[117310] in Cypherpunks
Re: Its the GUI, stupid
daemon@ATHENA.MIT.EDU (Anonymous)
Tue Aug 31 11:01:55 1999
Date: Tue, 31 Aug 1999 16:28:43 +0200 (CEST)
Message-Id: <199908311428.QAA26790@mail.replay.com>
From: Anonymous <nobody@replay.com>
To: cypherpunks@toad.com
Reply-To: Anonymous <nobody@replay.com>
>>>>> mgraffam <mgraffam@idsi.net> writes:
> On Tue, 31 Aug 1999, Anonymous wrote:
>> If a computer user doesn't understand the *general* principles
>> behind public-key cryptography, there's no point in providing a
>> fancy GUI to hide the messy details
> Horseshit... If Joe User can communicate with a web site securly
> without knowing dick about crypto, there is no fundamental reason
> the code couldn't be developed to communicate with Jane User just
> as easily and securely.
We were talking about PGP, a particular stand-alone encryption
programme; not about SSH or other embedded crypto applications.
And I still maintain that unless a user understands some *general*
principles behind PGP --
- "Why Do You Need PGP?"
- What are public and secret keys? Why are there two keys?
- What is a passphrase? Why do I need one? How do I choose one?
- To whom do I send my public key?
- To whom do I send my secret key?
- What is a keyring?
- How do I manage my keys?
- What is a key certificate?
-- a fancy GUI front end won't do a thing to help him effectively use
PGP. I'm quite confident that a poor user interface isn't the thing
that's kept PGP from general use by Joe Sixpack and his rich cousins.
Folks who don't want to learn anything about the subject would be
better served by MTA-based solutions administered by someone with a
clue. As Eric Murray pointed out,
``Either way, the purpose is to make the encryption/decryption
automatic as far as the end-users are concerned. It's hard enough
to get some corporate officers or marketing people to understand how
a regular email programs works or to pick good passwords. Educating
them on how to use PGP is like herding snakes. So automating the
process is a good thing.''
Widespread deployment of un-GAKed crypto, as quickly as possible, is
probably a Good Thing. And PGP is not the answer to *that* problem.
