So Snowden got his year of asylum in Russia earlier this week, which every single tech and news site on the planet has already written eight versions of, so Im not going to rehash the geopolitics here. Youve read it. What I actually spent my Saturday doing, instead of anything productive, was trying to set myself up with PGP for the first time since maybe 2009, and I want to talk about that instead because holy hell, it is still such a pain.
Heres the thing that got me started. A friend of mine, the paranoid one who always has an opinion about routers, sent me a message Wednesday night that just said "we should probably start encrypting our email, yeah?" and I said sure, mostly to be polite, and then didnt think about it again until Saturday morning when I actually sat down to do it.
I run Thunderbird still (dont judge me, I like it more than Mail.app) so the obvious path was Enigmail. Downloaded it, no problem, thats a five minute install. Then GPG itself. On my Mac that meant GPGTools, which bundles GPG Keychain and a Mail.app plugin I didnt need since Im not using Mail.app, but whatever, it also drops the command line tools in and thats what Enigmail actually talks to.
Generating the key was where things got slow. Not slow like "confusing," slow like literally slow. It wants entropy to generate a proper key and it tells you to go move your mouse around or type random stuff to build up randomness in the system pool. I sat there for probably four minutes opening and closing Finder windows like an idiot because the progress bar just would not move. I ended up starting a big file copy in the background because apparently disk activity feeds entropy too, and that got it unstuck. Nobody tells you that part. You just have to already know it, or read some ten-year-old forum post where someone else already figured it out, which is basically how I solved it.
4096-bit key, RSA, set it to expire in two years because that seemed responsible. Fine. Now the actual encrypting part.
I sent my friend my public key attached to a plain email (yes I know, chicken and egg problem there, I dont have a great answer for it) and he imported it and sent me his back. Cool, so far so good. I wrote him a test email, hit the little padlock icon in Enigmail, and it just... sat there. Turns out I hadnt set a passphrase properly and it kept prompting me through a pinentry dialog that looked like it was designed in like 1998 and rendered slightly wrong on my screen, text overlapping the box edges. Got that sorted after restarting Thunderbird twice.
Sent the encrypted email. He calls me on the phone, not text, an actual phone call, and says "it didnt work, I just got a wall of garbage text." Which, yes, thats what encrypted mail looks like if your key isnt set up right on the receiving end, but explaining PGP over the phone to someone who is also fumbling through GPG Keychain at the same time is genuinely one of the more absurd tech support experiences Ive had this year. We were reading fingerprint strings to each other out loud like we were exchanging nuclear launch codes. Eventually figured out he'd imported an old key from years ago that had gotten cached somewhere and Enigmail was picking that one instead of the new one.
By the time we actually got a message to decrypt cleanly it was almost 5pm and I had accomplished exactly one encrypted email exchange that said, in full, "testing testing ok this works." Four hours. One email. And Im someone who is at least reasonably comfortable with a terminal.
I dont think this is a knock on GPG specifically, its more that nothing about the tooling has meaningfully improved in the fifteen-ish years its been around. The concepts are fine. Public key crypto isnt hard to explain in principle. But every single step, from entropy to keyservers to figuring out why your mail client picked the wrong key out of your ring, assumes you already half know what youre doing before you start. Regular people are not going to do this, full stop, no matter how many stories run this month about who is reading what. My friend, who is genuinely more paranoid about this stuff than I am, was ready to just go back to texting by the second phone call.
Anyway. My key is up on the MIT keyserver if anyone wants it, fingerprint available on request, and Im entirely unconvinced Ill remember to actually use this for anything beyond one more test email sometime next week before it quietly falls out of my routine like it did in 2009.