Hacker News new | past | comments | ask | show | jobs | submit login

In my experience it is mostly due to annoyance. PGP is seamless until someone tries to check their mail on their friend's computer and discovers that encryption works as intended. Then all of a sudden they start begging you not to send them encrypted messages.

I have yet to see any other reason for why PGP is not even used by people for whom it would be easy. Even within the security and cryptography research communities it is rarely used.

The solution to this particular problem is to have smartcards; while we are at it, we should also use smartcards for authentication, so that when you sit down at your friend's computer you plug in a smartcard to log in and to read your messages. Unfortunately that means we need to deploy a bunch of new infrastructure, and I would not count on any help from governments or from the tech community (which is largely monetized by violating user privacy).




I know some folks in the Air Force - all of their ID cards have public/private keys stored on them. They use them (plus a pin) for logging onto their computers at work, all of their e-mails are digitally signed, and the computer is locked just by removing the card from the card reader. Most personnel don't know a thing about public key encryption/two factor authentication, and likely wouldn't care if you offered to explain it to them.

I can imagine this could easily get rolled out if you integrated the public/private keys into driver's licenses. A quick search online suggests that blank cards are about $.06 each in bulk [1], but smart card vary between $.60 and $1.50 [2] (don't take this as definitive - I have no experience purchasing them). I don't think anyone would care paying an extra, say $2 or so whenever they get a new license for the cost of the card plus recouping the cost of hardware to print them.

Phase it in over time - have hand-outs at the DMV answering "What's this funny chip on my driver's license?" Gradually phase it in over time for online tax payments/water bills/etc. - something like "your username and password will be good until {date reasonably far in the future}, but after that you'll need a card reader. You can purchase one for $15 from any of these retailers: ..."

Once both the cards and readers are in place, it's a lot easier to get the critical mass to push for stronger authentication from banks, online retailers, etc. People worried about privacy implication could purchase their own cards from independent retailers and put their own keys on them.

[1] http://www.smartcardsupply.com/Content/Cards/cards.htm

[2] http://www.smartcardsupply.com/Content/Cards/ISO7816.htm


>I know some folks in the Air Force . . .

Interesting. Do all of their work computers run Windows?


Wikipedia gives better overall picture in TL;DR fashion. http://en.wikipedia.org/wiki/Common_Access_Card


I don't think that's as big an issue these days, given the rise of the smartphone - people just use their smartphone for email.

The solution is to make software so the smartphone can act as the smartcard if you really want to go that route.

Smartcard readers exist, and certain institutions use them already, the problem is getting the cards and readers to the masses.


A version of your suggested solution is currently in use in Estonia [1], although it is not really used to encrypt e-mails.

I guess it's one of the virtues of having a population a tad smaller than 1.5 million.

[1]http://en.wikipedia.org/wiki/Estonian_ID_card




Consider applying for YC's Spring batch! Applications are open till Feb 11.

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: