3 ms·
> PGP UX is horrible and still stuck in the 90s! It's great for people who need it and it was really necessary to be invented. But something like OTR is the rea
by chimeracoder 13y ago
> PGP UX is horrible and still stuck in the 90s! It's great for people who need it and it was really necessary to be invented. But something like OTR is the real successor.
As tptacek commented on an earlier post, all of the alternatives to PGP provide more or less the same UX that PGP is capable of. It's not inconceivable that my PGP client could do most of the legwork (ie, fetching keys from keyservers, encrypting automatically, etc.) for me while maintaining compatibility with PGP.
In any case, I don't really want to enter a PGP vs. OTR discussion right now, because my original point is that many self-identified hackers use neither. If people read this thread and begin to use either one or the other, I consider that to be a win for now!
- FedRegister 13y ago> (ie, fetching keys from keyservers, encrypting automatically, etc) No no no no no! The keyservers have no authentication for key addition. Anybody can put up a key for any email address and effectively wedge themselves man in the middle.
- bigiain 13y agoAlso, the paranoid in me (and probably more significantly, the keyboard-activist-in-the-safety-of-my-parents-basement) suggests that it might be wise to access keyservers over TOR. If _I_ were involved with PRISM, the pipe running to pgp.mit.edu would be one of the most monitored connections around. "Hmmm, someone just searched for a PGP key for FedRegister - lets see what else that IP address has searched for, and what's in all the gmail inboxes that have ever been accessed using that IP address…"
- grabhive 13y agoYes. This is the way that hackers should be thinking from now on.
- chimeracoder 13y agofacepalm Yes, I redact my above comment to remove that example. However, I still stand by my statement that PGP UX is a client issue, not an inherent protocol issue (ie, it's fixable without abandoning PGP entirely).