6 ms·

Good points by the OP. I've railed about similar things. Most notably, VPNs are a UX disaster. And that is a shame because the fundamental technology behind

by bhauer 13y ago

Good points by the OP. I've railed about similar things. Most notably, VPNs are a UX disaster. And that is a shame because the fundamental technology behind VPNs would be a prerequisite to a model that I describe as "PAO" [1] wherein I host my own omnipresent applications and data. The failure of VPNs to deliver a user experience that casual users can manage is one of the many contributors to the rise of the traditional cloud. I contend that regular people would be perfectly fine buying and replacing hard drives in a home disk array if the experience were straight-forward (it's anything but). Similarly, regular people would be fine buying Internet connectivity with high upload speed if this was part of ensuring secure, (nearly) everywhere access to their data. Regular people would be fine joining a federated backup cartel with friends and family if it were easy to set up. The savvy can do many of these things with today's mediocre UX, but the tremendous amount of money to be made by solving the problem using proprietary centralized servers explains why R&D has been directed toward the cloud as opposed to self-hosted application servers. Diving into minutia for a moment, in light of this week's news, I also recently ranted that it's a real shame that GPG suffers from one of the worst user experiences across all modern software. PGP from 10 to 15 years ago was a better user experience than GPG in 2013. The Thunderbird+GPG interface is absolutely horrific and even when I know I should encrypt a particular communication, when faced with the reality of getting my recipient configured with GPG, I flinch at the certain pain and suffering. I concede, "well, it's probably not needed anyway--who is likely to be listening?" [1] http://tiamat.tsotech.com/pao http://tiamat.tsotech.com/pao

nknighthb 13y ago
The GPG UI is ultimately a relatively minor issue when it comes to mass adoption. There have been several PGP-like products with decent UIs and good mail integration, none has enjoyed mass-market success. Creating another one wrapping an existing crypto library would be no epic undertaking. The real problem is key management. Any system which depends on users to think about keys, protect their keys, back up their keys, is doomed. The fix is going to have to involve cheap, idiot-proof hardware. When crypto key management is the same as house key management, people will start to use it, hopefully in a semi-correct manner.
- Simucal 13y ago
  When I read the title of this article I was really hoping it was going to discuss the UX problems of key management.
- sneak 13y ago
  > There have been several PGP-like products with decent UIs and good mail integration, none has enjoyed mass-market success. iMessage comes to mind. It is the most popular realtime messaging system in the world behind SMS, and is end-to-end encrypted with per-device keys. Of course, it's centralized, as is the key management, so Apple can subvert it at the behest of the government. Crypto isn't always 100% of the answer.
  - nknighthb 13y ago
    iMessage is not PGP-like. Its centralized and Apple-device-specific nature is practically PGP's antithesis. It also fails several key feature checks, like the ability to encrypt or sign arbitrary files.
knowaveragejoe 13y ago
PAO sounds like a great idea, but I think at this point in time it places a lot on the user's shoulders that is unfeasible for the vast majority of people. Your writeup is quite long so I haven't read it in its entirety, but have you given any thought to failure states? It seems to me that there is a single, very critical point of failure and/or vulnerable to being compromised - your home Internet connection(and everything that supports it).
- bhauer 13y ago
  Agreed, especially in light of the subject at hand thanks to the OP. UX is a consistent problem with self-managed applications and hardware. But I don't think that an approachable UX is unachievable. In fact, my belief is that if equal R&D were allocated to such an exercise as the R&D currently expended on plain cloud services, we could get there fairly quickly. Yes, your home Internet connection is a vulnerability, in much the same way as it always has been. Later in my diatribe I mention that federated backup with friends & family would be part of the overall strategy. On the other hand, a decentralized approach makes for thousands or millions of low-value targets rather than our current condition where every cloud vendor is a relatively hardened (but evidently not impenetrable) high-value target.

by bhauer 13y ago

nknighthb 13y ago

The GPG UI is ultimately a relatively minor issue when it comes to mass adoption. There have been several PGP-like products with decent UIs and good mail integration, none has enjoyed mass-market success. Creating another one wrapping an existing crypto library would be no epic undertaking. The real problem is key management. Any system which depends on users to think about keys, protect their keys, back up their keys, is doomed. The fix is going to have to involve cheap, idiot-proof hardware. When crypto key management is the same as house key management, people will start to use it, hopefully in a semi-correct manner.

Simucal 13y ago
When I read the title of this article I was really hoping it was going to discuss the UX problems of key management.
sneak 13y ago
> There have been several PGP-like products with decent UIs and good mail integration, none has enjoyed mass-market success. iMessage comes to mind. It is the most popular realtime messaging system in the world behind SMS, and is end-to-end encrypted with per-device keys. Of course, it's centralized, as is the key management, so Apple can subvert it at the behest of the government. Crypto isn't always 100% of the answer.
- nknighthb 13y ago
  iMessage is not PGP-like. Its centralized and Apple-device-specific nature is practically PGP's antithesis. It also fails several key feature checks, like the ability to encrypt or sign arbitrary files.

knowaveragejoe 13y ago

PAO sounds like a great idea, but I think at this point in time it places a lot on the user's shoulders that is unfeasible for the vast majority of people. Your writeup is quite long so I haven't read it in its entirety, but have you given any thought to failure states? It seems to me that there is a single, very critical point of failure and/or vulnerable to being compromised - your home Internet connection(and everything that supports it).

bhauer 13y ago
Agreed, especially in light of the subject at hand thanks to the OP. UX is a consistent problem with self-managed applications and hardware. But I don't think that an approachable UX is unachievable. In fact, my belief is that if equal R&D were allocated to such an exercise as the R&D currently expended on plain cloud services, we could get there fairly quickly. Yes, your home Internet connection is a vulnerability, in much the same way as it always has been. Later in my diatribe I mention that federated backup with friends & family would be part of the overall strategy. On the other hand, a decentralized approach makes for thousands or millions of low-value targets rather than our current condition where every cloud vendor is a relatively hardened (but evidently not impenetrable) high-value target.