Hacker News new | ask | show | jobs
by mastazi 1749 days ago
> PGP is literally thirty years old now, and I'm not aware of any significant changes

sounds like a good thing to me

1 comments

That's a bad thing. PGP has some really awful usability problems which have never been addressed. The paper "Why Johnny Can't Encrypt" described some of these issues in 1999, and a series of followups ("Why Johnny Still Can't Encrypt", "Why Johnny Still, Still Can't Encrypt"...) have come out over the years confirming that it still hasn't improved.
PGP is a protocol, not a client. It should be up to clients to make it easy to use. You can setup PGP in Thunderbird in one minute https://support.mozilla.org/en-US/kb/openpgp-thunderbird-how...

Edit: maybe what seems easy to me can seem hard to someone else. Not sure if I'm having a bias here.

Someone should carry out a study where they test whether people can create a ProtonMail account and send an email from it (with a control group trying to do the same using Gmail). They could title the resulting research paper "Why Johnny Can Now Encrypt".
I don't know of any tests specifically for ProtonMail, but "Why Johnny Still, Still Can't Encrypt" tested the usability of another in-browser PGP interface and found it lacking.
I've heard fairly compelling arguments for why ProtonMail isn't a good choice if you want privacy due to where your keys are saved.
And it still involves some significant trade-offs in terms of functionality: Potentially worse (spam) filtering and no full-text search unless you keep a full local copy of your mails around (which is rather unreasonable on a phone and impossible with webmail).

And those trade-offs are more or less fundamental if you want to access your mail from multiple devices, but at the same time don't want to trust your server to handle decrypted mails.

All depends on your threat model. I would never expect to receive sensitive information via email in 2021 when there are protocols like Matrix available. Even my bank and utility providers only send me email notifications telling me to login to their platform to view sensitive information. At this point, other than select business communications, email has been relegated to a two-way notification system for most people.

Sure, I send a lot of emails, but likewise, if I had anything worth keeping private, I certainly wouldn't be sending it in an email, even an encrypted one.