Even the Inventor of PGP Doesn’t Use PGP

If you've ever tried to learn how to send an encrypted email, you know it's a painful, easy-to-fuck-up process. To use a popular buzzword in Silicon Valley-speak, it's anything but "frictionless."

So much so that even Phil Zimmermann, the person who invented what is still probably the most famous technology for encrypted communication—PGP, or Pretty Good Privacy—doesn't use his own brainchild.

On Tuesday, in an email to security researcher Joseph Bonneau, Zimmermann said he couldn't decrypt the original message because he didn't "have a version of PGP that runs on any of my devices."

Email from Phil Zimmerman:

Joseph BonneauSeptember 1, 2015

I reached out to Zimmermann, via unencrypted email, to get to the bottom of this. Zimmermann himself admitted that this whole thing is, well, a little ironic.

"The irony is not lost on me," he wrote, after explaining that the main reason he doesn't use PGP is that he can't run it on his MacBook since Symantec bought PGP in 2010, and "no version of PGP ever ran on an iOS device." (It's also worth noting that the PGP key associated with the email address displayed on Zimmermann's official site is dated 2001 and is only 1024 bits, which is believed to be an insecure length.)

The good news is that it's possible to do email encryption on a Mac using GPG Tools, a suite that uses the PGP's free software replacement, GNU Privacy Guard. In fact, Zimmermann told me he's going to try it too.

"I do plan to get GnuPG for my MacBook, Real Soon Now [sic]," he said, explaining that he hasn't yet because he hasn't had time to learn how to set it up.

The bad news is that it's not that easy to pull off email encryption on a phone or mobile. Most security experts I've spoken with have told me it's a bad idea to try to do PGP on a phone because it's harder to handle encryption keys securely in a phone, and there aren't that many services that allow you to use PGP or GPG on iOS or Android to begin with.

So if you are like Zimmermann (his emails to me came either from an iPad or his iPhone, according to his signature) you probably won't do email encryption on your phone any time soon.

But it's not just a lack of user friendliness or compatibility. PGP has never taken off among non-techies because it's inherently hard to use, which makes it very easy to make a mistake that nullifies the good crypto behind it. Even cryptographic experts like Matthew Green, or secure communications experts like the Grugq think it's time for PGP to die.

Good. Let PGP die. There are much better solutions available, let legacy 90s crypto fall by the wayside the grugqSeptember 1, 2015

Using PGP is so hard it's even become fodder for Twitter parody accounts.

\

EFF_Is_HipNovember 5, 2013

This is the whole reason why a new wave of more usable, mobile-friendly encryption apps made by Open Whisper Systems, or Zimmermann's Silent Circle, have been taking off in the last few years.

And yet PGP isn't really dead because the crypto behind it is sound. Even the NSA can't break it. That's why Google and Yahoo have been trying to come up with easier ways to implement PGP in their services, and why Facebook has started sending email notifications using PGP encryption.

So yes, PGP is hard, and in some ways, it's outdated. But it dies hard—even if it's own father doesn't use it that much anymore.