3 ms·

> Key management (including, critically, movement between devices) is the primary reason email encryption is rare. I think you're wrong. Basic key management i

> Key management (including, critically, movement between devices) is the primary reason email encryption is rare. I think you're wrong. Basic key management is nearly trivial, even for complete non-techies. My dad didn't knew a thing about modern crypto but learned to sign his amateur radio callbook records in no time. Just showed him "here's your keypair, keep this one absolutely private, and this is public key, here we ask them to sign the public part, yada yada" (the whole explanation took about 15 minutes) and he got it. Maybe that's because he was personally interested in learning. Now, while he would probably get confused and fail when faced with any remotely advanced things, he's able to use very basic crypto well enough. And, yes, he had backed keys up and had moved them between computers. It wasn't that hard. The primary reason for rarity is complete UI/UX awkwardness. Key management (if present) is hidden beneath dozen of clicks deep into some obscure settings area - this prevents users from learning there's one. Then UI is plain horrible (pretty much raw view of keystore contents, with all that X.50x-based weirdness exposed naked right to ASN.1 OIDs), which prevents use by those who found it. And software vendors, even though they're bragging about their "security for our users" efforts, don't give a damn about that, as key management UIs remained mostly the same for decades.

nknighthb 13y ago
Your dad is probably exactly the kind of person Zimmerman was thinking about in 1991. Somebody with one PC that they do everything on. He also has a specific motivation for learning about and putting up with public key crypto. I don't know what UIs you've used, but the ones I've used dating back to the early 90s are nothing like what you're describing. Typical public key crypto UIs are very clear and unambiguous, and I've had no trouble teaching intelligent people how to use them. The problem is twofold: First, half the population is necessarily below average. Second, even getting the intelligent people to keep using it is a completely different matter. I've had an engineer-CEO mandate PGP usage for the company. Later, when sending him encrypted documents, he couldn't read them. Why? Because he'd gotten a new laptop. Where were his keys? Who knows. Ditto one of the best and most security-minded engineers I know. Tried to send an encrypted file to him, "I haven't really used PGP in years, I'm not sure where my keys are". I've kept a keychain[0] intact for the better part of a decade. I don't personally know a single other person who has, including the person who originally asked me to generate a public key. [0] In fact, one of my still-used SSH keys is also about that old, as is my known_hosts file. These are, again, singular accomplishments in my professional and social circles.

nknighthb 13y ago

Your dad is probably exactly the kind of person Zimmerman was thinking about in 1991. Somebody with one PC that they do everything on. He also has a specific motivation for learning about and putting up with public key crypto. I don't know what UIs you've used, but the ones I've used dating back to the early 90s are nothing like what you're describing. Typical public key crypto UIs are very clear and unambiguous, and I've had no trouble teaching intelligent people how to use them. The problem is twofold: First, half the population is necessarily below average. Second, even getting the intelligent people to keep using it is a completely different matter. I've had an engineer-CEO mandate PGP usage for the company. Later, when sending him encrypted documents, he couldn't read them. Why? Because he'd gotten a new laptop. Where were his keys? Who knows. Ditto one of the best and most security-minded engineers I know. Tried to send an encrypted file to him, "I haven't really used PGP in years, I'm not sure where my keys are". I've kept a keychain[0] intact for the better part of a decade. I don't personally know a single other person who has, including the person who originally asked me to generate a public key. [0] In fact, one of my still-used SSH keys is also about that old, as is my known_hosts file. These are, again, singular accomplishments in my professional and social circles.