9 ms·

I find it interesting how many business models and ideas are obsolete if there was a wider and easier adoption of gpg. It's over two decades old, but not aged i

I find it interesting how many business models and ideas are obsolete if there was a wider and easier adoption of gpg. It's over two decades old, but not aged in a bad way. I wonder why it isn't integrated better in OS-es, or part of education, as it's such a useful tool. I get why these products pop up, because they solve the initial inertia and make it accessible. Maybe it's OSS licensing, maybe US laws regarding crypto, hm. Does anyone have thoughts on this? Edit: my ability to communicate seems to be pretty bad today, so let me clarify. The question is about enhancement/integration in terms of usability, and not lack of adoption "as is". I'm well aware that the reason why it's not more adopted is because it isn't easy to use, otherwise these services wouldn't be popping up that makes it more user friendly. Hence the "... obsolete if there was a wider and easier adoption of gpg"

nindalf 6y ago
I have thoughts. It's very similar to why dropbox is a thing. In the original Show HN for Dropbox, the top comment assured the founder that it could easily be replaced with sshfs and a version control system. For some reason, the average consumer found Dropbox easier to use.
- okamiueru 6y ago
  I mean, I'm not asking why something easy to use is used more than something not easy to use. That would be silly. Maybe someone thought that, and that's why I got downvoted? What you've replied can be reduced to "because it's easier to use". These are not the thoughts I'm after, so let me clarify / reiterate. I'm asking why a highly usable technology that has been in existence for two decades has not found its way into a accessible easy to use implementation. Seemed like an interesting thing to get an opinion on, but I also don't care enough to offend anyone.
  - nindalf 6y ago
    > a highly usable technology I think the consensus is that GPG isn't easy to use. Perhaps it only seems easy to use for you because you're used to it? Kinda like git. Git's UX is objectively bad but it doesn't bother me because using it is second nature now. I don't think it would be easy for a non-programmer to pick up. That's why people use document versioning provided by Google/Microsoft/Apple/Dropbox/Adobe rather than using git from the command line. It's the same with GPG.
    - okamiueru 6y ago
      I think you're being obtuse, either intentional or not. The technology is useful because of what it does, and my ability to use it is irrelevant. In a "nuclear fusion is a useful technology" sense. Everything else I've explained twice now should have made that explicit and abundantly clear, so, I think I'm done here. Feel free to not continue this conversation.
      - jmercouris 6y ago
        I think many open source technologies drop the ball when it comes to integrating a nice application. Seems that the protocol and implementation is nice, but the user interface is lacking. Perhaps that is not an interesting part of development for the GPG team.
        megous 6y ago
        There are many GUI frontends for GnuPG, if that's useful to someone: https://www.gnupg.org/software/frontends.html https://www.gnupg.org/software/frontends.html
      - nindalf 6y ago
        You said "usable" when you meant "useful". And then you got upset when I took your comment at face value. Talk about childish.
        okamiueru 6y ago
        That was indeed a autocorrect issue, and if that was what caused the confusion, I apologize. I've also done nothing but reiterate the same point from the start, which you seemed quite opposed to consider. This has also devolved into name-calling, so, not sure why you bothered at all. Even if admittedly, the word "usable" (hard to misunderstand in the context, IMO) should have been "useful", the usable part of this could very much have been for other knowledgeable software developers/designers for it to be the backend of something user-friendly. As such, not even "usable" in that context would have been wrong. Regardless, this would require some modicum willingness for benefit of doubt, which, I do not expect at this point. My only advice to you, is that perhaps don't assume people are children, and perhaps you'll find it easier to see meaning in their arguments.
  - jsmeaton 6y ago
    https://latacora.micro.blog/2019/07/16/the-pgp-problem.html https://latacora.micro.blog/2019/07/16/the-pgp-problem.html Is a pretty good tear down of pgp. It doesn’t sound like pgp can be made more usable.
    - okamiueru 6y ago
      That was a very interesting read, and covers all the issues I had with GPG/PGP broken down on a per-use-case basis, which is really neat. Fairly up-to-date too (aside from maybe WhatsApp mentioned alongside Signal). In any case, thanks for sharing! Nice to see simplified and somewhat modernized tools like (https://github.com/str4d/rage https://github.com/str4d/rage) and (https://github.com/FiloSottile/age https://github.com/FiloSottile/age) The article that post mentions in the beginning also had some interesting perspectives, though a bit older. https://blog.cryptographyengineering.com/2014/08/13/whats-matter-with-pgp/ https://blog.cryptographyengineering.com/2014/08/13/whats-ma...
