Why Johnny Still Can't Encrypt: Evaluating the Usability of a Modern PGP Client
Backwards compatibility is the killer.<p>The whole design of PGP is to be the envelope to make email private, versus the plaintext postcard that everybody can read. It works with existing servers and existing mail clients.<p>The biggest Snowden revelation is the importance of metadata. Just knowing whom you talk to, when, is frequently enough to compromise the parties involved. You might be doing something legal now, but you can’t tell when some despot takes over and makes your activity illegal. When data can potentially last your lifetime, you need to consider this sort of thing. Illustration: Using Metadata to find Paul Revere. [1]<p>So, we need a new mail transmission protocol that limits the amount of metadata that can be seen. Something like Dark Mail [2]. I don’t think Open Whisper Signal hides the metadata.<p>The problem is that Dark Mail needs to be developed and its security reviewed, and people need to adopt it. It needs new servers and clients, and the prevalence of Windows shows just how difficult that problem is. Also, any new messaging program these days needs a story about web and mobile.<p>In practice, I heard someone say that the biggest improvement in people’s privacy has been use of Gmail. The clients connect to it with SSL certificates controlled by Google; Google promotes 2-factor authentication and access tokens; and Google’s legal team challenges subpoenas. As long as you are not leaking national security secrets, I think this is adequate until a better system is deployed.<p>[1] <a href="http://kieranhealy.org/blog/archives/2013/06/09/using-metadata-to-find-paul-revere/" rel="nofollow">http://kieranhealy.org/blog/archives/2013/06/09/using-metada...</a><p>[2] <a href="https://darkmail.info" rel="nofollow">https://darkmail.info</a>