5 ms·

While I'm all for propagating the knowledge of cryptography, there was a kid in High School would walk around handing his public key out to people on slips of p

While I'm all for propagating the knowledge of cryptography, there was a kid in High School would walk around handing his public key out to people on slips of paper. That wasn't terribly effective for him.

niels_olson 13y ago
Here's my issue with that, and, hey, I sort of agree, I have found pgp to be useful among hackers, but no one outside that circle has any interest in it, even my mom, the college math teacher. But is this where the technorati has failed to fill their real social obligation? Are we the new Russian intellectuals who failed to engage the people? Are we so self-absorbed in navel-gazing on Hacker News that we fail to actually execute on the one idea that matters? If we can't restore the security of communications, how will history judge us?
- stinkytaco 13y ago
  I love PGP, but I would think that history would judge us for not developing something more accessible rather than for not spreading PGP. Even I, a PGP user and geek, access my email via Gmail web or my phone's app most of the time rather than via my IMAP client because most people I communicate with don't use PGP and cannot be bothered to (because they also use webmail). And the sad part? I don't blame them. I'm not at my computer all the time. I don't carry it with me anymore and neither do they. They check it from work, from their phone or wherever. I don't have a solution for the problems that would plague a good crypto/identity system. Centralized trusted parties? That's worked just OK for websites and it entails a cost, and the paranoia that comes with it. A open solution like Persona? Maybe, but I don't know how to integrate that across browsers and devices without trust concerns. No, I don’t know. But I do know that PGP is a lot of trouble.
  - jiggy2011 13y ago
    It's a shame facebook doesn't allow for sharing PGP keys, that would solve the problem pretty well.
    - stinkytaco 13y ago
      It would go some of the way to solving the problem, but you've got to trust Facebook in that exchange and I'm not sure I do. The only real way to establish trust in PGP is in person (or over the phone if you really know the person). That said, I do think Facebook could go a long way to establishing a trust infrastructure.
      - jiggy2011 13y ago
        You would to a point. However your facebook friends could verify you by signing your public key with their private keys. Private keys could be stored on facebook's servers but encrypted with a key that is not sent to facebook (so all client side). The signing interface could be built into the facebook UI (like a verify button). So hopefully the FB API could expose public keys for use by other apps. Not perfect, but the advantage is that people already have FB accounts linked to their real IDs.
        stinkytaco 13y ago
        This would all be good once trust is established. FB would basically become a large keyserver that people already use, with an exposed API. That's a good thought. But I would still need to verify the trust in person. Otherwise, Facebook could be the MITM. Which is, of course, the problem with the web of trust concept being exposed to the world at large. Too many people would simply establish trust for the expediency. I can see someone in my high school class signing my key and thus expecting me to do the same, without any understanding of the point of the whole business. If Facebook has shown us anything, it's that interpersonal concepts (like "friend") can be easily eroded.
        jiggy2011 13y ago
        Yes, you would still have to trust FB to a degree , especially in the initial phase and they would still be serving the code that did all of the crypto so you have issues there. Once the trust was established though, especially with OTR it would be more difficult for them to later start abusing it. But it's still an improvement on FB having everything on their server under their complete control, if they starting messing with keys people would notice. There could be a problem with people just signing any old key, but really you just need to verify that the person is who they say they are. I think that works 90% of the time on FB as it is, it's unlikely you'd get away with being an imposter.
  - jlgaddis 13y ago
    Symantec's Windows version of PGP isn't that bad, as far as UIs go. It's been a couple years since I used it but I'm confident I could teach the average person who already uses Outlook how to use it in an hour or two. The nice thing is that it has opportunistic encryption enabled by default. Thus, it will always try to encrypt an outgoing e-mail and throw up a warning if the recipient's public key isn't available, for example. The error is, surprisingly, understandable to the average person (something like "A public key for <recipient> is not available and this message cannot be sent encrypted. Would you like to send it unencrypted?")

niels_olson 13y ago

Here's my issue with that, and, hey, I sort of agree, I have found pgp to be useful among hackers, but no one outside that circle has any interest in it, even my mom, the college math teacher. But is this where the technorati has failed to fill their real social obligation? Are we the new Russian intellectuals who failed to engage the people? Are we so self-absorbed in navel-gazing on Hacker News that we fail to actually execute on the one idea that matters? If we can't restore the security of communications, how will history judge us?

stinkytaco 13y ago
I love PGP, but I would think that history would judge us for not developing something more accessible rather than for not spreading PGP. Even I, a PGP user and geek, access my email via Gmail web or my phone's app most of the time rather than via my IMAP client because most people I communicate with don't use PGP and cannot be bothered to (because they also use webmail). And the sad part? I don't blame them. I'm not at my computer all the time. I don't carry it with me anymore and neither do they. They check it from work, from their phone or wherever. I don't have a solution for the problems that would plague a good crypto/identity system. Centralized trusted parties? That's worked just OK for websites and it entails a cost, and the paranoia that comes with it. A open solution like Persona? Maybe, but I don't know how to integrate that across browsers and devices without trust concerns. No, I don’t know. But I do know that PGP is a lot of trouble.
- jiggy2011 13y ago
  It's a shame facebook doesn't allow for sharing PGP keys, that would solve the problem pretty well.
  - stinkytaco 13y ago
    It would go some of the way to solving the problem, but you've got to trust Facebook in that exchange and I'm not sure I do. The only real way to establish trust in PGP is in person (or over the phone if you really know the person). That said, I do think Facebook could go a long way to establishing a trust infrastructure.
    - jiggy2011 13y ago
      You would to a point. However your facebook friends could verify you by signing your public key with their private keys. Private keys could be stored on facebook's servers but encrypted with a key that is not sent to facebook (so all client side). The signing interface could be built into the facebook UI (like a verify button). So hopefully the FB API could expose public keys for use by other apps. Not perfect, but the advantage is that people already have FB accounts linked to their real IDs.
      - stinkytaco 13y ago
        This would all be good once trust is established. FB would basically become a large keyserver that people already use, with an exposed API. That's a good thought. But I would still need to verify the trust in person. Otherwise, Facebook could be the MITM. Which is, of course, the problem with the web of trust concept being exposed to the world at large. Too many people would simply establish trust for the expediency. I can see someone in my high school class signing my key and thus expecting me to do the same, without any understanding of the point of the whole business. If Facebook has shown us anything, it's that interpersonal concepts (like "friend") can be easily eroded.
        jiggy2011 13y ago
        Yes, you would still have to trust FB to a degree , especially in the initial phase and they would still be serving the code that did all of the crypto so you have issues there. Once the trust was established though, especially with OTR it would be more difficult for them to later start abusing it. But it's still an improvement on FB having everything on their server under their complete control, if they starting messing with keys people would notice. There could be a problem with people just signing any old key, but really you just need to verify that the person is who they say they are. I think that works 90% of the time on FB as it is, it's unlikely you'd get away with being an imposter.
- jlgaddis 13y ago
  Symantec's Windows version of PGP isn't that bad, as far as UIs go. It's been a couple years since I used it but I'm confident I could teach the average person who already uses Outlook how to use it in an hour or two. The nice thing is that it has opportunistic encryption enabled by default. Thus, it will always try to encrypt an outgoing e-mail and throw up a warning if the recipient's public key isn't available, for example. The error is, surprisingly, understandable to the average person (something like "A public key for <recipient> is not available and this message cannot be sent encrypted. Would you like to send it unencrypted?")