5 ms·

Thank you for the kind words, but just to be crystal clear: we are storing the users' private keys on the cloud, hence the symmetric encryption. It's certainly

Thank you for the kind words, but just to be crystal clear: we are storing the users' private keys on the cloud, hence the symmetric encryption. It's certainly a trade-off, and not the right option for everyone, but it lowers the barrier to entry for OpenPGP enormously.

Osmium 13y ago
Really admire what you're doing here, but proposed pricing seems off (just my opinion). If you think we'd be better off moving to a "encrypted by default" world, then limiting paying users to sending 150 messages a month isn't a good way to do it! Especially when I know it doesn't cost that much to do so.
- napoleond 13y ago
  I appreciate the feedback! Pricing is tricky, and we're open to suggestions--our challenge is basically to earn most of our profit from business users while keeping it inexpensive for consumers. Maybe the number of messages is the wrong way to separate the two camps, though. Any ideas? (Is 150 messages/month really limiting for average users? I don't think I've sent anywhere near that much personal mail this month, but I may be an anomaly.) EDIT: I forgot to mention that whichever way we end up doing it, the personal plan will be free for anyone who signs up for the mailing list before August 1.
  - lmm 13y ago
    My first thought is number of recipients. If you allowed low-tier users to send messages to e.g. 5 people at a time, and any more required the business plan, that seems like a good way to separate the two.
    - Osmium 13y ago
      Number of recipients seems like a good idea for separating personal and business to me too. Personally, I only use PGP for emails with my partner, but we definitely send way in excess of 150 messages a month. I'm all for a world where people start using encryption as a matter of course, so I really the OP's product works out. It'll finally get rid of that "you must have something to hide" mentality, when all you really want to do is protect yourself from the odd security vulnerability or a grumpy sys admin with an axe to grind!
    - napoleond 13y ago
      That's a great idea, thanks for the suggestion! I'll be making some changes to reflect that.
  - rdl 13y ago
    I would try to differentiate based on features, vs. messages. Businesses care about: * third-party administrators being able to create/update/etc. accounts (either consultants for small companies, or IT staff for larger companies) -- this is the #1 way to differentiate a consumer service from a business service. * document retention policy (which is really document destruction capability * escrow (corp escrow keys) * escrow for in-line checking of messages (either DLP, or AV, or archiving for compliance with SEC or other regulators) * certifications of compliance * support * maybe custom domain names and other trickery (including stuff like splitting domain names to both work with existing exchange servers or google apps plus your service * service level agreements, indemnity, etc. * integration into stuff like Active Directory (LDAP) for account provisioning and credentials * Maybe 2FA (although I'd argue 2FA should be a base feature, but for mail it isn't very meaningful except if you do cert auth or cookie/ip blessing of systems + stored imap or web browser password to log in + your passphrase stuff for the crypto, and then a non-cert 2FA thing is only meaningful to management I don't think you need to worry about marginal 5-10 user businesses using the free service instead of a paid service; I'd focus on making sure you can make real money on 100-500+ user businesses, or small businesses which will grow into those, and then on getting as many free users as possible to try to drive conversions. I'd rather sell 10 companies with 500 users each than 50 companies with 5 users each.
    - napoleond 13y ago
      Awesome feedback as usual. Thanks Ryan! That gives us a lot to think about.
mike-cardwell 13y ago
The open source webmail application "Roundcube" combined with the "openpgp_rc" plugin which utilises the "openpgp.js" library, works as follows: You can generate your keys in the browser, or paste in an existing key. The key is then stored in HTML localStorage in the browser. If you ever clear your localStorage, you have to paste it in again. But this way, the key never goes near the server. Your method is suitable for most people who can't be bothered backing up their keys. Choice would be a good thing though.
- napoleond 13y ago
  That's a cool way of doing it! Of course, the usual caveats about in-browser crypto still apply, but still neat. I agree that choice is great, and we might expose manual key management in Parley at some point, but realistically people who know how to do that (and have the desire to) already have many options.

Osmium 13y ago

Really admire what you're doing here, but proposed pricing seems off (just my opinion). If you think we'd be better off moving to a "encrypted by default" world, then limiting paying users to sending 150 messages a month isn't a good way to do it! Especially when I know it doesn't cost that much to do so.

napoleond 13y ago
I appreciate the feedback! Pricing is tricky, and we're open to suggestions--our challenge is basically to earn most of our profit from business users while keeping it inexpensive for consumers. Maybe the number of messages is the wrong way to separate the two camps, though. Any ideas? (Is 150 messages/month really limiting for average users? I don't think I've sent anywhere near that much personal mail this month, but I may be an anomaly.) EDIT: I forgot to mention that whichever way we end up doing it, the personal plan will be free for anyone who signs up for the mailing list before August 1.
- lmm 13y ago
  My first thought is number of recipients. If you allowed low-tier users to send messages to e.g. 5 people at a time, and any more required the business plan, that seems like a good way to separate the two.
  - Osmium 13y ago
    Number of recipients seems like a good idea for separating personal and business to me too. Personally, I only use PGP for emails with my partner, but we definitely send way in excess of 150 messages a month. I'm all for a world where people start using encryption as a matter of course, so I really the OP's product works out. It'll finally get rid of that "you must have something to hide" mentality, when all you really want to do is protect yourself from the odd security vulnerability or a grumpy sys admin with an axe to grind!
  - napoleond 13y ago
    That's a great idea, thanks for the suggestion! I'll be making some changes to reflect that.
- rdl 13y ago
  I would try to differentiate based on features, vs. messages. Businesses care about: * third-party administrators being able to create/update/etc. accounts (either consultants for small companies, or IT staff for larger companies) -- this is the #1 way to differentiate a consumer service from a business service. * document retention policy (which is really document destruction capability * escrow (corp escrow keys) * escrow for in-line checking of messages (either DLP, or AV, or archiving for compliance with SEC or other regulators) * certifications of compliance * support * maybe custom domain names and other trickery (including stuff like splitting domain names to both work with existing exchange servers or google apps plus your service * service level agreements, indemnity, etc. * integration into stuff like Active Directory (LDAP) for account provisioning and credentials * Maybe 2FA (although I'd argue 2FA should be a base feature, but for mail it isn't very meaningful except if you do cert auth or cookie/ip blessing of systems + stored imap or web browser password to log in + your passphrase stuff for the crypto, and then a non-cert 2FA thing is only meaningful to management I don't think you need to worry about marginal 5-10 user businesses using the free service instead of a paid service; I'd focus on making sure you can make real money on 100-500+ user businesses, or small businesses which will grow into those, and then on getting as many free users as possible to try to drive conversions. I'd rather sell 10 companies with 500 users each than 50 companies with 5 users each.
  - napoleond 13y ago
    Awesome feedback as usual. Thanks Ryan! That gives us a lot to think about.

mike-cardwell 13y ago

The open source webmail application "Roundcube" combined with the "openpgp_rc" plugin which utilises the "openpgp.js" library, works as follows: You can generate your keys in the browser, or paste in an existing key. The key is then stored in HTML localStorage in the browser. If you ever clear your localStorage, you have to paste it in again. But this way, the key never goes near the server. Your method is suitable for most people who can't be bothered backing up their keys. Choice would be a good thing though.

napoleond 13y ago
That's a cool way of doing it! Of course, the usual caveats about in-browser crypto still apply, but still neat. I agree that choice is great, and we might expose manual key management in Parley at some point, but realistically people who know how to do that (and have the desire to) already have many options.