How many Webmail Users Actually Use PGP Signatures?

[dbouley]

I was just curious as to how many Vivaldi Webmail users actually use the digital PGP signature/encryption service that Vivaldi devs were so kind to provide for us?

I know that PGP signing of emails is not something most people do. The only digitally signed emails that I get in my in-box are typically from people who subscribe to Linux newsgroups.

But, how about you folks? Anyone here, besides me, who digitally sign their emails? And, if you do, how do you publish your PGP public key-set? I've added mine to my "About Me" page on my Vivaldi blog.

I think it would be nice if Vivaldi added a space for it in our Profile Page, for those of us who would like to make that available to other Vivaldi users.

Your thoughts?

[dbouley]

@guigirl said in How many Webmail Users Actually Use PGP Signatures?:

I'm highly in favour of it, but humanity seems too unmotivated for practical viability.

Yup, I know what you mean. They complain about being victims of email scams or identity theft, yet they refuse to take just the extra step or two to protect themselves. Very few want to take responsibility of their own security or safety. They'd rather put all their trust in "the corporation" or "the government" to protect them from themselves.

Frustrating.

[fjc1029]

I don't (yet) use PGP Signatures in Vivaldi Webmail. For the very reason you mentioned, it's not 'popular' yet. But your idea to include it in our profiles might get those of us who do use V. Webmail to use it more.

I noticed the Email Encryption for V. Webmail is not end-to-end, for this reason I have decided for now not to use it. But I just started using Protonmail to see what it does. I feel it is so popular I would find more people to connect with there who use that platform (which is my thought behind agreeing with you about sharing our public key-set on our Profiles).

Sir Tim Berners-Lee is now an advisor to ProtonMail, just like he is for MeWe so I try to join those platforms to support his efforts to this thing called the World Wide Web.

[dbouley]

@fjc1029 Yeah, it's one of those things that isn't "mission critical", but an extra step that you can use (or your recipients can use) to help ensure that the e-mails they receive are truly from you.

For friends and family who don't know what PGP is or who aren't technical, I get asked is "what's this ASC attachment for?" I explain it to them as a "security thing" and move on. For those who do know what it is and appreciate it, it's more for their reassurance.

But, as @guigirl implied, e-mail is getting replaced with smart phones and texting, where one's security and privacy aren't all that appreciated (which is why I hardly use it and go out of my way not to use it). I've never been the one to bow to peer-pressure, and I like to throw my support behind others that do the same, when I can.

[A Former User]

@fjc1029 for protonmail specifically (& other providers that automatically use pgp among their users), i’d welcome a possibility to get the public key for any user (based on their address) without having to ask them to send it. since they already store the keys anyway, it’s just about providing them to anyone.

i’m not a big fan of sending the keys myself – first for the reason already mentioned by @dbouley (‘what’s this thing for?’), second because i doubt its security (i believe there are less insecure ways of getting the key, such as what i suggested above – but i’m no expert on that).

[dbouley]

@potmeklecbohdan said in How many Webmail Users Actually Use PGP Signatures?:

for protonmail specifically (& other providers that automatically use pgp among their users), i’d welcome a possibility to get the public key for any user (based on their address) without having to ask them to send it. since they already store the keys anyway, it’s just about providing them to anyone.

I'm not sure if you're aware of it or not, but there is a PGP "directory" where you can upload the public portion of your key and anyone can then search for peolpe's PGP key. I think this is what you were meaning in your post (?).

Of course, the directory is only as good as the people using it. It's up to the individual to ensure their keys are up-to-date and people know to go there to look for them.

[A Former User]

@dbouley i know about key servers, but:

• it’s up to the individuals to upload their keys to some server (so to find one’s key, you’d have to ask them – which defeats the purpose of my suggestion – or scan all keyservers – which is awfully impractical & insecure, as noted in my next point)
• it’s insecure for finding keys, anyone can upload them – otoh, the mail providers have the keys from the correct person and are sure the key is the one they use for e-mail en/decryption