So this week's big story, if you somehow missed it, is that the NSA and GCHQ have apparently spent years working to break or backdoor most of the encryption the internet quietly runs on. The Guardian, the New York Times and ProPublica all ran versions of it together on Thursday, and I've read all three pieces twice now and I'm still not sure I've fully absorbed it. It's the kind of story that makes you want to close your laptop and go live in a cabin, except the cabin would probably also have a router in it.
I'm not going to try to explain the whole Bullrun thing here, half the tech press has already done that better than I could, and by the time you're reading this there will be ten more posts doing it again. What I actually did instead, on Sunday, with a pot of coffee and my daughter napping (a small miracle in itself), was finally set up GPG for my own email. I'd been meaning to for about two years. This week gave me the shove.
Here's roughly what that involved, in case you also want to feel briefly paranoid and productive at the same time.
Getting GnuPG installed
I'm on a Mac, so this was brew install gnupg and then a wait while Homebrew pulled down a pile of dependencies I didn't ask for and don't fully understand. If you're on Windows, Gpg4win is the usual route. Ubuntu people, you almost certainly have GnuPG already sitting there unused, which feels about right.
Once it's in, you generate a keypair with gpg --gen-key. I went with RSA and RSA, 4096 bits, no expiration (probably a mistake, everyone says set an expiration, I did not listen). It asks for a passphrase and I typed something long and dumb-looking that I will absolutely forget by December.
Enigmail, or: making Thunderbird do something useful again
I still run Thunderbird for one of my email accounts, mostly out of habit, and the Enigmail add-on bolts GPG support right into it. Once it's installed you get a little padlock icon and a way to sign and encrypt messages from the compose window. Setup wizard walks you through pointing it at the key you just made. Took maybe ten minutes.
Then I uploaded my public key to a keyserver (pool.sks-keyservers.net, if you're wondering) so it's actually findable, and that's where the whole exercise quietly falls apart.
The actual problem
Nobody I email regularly has a public key. Not one person. I sent a test encrypted message to a friend who works in, of all things, information security, and he replied "cool, give me like an hour" and then never set his up. My mom does not need to know what GPG stands for. My editor for the freelance stuff I do on the side would just reply asking why the email looks broken.
Encryption you can't use with anyone is a neat little padlock on an empty box. That's the part nobody selling you on "just use PGP" wants to sit with. It's not that the tools are impossible, Enigmail genuinely isn't bad once it's configured, it's that the entire thing only works if the person on the other end has also spent their Sunday doing this, and basically nobody has.
Worth mentioning too: Lavabit, the encrypted email service Edward Snowden reportedly used, shut itself down back in August rather than comply with a government order it wouldn't disclose, and Silent Circle pulled the plug on its own encrypted email product within days of that, specifically because they figured they'd be next. So even the people building purpose-made secure email decided the safest move was just not offering it anymore. That's not exactly a ringing endorsement for the rest of us fumbling around with keyservers on a Sunday afternoon.
I'm keeping my key set up anyway. Signed my last two blog-related emails with it just to see the little "Good signature" message pop up, which is a strange thing to find satisfying but here we are. If you want to send me something encrypted, my key's on the keyserver under this email address, good luck getting me to check it more than once a week, though, because that's the other unglamorous truth about all this. The crypto isn't the hard part. Remembering it exists is.