4 ms·

Old article is old May 2018 specifically

by zymhan 5y ago

duskwuff 5y ago
Has anything changed? PGP is literally thirty years old now, and I'm not aware of any significant changes to either the protocol or to the support landscape.
- mastazi 5y ago
  > PGP is literally thirty years old now, and I'm not aware of any significant changes sounds like a good thing to me
  - duskwuff 5y ago
    That's a bad thing. PGP has some really awful usability problems which have never been addressed. The paper "Why Johnny Can't Encrypt" described some of these issues in 1999, and a series of followups ("Why Johnny Still Can't Encrypt", "Why Johnny Still, Still Can't Encrypt"...) have come out over the years confirming that it still hasn't improved.
    - mastazi 5y ago
      PGP is a protocol, not a client. It should be up to clients to make it easy to use. You can setup PGP in Thunderbird in one minute https://support.mozilla.org/en-US/kb/openpgp-thunderbird-howto-and-faq#w_i-have-never-used-openpgp-with-thunderbird-before-how-do-i-setup-openpgp https://support.mozilla.org/en-US/kb/openpgp-thunderbird-how... Edit: maybe what seems easy to me can seem hard to someone else. Not sure if I'm having a bias here.
    - dane-pgp 5y ago
      Someone should carry out a study where they test whether people can create a ProtonMail account and send an email from it (with a control group trying to do the same using Gmail). They could title the resulting research paper "Why Johnny Can Now Encrypt".
      - hammyhavoc 5y ago
        I've heard fairly compelling arguments for why ProtonMail isn't a good choice if you want privacy due to where your keys are saved.
        iggldiggl 5y ago
        And it still involves some significant trade-offs in terms of functionality: Potentially worse (spam) filtering and no full-text search unless you keep a full local copy of your mails around (which is rather unreasonable on a phone and impossible with webmail). And those trade-offs are more or less fundamental if you want to access your mail from multiple devices, but at the same time don't want to trust your server to handle decrypted mails.
        hammyhavoc 5y ago
        All depends on your threat model. I would never expect to receive sensitive information via email in 2021 when there are protocols like Matrix available. Even my bank and utility providers only send me email notifications telling me to login to their platform to view sensitive information. At this point, other than select business communications, email has been relegated to a two-way notification system for most people. Sure, I send a lot of emails, but likewise, if I had anything worth keeping private, I certainly wouldn't be sending it in an email, even an encrypted one.
      - duskwuff 5y ago
        I don't know of any tests specifically for ProtonMail, but "Why Johnny Still, Still Can't Encrypt" tested the usability of another in-browser PGP interface and found it lacking.

Old article is old May 2018 specifically

by zymhan 5y ago

Old article is old May 2018 specifically

Has anything changed? PGP is literally thirty years old now, and I'm not aware of any significant changes to either the protocol or to the support landscape.

mastazi 5y ago
> PGP is literally thirty years old now, and I'm not aware of any significant changes sounds like a good thing to me
- duskwuff 5y ago
  That's a bad thing. PGP has some really awful usability problems which have never been addressed. The paper "Why Johnny Can't Encrypt" described some of these issues in 1999, and a series of followups ("Why Johnny Still Can't Encrypt", "Why Johnny Still, Still Can't Encrypt"...) have come out over the years confirming that it still hasn't improved.
  - mastazi 5y ago
    PGP is a protocol, not a client. It should be up to clients to make it easy to use. You can setup PGP in Thunderbird in one minute https://support.mozilla.org/en-US/kb/openpgp-thunderbird-howto-and-faq#w_i-have-never-used-openpgp-with-thunderbird-before-how-do-i-setup-openpgp https://support.mozilla.org/en-US/kb/openpgp-thunderbird-how... Edit: maybe what seems easy to me can seem hard to someone else. Not sure if I'm having a bias here.
  - dane-pgp 5y ago
    Someone should carry out a study where they test whether people can create a ProtonMail account and send an email from it (with a control group trying to do the same using Gmail). They could title the resulting research paper "Why Johnny Can Now Encrypt".
    - hammyhavoc 5y ago
      I've heard fairly compelling arguments for why ProtonMail isn't a good choice if you want privacy due to where your keys are saved.
      - iggldiggl 5y ago
        And it still involves some significant trade-offs in terms of functionality: Potentially worse (spam) filtering and no full-text search unless you keep a full local copy of your mails around (which is rather unreasonable on a phone and impossible with webmail). And those trade-offs are more or less fundamental if you want to access your mail from multiple devices, but at the same time don't want to trust your server to handle decrypted mails.
        hammyhavoc 5y ago
        All depends on your threat model. I would never expect to receive sensitive information via email in 2021 when there are protocols like Matrix available. Even my bank and utility providers only send me email notifications telling me to login to their platform to view sensitive information. At this point, other than select business communications, email has been relegated to a two-way notification system for most people. Sure, I send a lot of emails, but likewise, if I had anything worth keeping private, I certainly wouldn't be sending it in an email, even an encrypted one.
    - duskwuff 5y ago
      I don't know of any tests specifically for ProtonMail, but "Why Johnny Still, Still Can't Encrypt" tested the usability of another in-browser PGP interface and found it lacking.