4 ms·

... Wait, why aren't we talking about PGP? PGP (and it's mathematical foundations to some degree) were invented to solve the secure email problem. Back then t

... Wait, why aren't we talking about PGP? PGP (and it's mathematical foundations to some degree) were invented to solve the secure email problem. Back then the proponents of PGP essentially predicted the situation we're in now. Up until now there's been plausible deniability for any of us normal people to care, so consumer adoption of PGP remains close to nil. Even corporate use I've seen only comes into play when dealing with another company who forces it be used. That's changing fast. Their original use case (secure messaging in a monitored society) is no longer only a tinfoil hat situation. The solution is for all of us HNers to adopt PGP 100%. Everyone who wants to talk to use would have to adopt PGP. The friction to start is rather huge but that is how something like this would get adopted. As for "but it doesn't jive with my gmail nicely".. maybe it's time we give up gmail too. It's value proposition is based on reading your email to be better build a profile on you to sell to advertisers. That's why google plus wanted your real name, so they have a face to put all that mined data to. Switch To PGP Day? edit: relevant links "simple pgp chrome plugin for gmail" - http://news.ycombinator.com/item?id=2918255 http://news.ycombinator.com/item?id=2918255

buro9 15y ago
I agree. I want to talk about PGP. But I'm talking to end users who have real trouble setting up a VPN. PGP's big problem back then was that it should be invisible and just work, it was neither. That's what I mean by needing to revisit secure email.
- gravitronic 15y ago
  I agree with everything you posted above and have no solution better than "hushmail and live with it".
  - DanBC 15y ago
    Hushmail only protects the contents. The new law is aimed at routing data (who sent the email; who it was sent to). Hushmail comply with correctly formed legal requests (they have to) but they go as far as creating back-doored java apps and serving them to specified customers. I guess it's harder for English LEOs to get correct legal documents to an American company for English customers. But I don't know.
- kamjam 15y ago
  GMail and other webmail providers just need to add this and make it a configurable option in the settings. Heck, even Outlook should give the users this option via some wizard (they seem to have one for everything else!). Totally agree that this needs to be as invisible as possible. When I first set up PGP in Thunderbird a few years back it was quite a bit of flaffing about, add to that the fact that your key reside on any one of a million servers... The cynic in me says it's been done in this way on purpose, i mean, don't want to make the feds actually do any work to be able to snoop around my emails.
  - gravitronic 15y ago
    GMail is open about the fact that it mines your emails for your advertising profile. Encrypting the data for you would result in reduced value proposition for them. Not going to happen.
    - kamjam 15y ago
      Ahhh, yes, that is very true! Time to crank up Thunderbird Portable again :)
    - tjoff 15y ago
      No. Google would of course be able to decrypt the content (I don't see how they would adopt it otherwise in this universe, google must comply if they get a warrant and they are not willing to fight that), thing is only google would be able to and noone else. And that alone is a huge win.
rlpb 15y ago
PGP on its own will only protect the contents of communications, not the fact that the communication occurred, nor the parties of that communication. The proposed legislation will apparently still require a warrant for the contents (and in the UK you will be required to decrypt the contents on demand). So while I agree that PGP is a good thing, it will not work around this proposed legislation at all. If I had to choose, I would prefer to see effort going into political action to prevent this law being passed instead. This is an unwarranted privacy intrusion by definition. If it were warranted, then the police would be able to get a warrant.

buro9 15y ago

I agree. I want to talk about PGP. But I'm talking to end users who have real trouble setting up a VPN. PGP's big problem back then was that it should be invisible and just work, it was neither. That's what I mean by needing to revisit secure email.

gravitronic 15y ago
I agree with everything you posted above and have no solution better than "hushmail and live with it".
- DanBC 15y ago
  Hushmail only protects the contents. The new law is aimed at routing data (who sent the email; who it was sent to). Hushmail comply with correctly formed legal requests (they have to) but they go as far as creating back-doored java apps and serving them to specified customers. I guess it's harder for English LEOs to get correct legal documents to an American company for English customers. But I don't know.
kamjam 15y ago
GMail and other webmail providers just need to add this and make it a configurable option in the settings. Heck, even Outlook should give the users this option via some wizard (they seem to have one for everything else!). Totally agree that this needs to be as invisible as possible. When I first set up PGP in Thunderbird a few years back it was quite a bit of flaffing about, add to that the fact that your key reside on any one of a million servers... The cynic in me says it's been done in this way on purpose, i mean, don't want to make the feds actually do any work to be able to snoop around my emails.
- gravitronic 15y ago
  GMail is open about the fact that it mines your emails for your advertising profile. Encrypting the data for you would result in reduced value proposition for them. Not going to happen.
  - kamjam 15y ago
    Ahhh, yes, that is very true! Time to crank up Thunderbird Portable again :)
  - tjoff 15y ago
    No. Google would of course be able to decrypt the content (I don't see how they would adopt it otherwise in this universe, google must comply if they get a warrant and they are not willing to fight that), thing is only google would be able to and noone else. And that alone is a huge win.

rlpb 15y ago

PGP on its own will only protect the contents of communications, not the fact that the communication occurred, nor the parties of that communication. The proposed legislation will apparently still require a warrant for the contents (and in the UK you will be required to decrypt the contents on demand). So while I agree that PGP is a good thing, it will not work around this proposed legislation at all. If I had to choose, I would prefer to see effort going into political action to prevent this law being passed instead. This is an unwarranted privacy intrusion by definition. If it were warranted, then the police would be able to get a warrant.