Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

FTA:

Do you encrypt all your own e-mail, as a result of this stuff?

No, that’s really hard.



TWiT had a decent show on how to encrypt your e-mail with Mailvelope (Chrome/FF extension) and also with Thunderbird/Enigmail:

http://twit.tv/show/know-how/50


The hard part isn't the encryption, it's making sure everyone has everyone elses public key and nobdy loses their private key, otherwise the average person will see it as too much bother and just won't do it.


It would help if we had popular services create databases with people's public keys. Like let's say Gmail would allow you to search for your friend's public key, or you could find it in their profile, and you'd be able to easily import it in whatever PGP app you're using.

Of course that implies these services to actually care about security for their users this much. There are a ton of things major companies could to do make end-to-end encryption mainstream and popular. The problem is they have no interest in doing it, and not enough people are asking them to do it.

But I'd like to think that in a Post-PRISM world where nothing changes at the government level, there would be more services popping up and offering these "features". It's what competition is supposed to do.


The searching is part of the problem, it's just too much effort.

Build checking whether a public key is available via the STMP servers, do it transparently with designated trusted pub key repos much like browsers have trusted CAs or something along the lines of dns.

Problem still stands, lose your pub key, all mail signed with it is lost to you and people will complain. You could offer a service that allows folks to store and retrive the pub key, but that kinda misses the point because anyone who stores that info can hand it over to the NSA et all.

Other problem with this is the .GOV could MITM this service, give you a fake pub key, read the mail, then resign with read pub key and send it on. You need your mail client to actually register the pub key on first send and hope you weren't always being intercepted from the start, and give you a warning when the key changes.


No way that general encryption of personal, non-financial data would remain legal long after this became the norm. These syping programs are more invasive than outlawing encryption.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: