and better standards than GPG IMO. For one, GPG tools are difficult to use. Anything beyond a simple 1-click-setup-ready-to-use-inclu
by zaarn 9y ago
E-Mail needs better tools and better standards than GPG IMO.
For one, GPG tools are difficult to use. Anything beyond a simple 1-click-setup-ready-to-use-including-keyserver-publication will make any wide market adoption difficult.
On the other, the GPG standard is a bit ... clunky. Ideally it should be modernized to take advantage of the email format; add generic messages about encryption in alternate mime content bodies and simply encode the encrypted messages into it's own. I imagine other, similar, improvements could be made, up and including having GPG also sign the email headers before pushing it out into the world.
- AnaniasAnanas 9y agoGPG is not a standard, the standard is OpenPGP. As for the tools, they seem very easy, especially engimail which IS 1-click setup. > add generic messages about encryption in alternate mime content bodies and simply encode the encrypted messages into it's own This is exactly what it is doing. PGP/MIME is a thing.
- zaarn 9y agoEnigmail is far from friction free and no 1-click setup. I still have to go through key generation last I checked. And then publish those keys or give them to friends. If PGP/GPG wants adoption they need to eliminate those friction points, a TOFU model with automatic key redistribution should lower friction sufficiently but except TOFU there isn't much development in that direction. >This is exactly what it is doing. PGP/MIME is a thing. I don't think I ever received a single PGP/MIME email. I don't think a lot of people use PGP/MIME. It's a niche setting for a niche software.
- dane-pgp 9y agoYour desire for "a TOFU model with automatic key redistribution" is well-founded, and people (including implementers) are trying to do something about this. Check out the Autocrypt project: https://autocrypt.org/ https://autocrypt.org/ A similar (and complementary) approach is outlined in RFC-7929: https://tools.ietf.org/html/rfc7929 https://tools.ietf.org/html/rfc7929 which is supported by GPG and a few email providers.
- AnaniasAnanas 9y ago> no 1-click setup True, it is 3-click setup. > I don't think I ever received a single PGP/MIME email I haven't seen non-PGP/MIME emails in ages. In fact, Engimail uses PGP/MIME by default.
- cyphar 9y ago> the standard is OpenPGP The standard is PGP. OpenPGP is an implementation.
- AnaniasAnanas 9y agoIs this a joke?
- jwilk 9y agoNo. OpenPGP is the standard. PGP and GPG are implementations of this standard.
- lmm 9y agoBetter tools yes, better standards no. There isn't a single production-quality library implementation of the OpenPGP standard; anyone who uses OpenPGP in production ends up with some variant on a crappy 700-line python script wrapping the GPG executable. (There are dozens or hundreds of those out there, every company has their own). I'll never understand what possesses people who aren't up to writing a solid library implementation of the existing standard to believe that they would be capable of coming up with a better new standard, but it's distressingly common. Error reporting in email clients that support OpenPGP is awful because they all work by some variant of exec-ing the GPG process and piping its input/output, so half the time you'll try to set up PGP and it just won't work. Even when it does work, no extant mail program has yet reached the level of having an actual UI/UX designer spend even a couple of months of work actually trying to make the PGP experience a good one - and why would they when no-one's prepared to pay for it? Security professionals are willing to work for free on things like security audits of the GPG code, because you can get a conference paper out of that, but there's no corresponding channel for usability work. > Ideally it should be modernized to take advantage of the email format; add generic messages about encryption in alternate mime content bodies and simply encode the encrypted messages into it's own. PGP/MIME already does this. We don't need a new standard. We need to get better at using the standard we have.
- rakoo 9y agoTotally agree on it. Autocrypt (https://autocrypt.org/index.html https://autocrypt.org/index.html) is looking good as an incremental approach towards an automatic, widespread use of encryption in emails
- yrro 9y agoForgive me but isn't GPGME the high level library that programs probably want to use rather than dealing with gpg's protocol themselves?
- lmm 9y agoGPGME is a library that automates the exec-ing and pipeing, with all the issues that come with that (e.g. poor error reporting).