Sunsetting PGP

TL;DR: I’ve been supporting PGP since around 2012. The number of encrypted or signed messages I receive haven’t been high to begin with, and have only decreased since. It’s time to let it die.

I like privacy. I enjoy having conversations with people on and over the Internet without having to worry that someone is eavesdropping on what we’re talking about. Even if it’s nothing more than a constant stream of shitposting.

When I became interested in information security during my teenage years, instant messengers were slowly but steadily dying. MSN Live Messenger wasn’t shut down yet (if I remember correctly that took until 2012), but barely anyone used it. The same thing was happening with ICQ, the other popular messenger in my corner of the world at the time.

And while I started out enthusiastic (both out of actual enthusiasm and post-teenage edginess), I stopped telling people to use PGP a long time ago. It might be cool technology still, and it might

I was enthusiastic about PGP (both out of equal parts actual enthusiasm and post-teenage edginess) when I first came into contact with it. I was even lucky enough to end up in a place of work where PGP was used regularly.

However, over time, that enthusiasm has waned until it eventually vanished altogether. These days I’m far from recommending PGP to people, actually rather trying to disuade people from it for most use-cases.

The reason for that change is PGP has issues on all fronts.

I’m not a cryptographer, but even to me there are blatantly obvious problems that haven’t been adressed - or, in some cases, can’t even be adressed, because they stem from faults in the structural design of PGP.

I’m talking about the lack of forward secrecy, metadata leaks, broken authentication (you can simply remove the last 22 bytes of ciphertext to strip it off, without breaking the message)

But while these are bad, they aren’t the main problems. The issues I just described aren’t the reason PGP never really took off outside a small number of certain crowds.

I, in a professional capacity, have had people send me their private key instead of their public key more thance once. Even the Adobe PSIRT managed to fuck this part up, accidentally publishing ther private key in 2017.

My favourite comment on the usability (or lack thereof) of PGP comes from Ted Unangst, in a paper about signify, in which he wrote:

There was a PGP usability study conducted a few years ago where a group of technical people were placed in a room with a computer and asked to set up PGP. Two hours later, they were never seen or heard from again.

PGP is not dead to me. I’ll continue using it to sign git-commits, and it will (in combination / cooperation with my Yubikey) remain my daily driver for authenticating against my servers.

But for communication it’s been dead for years, and there is no chance of a resurrection happening any time soon (or late, for that matter). There’s no point in pretending otherwise. I received my last encrypted / signed digital mail in 2020. And that, at the time, was the first one I had received since the beginning of 2019. So .. yeah. There’s not really a point in continuing to support it.

I have already removed the link to my PGP-key from the “About” section of this site. Farewell PGP. You will, kind of, be missed.