An Encryption User Story
I’m a user and I have a problem. I can’t send a file to my friend. It’s a report with confidential data in it. I don’t want anyone but my friend to be able to read it.
- A computer with internet access.
- A public Twitter account. My friend follows me on Twitter.
- A Google Drive account. I can upload files there and my friend can use the link to download the file.
- My documents are sensitive, and I don’t trust Google not to scan them.
- I assume that Twitter reads, stores and publishes my tweets. I assume that my tweets are not modified before being published publicly.
- I have basic computer literacy skills, but I am not technical, and do not enjoy using computers. I did download Firefox after hearing that it was better for my privacy than Google Chrome.
How can I send the report to my friend?
I think that the story above represents a genuine use case that isn’t being met by software today. PGP is an obvious solution to the problem, and it’s the solution that I would likely choose. Unfortunately, PGP is a complete nonstarter for nontechnical people. It is notoriously difficult to use, and a number of high profile cryptographers have given up on using it completely.
Signal is probably the option with the most promise. It’s the solution that likely has the highest chance of success with normal computer users. However, the phone number requirement and focus on messaging first makes it awkward to use in a desktop computing setting.
There are also a number of other encryption applications that might do the job. But many are either closed source or lack essential features like authentication.
I believe that a better solution to this problem can and should exist. I would like to take the knowledge that I’ve learned studying cryptography over the past few years to help make that a reality.