- megous 6y ago
  Dropbox also has CLI. If that was the only way to access dropbox, average consumer would be out of luck too. GnuPG has a ton of frontends. I can do three clicks in gajim and have chat secured by GnuPG. Or manage keys with some system keyring app like seahorse (https://wiki.debian.org/Seahorse https://wiki.debian.org/Seahorse), or whatever. The problem is only education. Dropbox just pays a ton of money to put their solution in front of people's eyes via ads, and whatever. GnuPG obviously does not do that on the same level. Also securing your communication via asymmetric cryptography requires a bit more understanding and data hygiene than uploading a file somewhere. So it will be an uphill battle regardless of the UI.
  - mekster 6y ago
    > The problem is only education. I don't want to be educated to use something and I'm a developer for 20+ years. I wouldn't consider to use any services unless anyone (as in company staff) wouldn't be bothered to use it. I can't really recommend Bitwarden Send when pasting files in a self hosted Mattermost chat room would suffice for internal use.
    - megous 6y ago
      I was writing about GnuPG.
lxgr 6y ago
> Does anyone have thoughts on this? Many people do, and it usually boils down to usability (or more precisely, the lack thereof).
zokier 6y ago
As I understand that was sort of the thinking behind Keybase before they pivoted more into groupware and more proprietaryish stuff (and eventually got bought out)
toyg 6y ago
Apart from the obvious usability thing, I think key management is the main problem. With a solution like this, the user does not even know keys or certificates exist. Anything involving GPG, no matter how easy you make it, will require some knowledge of those concepts. .. And if you say "but what if the app did it all for you behind the scenes" - at that point, it would look exactly like this and the fact it's gpg based or not would not matter to anyone, not even to you.
- rlpb 6y ago
  > Anything involving GPG, no matter how easy you make it, will require some knowledge of those concepts. I don't think that's necessary. It would be sufficient to simply abandon the idea that keys must be relatively permanent and are useless without establishing out-of-band trust first. Take WhatsApp for example. The client autogenerates the key, and then contacts are Trusted On First Use (TOFU). Rekeys aren't even notified to the user by default. Having users verify key fingerprints before they can even use the software was considered too difficult. So perfect security is compromised, but instead we get something that works, and can upgrade security if the user takes those additional steps. The equivalent for GPG would involve an automatic request that a different party create a keypair and send back the public key, such that an encrypted message can then be sent. TOFU. Key management could then be automatic, and fingerprints still verifiable if users want to do that manually later.
pydry 6y ago
Seeing how many people lose their bitcoins or prefer to host them illustrated to me what the natural inhibitions to GPG were. I think the assumption it builds in that users fully own and have full control over their device never fully held and will become less and less valid over time also. With the "thin client" model and careless users, GPG breaks. Also, the NSA clearly wanted to kill the project. I'm pretty sure they engaged in some smarter and more underhanded sabotage after the obvious failure of classifying math as munitions export.
atleta 6y ago
For this to work it would have to be included in all major OSs and/or browsers. People just use what they know and what they can use, even if it sounds tautological. E.g. it's pretty hard to convince even small groups to use a mailing list, to upload e.g. photos of shared interest to e.g. a google drive (instead of mailing them around or just sticking them into a FB group). It's doable but it's not the norm.
- okamiueru 6y ago
  I'll mention this article I was directed to by jsmeaton that really highlighted a lot of the reason why there is inertia behind such UX friendly integrations of PGP backed solutions: https://latacora.micro.blog/2019/07/16/the-pgp-problem.html https://latacora.micro.blog/2019/07/16/the-pgp-problem.html It's the best break down I've seen of PGP and it really took me out of my flawed notion of PGP, and that it is maybe not so 'pretty good' as I had thought.
nonameiguess 6y ago
ProtonMail seems to have become reasonably popular and uses pgp, though it doesn't require users to be aware of this.
kitkat_new 6y ago
or if email got replaced with Matrix: https://matrix.org/ https://matrix.org/

