Hacker News new | ask | show | jobs
by duskwuff 1752 days ago
That's a bad thing. PGP has some really awful usability problems which have never been addressed. The paper "Why Johnny Can't Encrypt" described some of these issues in 1999, and a series of followups ("Why Johnny Still Can't Encrypt", "Why Johnny Still, Still Can't Encrypt"...) have come out over the years confirming that it still hasn't improved.
2 comments
mastazi 1752 days ago
PGP is a protocol, not a client. It should be up to clients to make it easy to use. You can setup PGP in Thunderbird in one minute https://support.mozilla.org/en-US/kb/openpgp-thunderbird-how...

Edit: maybe what seems easy to me can seem hard to someone else. Not sure if I'm having a bias here.

link
dane-pgp 1752 days ago
Someone should carry out a study where they test whether people can create a ProtonMail account and send an email from it (with a control group trying to do the same using Gmail). They could title the resulting research paper "Why Johnny Can Now Encrypt".
link
duskwuff 1751 days ago
I don't know of any tests specifically for ProtonMail, but "Why Johnny Still, Still Can't Encrypt" tested the usability of another in-browser PGP interface and found it lacking.
link
hammyhavoc 1752 days ago
I've heard fairly compelling arguments for why ProtonMail isn't a good choice if you want privacy due to where your keys are saved.
link
iggldiggl 1751 days ago
And it still involves some significant trade-offs in terms of functionality: Potentially worse (spam) filtering and no full-text search unless you keep a full local copy of your mails around (which is rather unreasonable on a phone and impossible with webmail).

And those trade-offs are more or less fundamental if you want to access your mail from multiple devices, but at the same time don't want to trust your server to handle decrypted mails.

link
hammyhavoc 1751 days ago
All depends on your threat model. I would never expect to receive sensitive information via email in 2021 when there are protocols like Matrix available. Even my bank and utility providers only send me email notifications telling me to login to their platform to view sensitive information. At this point, other than select business communications, email has been relegated to a two-way notification system for most people.

Sure, I send a lot of emails, but likewise, if I had anything worth keeping private, I certainly wouldn't be sending it in an email, even an encrypted one.

link