3 ms·

An emerging HN trope is that “almost no one uses PGP.” PGP remains wildly popular on Tor cryptomarkets, an area where users assume server compromise will happe

An emerging HN trope is that “almost no one uses PGP.” PGP remains wildly popular on Tor cryptomarkets, an area where users assume server compromise will happen yet still decide to transact using encrypted messages. Don’t underestimate a technology gaining popularity in fringe communities with young user bases, often from non-technical backgrounds. Kudos to companies like Keybase and Protonmail for investing in PGP’s future.

louwrentius 6y ago
So you mean to say is that PGP is wildly or only popular with criminals?
- hermod 6y ago
  Which would be an excellent endorsement for PGP, provided that the said criminals don't get caught.
- timerol 6y ago
  Conflating "people that practice good OpSec" and "criminals" is disingenuous.
- exolymph 6y ago
  If criminals don't use your privacy tech, it probably doesn't work.
snowwrestler 6y ago
I think a lot of people think about encryption technologies in terms of global adoption. HTTPS, encrypted filesystems, and E2E encrypted messaging have all reached a significant percentage of global Internet users. But in that context, 50k PGP users is arguably "almost no one." If we guesstimate 4 billion Internet users, that's 0.001% of all users. I think the point is not that PGP is impossible to use, I think the point is that PGP is not appropriate to scale to the global Internet the way other encryption technologies have.
- a3_nm 6y ago
  It's not true that something isn't valuable just because it hasn't scaled. PGP has an outdated and confusing UX, a broken threat model, and is extremely bad in many respects. But it does have users, and for some people and some tasks, it works better than alternatives. (My use cases: exchanging routine work email with other nerds who have it set up, share confidential documents.) So, while we shouldn't minimize its very major problems, we shouldn't pretend that its user base does not exist and that it's not addressing at least some use cases.

louwrentius 6y ago

So you mean to say is that PGP is wildly or only popular with criminals?

hermod 6y ago
Which would be an excellent endorsement for PGP, provided that the said criminals don't get caught.
timerol 6y ago
Conflating "people that practice good OpSec" and "criminals" is disingenuous.
exolymph 6y ago
If criminals don't use your privacy tech, it probably doesn't work.

snowwrestler 6y ago

I think a lot of people think about encryption technologies in terms of global adoption. HTTPS, encrypted filesystems, and E2E encrypted messaging have all reached a significant percentage of global Internet users. But in that context, 50k PGP users is arguably "almost no one." If we guesstimate 4 billion Internet users, that's 0.001% of all users. I think the point is not that PGP is impossible to use, I think the point is that PGP is not appropriate to scale to the global Internet the way other encryption technologies have.

a3_nm 6y ago
It's not true that something isn't valuable just because it hasn't scaled. PGP has an outdated and confusing UX, a broken threat model, and is extremely bad in many respects. But it does have users, and for some people and some tasks, it works better than alternatives. (My use cases: exchanging routine work email with other nerds who have it set up, share confidential documents.) So, while we shouldn't minimize its very major problems, we shouldn't pretend that its user base does not exist and that it's not addressing at least some use cases.