nindalf 6y ago

I have thoughts. It's very similar to why dropbox is a thing. In the original Show HN for Dropbox, the top comment assured the founder that it could easily be replaced with sshfs and a version control system. For some reason, the average consumer found Dropbox easier to use.

okamiueru 6y ago
I mean, I'm not asking why something easy to use is used more than something not easy to use. That would be silly. Maybe someone thought that, and that's why I got downvoted? What you've replied can be reduced to "because it's easier to use". These are not the thoughts I'm after, so let me clarify / reiterate. I'm asking why a highly usable technology that has been in existence for two decades has not found its way into a accessible easy to use implementation. Seemed like an interesting thing to get an opinion on, but I also don't care enough to offend anyone.
- nindalf 6y ago
  > a highly usable technology I think the consensus is that GPG isn't easy to use. Perhaps it only seems easy to use for you because you're used to it? Kinda like git. Git's UX is objectively bad but it doesn't bother me because using it is second nature now. I don't think it would be easy for a non-programmer to pick up. That's why people use document versioning provided by Google/Microsoft/Apple/Dropbox/Adobe rather than using git from the command line. It's the same with GPG.
  - okamiueru 6y ago
    I think you're being obtuse, either intentional or not. The technology is useful because of what it does, and my ability to use it is irrelevant. In a "nuclear fusion is a useful technology" sense. Everything else I've explained twice now should have made that explicit and abundantly clear, so, I think I'm done here. Feel free to not continue this conversation.
    - jmercouris 6y ago
      I think many open source technologies drop the ball when it comes to integrating a nice application. Seems that the protocol and implementation is nice, but the user interface is lacking. Perhaps that is not an interesting part of development for the GPG team.
      - megous 6y ago
        There are many GUI frontends for GnuPG, if that's useful to someone: https://www.gnupg.org/software/frontends.html https://www.gnupg.org/software/frontends.html
    - nindalf 6y ago
      You said "usable" when you meant "useful". And then you got upset when I took your comment at face value. Talk about childish.
      - okamiueru 6y ago
        That was indeed a autocorrect issue, and if that was what caused the confusion, I apologize. I've also done nothing but reiterate the same point from the start, which you seemed quite opposed to consider. This has also devolved into name-calling, so, not sure why you bothered at all. Even if admittedly, the word "usable" (hard to misunderstand in the context, IMO) should have been "useful", the usable part of this could very much have been for other knowledgeable software developers/designers for it to be the backend of something user-friendly. As such, not even "usable" in that context would have been wrong. Regardless, this would require some modicum willingness for benefit of doubt, which, I do not expect at this point. My only advice to you, is that perhaps don't assume people are children, and perhaps you'll find it easier to see meaning in their arguments.
- jsmeaton 6y ago
  https://latacora.micro.blog/2019/07/16/the-pgp-problem.html https://latacora.micro.blog/2019/07/16/the-pgp-problem.html Is a pretty good tear down of pgp. It doesn’t sound like pgp can be made more usable.
  - okamiueru 6y ago
    That was a very interesting read, and covers all the issues I had with GPG/PGP broken down on a per-use-case basis, which is really neat. Fairly up-to-date too (aside from maybe WhatsApp mentioned alongside Signal). In any case, thanks for sharing! Nice to see simplified and somewhat modernized tools like (https://github.com/str4d/rage https://github.com/str4d/rage) and (https://github.com/FiloSottile/age https://github.com/FiloSottile/age) The article that post mentions in the beginning also had some interesting perspectives, though a bit older. https://blog.cryptographyengineering.com/2014/08/13/whats-matter-with-pgp/ https://blog.cryptographyengineering.com/2014/08/13/whats-ma...
megous 6y ago
Dropbox also has CLI. If that was the only way to access dropbox, average consumer would be out of luck too. GnuPG has a ton of frontends. I can do three clicks in gajim and have chat secured by GnuPG. Or manage keys with some system keyring app like seahorse (https://wiki.debian.org/Seahorse https://wiki.debian.org/Seahorse), or whatever. The problem is only education. Dropbox just pays a ton of money to put their solution in front of people's eyes via ads, and whatever. GnuPG obviously does not do that on the same level. Also securing your communication via asymmetric cryptography requires a bit more understanding and data hygiene than uploading a file somewhere. So it will be an uphill battle regardless of the UI.
- mekster 6y ago
  > The problem is only education. I don't want to be educated to use something and I'm a developer for 20+ years. I wouldn't consider to use any services unless anyone (as in company staff) wouldn't be bothered to use it. I can't really recommend Bitwarden Send when pasting files in a self hosted Mattermost chat room would suffice for internal use.
  - megous 6y ago
    I was writing about GnuPG.

