[Cryptography] Avoiding PGP

[Dave Howe]

On 19/03/2018 07:38, Neuhaus Stephan (neut) wrote:
> +2. Just this week I had the devil of a time finding out which of two
> keys (containing the same email address) Enigmail was using for
> encryption and it took me some shell-foo to find and eliminate the
> unwanted key. My grandma (if she were still alive) would probably not
> have managed that. 
Odd - Enigmail has a key manager that is the typical point-and-drool
solution for this - Enigmail->key management gives you your keyring,
picking the right certificate (using the key ID shown) and selecting
"create per-recipient rule" lets you force which key will be used for
that target, if there are multiple possible keys.

Can't speak for your grandmother's technical ability of course, but
Enigmail is reasonably decent for this.

> This problem also occurs with X.509-style PKI. People simply substitute "I'm not checking the WoT" for "I'm not checking the certificate". See, e.g., https://www.usenix.org/system/files/login/articles/105484-Gutmann.pdf, which also wins the prize for the article with the shortest abstract so far. Clearly, CAs also don't necessarily always validate the key, so it's not clear that substituting a CA for the user gets you anything.
This is true of course (although the gutmann paper is for SSH) - SSH at
least will take some of that load from you, by remembering the key and
alerting you if it changes; I seem to recall most email clients do that
for s/mime certs if you are explicitly trusting them, but again, can't
force you to actually check them.  Not sure that doesn't apply to ANY
solution though, as it is a people problem, not a technical one; there
was a big deal made about how, if new keys are added to the Signal
engine as implemented in the whatsapp client AND there are pending
sends, it will send to the new key before asking you to approve the new
key... but that would only be distinction if people didn't just approve
new keys on sight, and actually bothered checking first that they were
valid.

Users don't read dialogue boxes, they just look at the bottom for which
button makes them go away.  Trying to make software that makes smart
choices because users won't is a worthwhile endeavor, but a great deal
of unappreciated work.