Getting the Tech Community to Adopt Encryption
1 comments
One tip: make it dead easy to set up. Look at the Text Secure app: you can first pair with just a click, and everything is handled automatically through SMS. Nothing to type. The verification part is a bit more involved, but easy to do with QR codes.
The real problem with end to end security and things like email is that you cannot automate it without a central authority. You will still need to exchange keys at one time, and making that secure is hard.
If you are ready to make compromises, you could set up email clients so that they always send their public key in a header somewhere (or a pointer to their public key). You would not be sure on the first exchange that it is really the person you are talking to, but you would get the assurance that future messages come from the same person.
The real problem with end to end security and things like email is that you cannot automate it without a central authority. You will still need to exchange keys at one time, and making that secure is hard.
If you are ready to make compromises, you could set up email clients so that they always send their public key in a header somewhere (or a pointer to their public key). You would not be sure on the first exchange that it is really the person you are talking to, but you would get the assurance that future messages come from the same person.
The first I've found is Silent Circle (https://silentcircle.com/web/home/), which provides end-to-end encryption for a variety of services. Does any have experience and knowledge of its reliability, or a suggestion for a better service?