Introducing people to PGP

Like it or not, email is still an essential form of communication and (again, like it or not) PGP encryption is useless if nobody uses it. Has anyone ever successfully persuaded people into using PGP without sounding like a preaching neckbeard? How did you nudge people into trying it? Email signatures, subtle hints, advertising your PGP key/ fingerprint on social media?

You're never gonna get people to manually handle keys. The solution is what Signal and Matrix does.

i'd say just make sure your public key is easy to find. a lot of dev types have pgp keys for software signing and such but don't use them. i think getting these people to opportunistically encrypt with pgp is the closest to "mass adoption" you can reasonably expect. * i want to preface this next part by saying i'm not recommending against PGP. i'm trying to present an analysis of where PGP fits in to the bigger picture of online privacy and security. honestly, PGPs niche in the security/privacy space is kind of narrowing. PGP is somewhat at odds with the important practice of partitioning your identities. i don't think it's controversial to say that rolling a new email for every account you create and every "hat" you wear has a much greater impact on your privacy than opportunistically encrypting with PGP (even if PGP had better adoption). to facilitate this with PGP you would have to either link all of these email addresses to your identity key, which kind of defeats the point, or roll a new key for each email, which effectively means forgoing the web of trust aspect of PGP. in the rather rare cases where a giving an identity its own PGP key makes sense, i opt for the latter approach. more broadly speaking, PGP was absolutely not designed with things like ephemeral identities and anonymity in mind. you can of course use it this way, but rolling new keys all the time is a messy solution even with automated tooling (saying this as someone who has automated tooling to do just this). beyond the difficulty in managing all of these keys, the cryptographic properties of PGP aren't ideal for this application. what you'd really want is something that can derive temporary session keys that don't double as a crypographic name tag for some immutable identity. from a privacy standpoint anything in the double ratchet family of protocols is going to be a better option. i won't say much about PGP from a security standpoint because I'm not really qualified to do so. it's essentially just RSA so there isn't much to complain about anyway. it inherits the same issues as any system that uses long-lived keys. just take any criticism of TLS and replace the gripes about certificate authorities with gripes about polluting keyservers with bad data. so what is PGP good for? i'd like to hear other lainons' ideas about this, but i'll at least give you my own use cases: >proof of identity i put this first even though it's not particularly useful to me because i think it is the only case where using PGP exactly as intended is truly the best option. obviously this is important if you have any kind of mass culture platform, but it's also good for stuff like signing software releases. identity doesn't need to mean "what it says on your birth certificate" of course. in fact, PGP is especially useful in cases where you want to use an alias and ensure that people can't pretend to be that alias. i'm also going to lump things like secure file drops and tip lines into this category. if you want to be able to offer a guarantee that whatever is sent to you is for your eyes only, PGP is great. >layering encryption or signing on top of things that don't support it. speaks for itself. sometimes you don't have any other options and PGP doesn't require the runtime infrastructure that other protocols do. use it like a trip code on forums that don't have it. send one-off encrypted messages or files over social media. that kind of thing. i specify one-off here because if you're going to be encrypting your entire facebook conversation with someone you would certainly be better off using something else to talk. >as a general purpose encryption tool for your own files. some people prefer using a more full-featured password store type thing, but not all software supports oauth/kerberos/ldap/whatever and sometimes you have to store utility-type passwords on a server. it's not going to be your only line of defense for sure, especially if you need the keys to be accessible to some service without you manually entering a password, but PGP can certainly buy you some additional security when layered in with disk encryption, filesystem permissions, good network security, and all that. >as a replacement for TLS certs this is more theoretical as i've rarely seen it officially implemented and its not at all standardized. retroshare is the only example i can think of right now. the problem domain is: "i have this hacky script that passes data between my systems over the network. i'd like it to be encrypted". most people just use ssh tunnels for this because rolling up a PKI is a pain. if they need something more robust they'll use a vpn. at least then you're only making the pki once. still, PGP keys are substantially easier to deal with and if your goal is just "make sure people can't sniff this traffic" then i could see it as a drop-in replacement. you don't gain much over just doing everything with ssh keys (or wireguard) but i can imagine a situation where you do want some minimal notion of trust delegation/key signing but don't need a proper PKI or something even more complicated like kerberos.

>>10792 this if you want other people using PGP you better get a'hackin protonmail is the most successful implementation i've seen yet and people still hate it.

>>10792 >some time back decide to try signal >impossible to use without registering a phone number almost fell off my chair

what's a good pgp key manager/decrypter for linux?

>>10799 >what's a good pgp key manager/decrypter for linux? GPA is not bad. You can also use enigmail. But both hide most of the options that GnuPG offers you. So if you're not afraid of the command line, just use gpg.

>>10791 We're using OpenPGP with friends successfully. No problems whatsoever. Of course setting it up took a while for some people, but after that it works like charm.

>Has anyone ever successfully persuaded people into using PGP A I managed to do it once. >without sounding like a preaching neckbeard? I'll get back to you on that....

Best PGP guide I found online: http://dreadditevelidot.onion/d/OpSec/wiki/?id=23318f36 I made a .org file out of it: https://pastebin.com/raw/R2KnGKQg

>>10885 I fuarrrking hate captcha so much, I couldn't open the .onion link because dred is a broken piece of soykaf and I had to enable js for pastebin. I've attached the document for those who don't want to go through all this trouble, just change .txt into .org. Lainchan doesn't support .org files as of making this post.

>>10791 I can't even convince people to not download the covid tracking app, because apparently we all "have nothing to hide". Had that conversation today. Potential security holes, bad actors simply using it for stalking etc - they just don't care. This is in a software dev team too, they aren't tech illiterates. They also actively think their personal lives being mined for neuromarketing is wonderful though, since it tells them what to buy. Think I'm an insane conspiracy nut for running an ad blocker. I hate my life.

>>10791 I havent convinced anyone to use it yet, but I did start writing a blog series on how to use it. http://cgjzkysxa4ru5rhrtr6rafckhexbisbtxwg2fg743cjumioysmirhdad.onion/blog/gpg-1.html >>10793 Best Analysis of PGP I have read in a long time. A lot of p2p apps like this - they are encrypted (or not) but highly vulernable to network and traffic analysis. Things like blockchain and the fediverse.

>>10796 >protonmail is the most successful implementation i've seen yet and people still hate it. The mainstream hates it because its not google or similar. Privacy advocates dislike it because its potentially a honeypot. Ultimately I don't think any big hosted privacy focused service is ever going to please people because by their very nature they are offputting to the mainstream and suspicious to those with an interest in privacy.

>>12285 >Privacy advocates dislike it because its potentially a honeypot. Additionally many don't like browser based e2e. Especially considering their e2e implementation's value is questionable since it only really works for other proton users. Sure, they can't read your emails on disk, but they still have access to clear text emails when you use their relays. If you trust them not to log this is better than having clear text emails stored on disk (since there's nothing to subpoena) but this is where the honeypot concern comes in.

>>10902 I know it's a buzzword at this point but people feel like literal NPCs.