Skip to main content


In case you are wondering why my public PGP key is expired, it is because I would like to discourage people from sending me PGP-encrypted email. The number of times I have had people send me mail in the clear that they appear to have thought was encrypted is NOT SMALL.

reshared this

in reply to evacide

When GDPR was looming, we set up PGP and S/MIME in the small IT company I work for, because we anticipated several of our clients would be interested in it (since they deal with sensitive data). While we did get it to work, it was so user unfriendly that we abandoned any plans to teach our clients how to use it and looked for other solutions instead.
in reply to evacide

right you are, the failure mode is terrible. The only other security related tool I'm aware of that could fail the user that hard is IPSec; it was long ago, but IIRC back in the day I saw connections that seemed secure but were only signed.
in reply to evacide

I don't blame you. PGP is a security UX shitshow. it was excusable in 1995 when we didn't know better or have good alternatives, but it hasn't really gotten much better in the 30 years since.
in reply to evacide

well you obviously should have used GPG instead!

/me ducks!!!!!!

(also, /s)

in reply to evacide

Snailmail is orders of magnitude more secure than PGP because the PGP user interface is such rubbish.
in reply to evacide

Does this mean you still think pgp viable for folks with sufficient training?
in reply to Robert Link

@phaedral It depends on what you're trying to do, who is involved, and what the consequences of sending an unencrypted message are.
in reply to evacide

"Why I haven't updated my PGP book since 2005," exhibit #873.
in reply to evacide

funny enough, I use pgp frequently. But literally never for email, and almost never use the asymmetrical part... just for symmetric one-off file tasks.

The alternative is arcane openssl commands, which... ugh. Nasty.

in reply to evacide

I once had to email sensitive docs as part of security clearance process. the destination email server couldnt use opportunistic TLS and the recipient didnt understand or have tools for PGP de-crypt

so even when it made sense to use PGP, the tools/UX mean it didnt really make sense.

thunderbird is ok at pgp, without being truly seemless. I wouldnt want to rely on it under stress or with low pgp confidence

in reply to evacide

I don't know why anyone would bother with PGP - just use Gmail. I mean, if it's good enough for the US government........
in reply to evacide

it is a tragedy that in 2025 encrypted email is still not usable by mere mortals.
in reply to evacide

what is the best way to send encrypted emails without relying on a specific provider like proton?
in reply to evacide

The FreeBSD Mail admin team still insisted on using PGP the last time I had to ask them to do anything and they required PGP emails signed with the key in the FreeBSD handbook. My flow was:

  1. Create a new PGP key.
  2. Sign the email.
  3. Commit the new public key to the handbook.
  4. Send the email.
  5. Delete the key.

Absolute nonsense security.

in reply to evacide

As usual, you're right. Email was never supposed to be encrypted. It's a decades-old protocol, which is still good for sending out newsletters and other public info.

For sensitive personal communication, there are much more suitable and convenient options with in-built end-to-end encryption.

This entry was edited (1 day ago)
in reply to evacide

**Thank you** !

(My PGP keys are revoked - reason: thing of the past).

in reply to 9x0rg

@9x0rg I've kept using PGP under the rationale that some security is better than no secirity, though @evacide's point is well made and has given me something to think about.
in reply to evacide

I keep my key going for those that want to use it but fortunately that group is also smart enough to use it correctly.

Comically, most of that group are also trusted enough to just have my Signal number.

in reply to evacide

I am not surprised!I deleted my Proton account when the CEO started praising fascists, but they made PGP simple to use. 😿
in reply to trunc8ed

The number of people who have emailed my EFF account from their Proton account thinking that they were sending me an end-to-end encrypted email would surprise you.
This entry was edited (1 hour ago)

This website uses cookies. If you continue browsing this website, you agree to the usage of cookies.