lxgr 6y ago

> Does anyone have thoughts on this? Many people do, and it usually boils down to usability (or more precisely, the lack thereof).

zokier 6y ago

As I understand that was sort of the thinking behind Keybase before they pivoted more into groupware and more proprietaryish stuff (and eventually got bought out)

toyg 6y ago

Apart from the obvious usability thing, I think key management is the main problem. With a solution like this, the user does not even know keys or certificates exist. Anything involving GPG, no matter how easy you make it, will require some knowledge of those concepts. .. And if you say "but what if the app did it all for you behind the scenes" - at that point, it would look exactly like this and the fact it's gpg based or not would not matter to anyone, not even to you.

rlpb 6y ago
> Anything involving GPG, no matter how easy you make it, will require some knowledge of those concepts. I don't think that's necessary. It would be sufficient to simply abandon the idea that keys must be relatively permanent and are useless without establishing out-of-band trust first. Take WhatsApp for example. The client autogenerates the key, and then contacts are Trusted On First Use (TOFU). Rekeys aren't even notified to the user by default. Having users verify key fingerprints before they can even use the software was considered too difficult. So perfect security is compromised, but instead we get something that works, and can upgrade security if the user takes those additional steps. The equivalent for GPG would involve an automatic request that a different party create a keypair and send back the public key, such that an encrypted message can then be sent. TOFU. Key management could then be automatic, and fingerprints still verifiable if users want to do that manually later.

pydry 6y ago

Seeing how many people lose their bitcoins or prefer to host them illustrated to me what the natural inhibitions to GPG were. I think the assumption it builds in that users fully own and have full control over their device never fully held and will become less and less valid over time also. With the "thin client" model and careless users, GPG breaks. Also, the NSA clearly wanted to kill the project. I'm pretty sure they engaged in some smarter and more underhanded sabotage after the obvious failure of classifying math as munitions export.

atleta 6y ago

For this to work it would have to be included in all major OSs and/or browsers. People just use what they know and what they can use, even if it sounds tautological. E.g. it's pretty hard to convince even small groups to use a mailing list, to upload e.g. photos of shared interest to e.g. a google drive (instead of mailing them around or just sticking them into a FB group). It's doable but it's not the norm.

okamiueru 6y ago
I'll mention this article I was directed to by jsmeaton that really highlighted a lot of the reason why there is inertia behind such UX friendly integrations of PGP backed solutions: https://latacora.micro.blog/2019/07/16/the-pgp-problem.html https://latacora.micro.blog/2019/07/16/the-pgp-problem.html It's the best break down I've seen of PGP and it really took me out of my flawed notion of PGP, and that it is maybe not so 'pretty good' as I had thought.

nonameiguess 6y ago

ProtonMail seems to have become reasonably popular and uses pgp, though it doesn't require users to be aware of this.

kitkat_new 6y ago

or if email got replaced with Matrix: https://matrix.org/ https://matrix.org/