I read the federal government’s Zero-Trust Memo so you don’t have to

>WhatsApp has been wildly successful, my very non-technical in-laws use Signal for their family's conversations, and other messaging platforms are jumping on the bandwagon.

You only get effective end to end encryption if you can verify that you are talking to who you think you are talking to. Otherwise the people that are running the system can cause your messages to take an unencrypted detour and thus be able to read them. This is often called a man in the middle attack. Verifying identities normally means checking some sort of long identity number. Very few people know how to do that in an effective way.

For example: in a usability study involving Signal[1], 21 out of 28 computer science students failed to establish and maintain a secure end to end encrypted connection. The usability of end to end encrypted messaging is a serious issue. We should not kid ourselves into thinking it is a solved issue.

PGP in a sense is actually better here in that it forces the user to comprehend the existence of a key in a way where it is intuitively obvious that it is important to know where that key came from.

[1] https://www.ndss-symposium.org/wp-content/uploads/2018/03/09...

To call encrypted messaging a complete failure you have to demonstrate that the percentage of people capable of maintaining secure messaging is stagnant. As far as I can see, the opposite is true. It is easier than ever to establish and maintain a secure communication channel.

The Signal study showed that the majority of people were unable to understand Signal's security features, but not that the security model is broken. The question at hand isn't how many people are using it wrong but how many people are using it right that never could have managed to do so with PGP keys. If even 10% of Signal's users successfully maintain a secure channel, you're looking at around 5 million people, most of whom probably would not have been able to set up secure messaging without Signal.

Do we still have work to do? Of course! But that doesn't mean that we've failed in our efforts so far.

That assumes that usability is actually getting better. There is no evidence that this is the case from usability studies. This is not a new problem and we have known what is wrong for something like 20 years now. This isn't something I just thought of. See: Why Johnny Can't Encrypt[1].

[1] https://www.usenix.org/legacy/events/sec99/full_papers/whitt...

[1] https://people.eecs.berkeley.edu/~tygar/papers/Why_Johnny_Ca...