IdeaWell

Project ideas from Hacker News discussions.

Why I Wrote PGP (1991, revised 1999)

Original Article

Hacker News Discussion

📝 Discussion Summary (Click to expand)

1. PGP’s monolithic, “jack‑of‑all‑trades” design is outdated and a security liability

“There's a good idea in PGP, and a very bad one. … The bad idea is a tool with PGP's design, of ‘cryptographic jack‑of‑all‑trades’. PGP's design has aged like milk, and PGP itself is a security liability in almost every system that hosts it.” – tptacek

2. Usability problems keep PGP from widespread adoption

“The biggest issue of using PGP was using PGP. … Exchanging keys was problematic. Writing text in one app, encrypting in another app, copying encrypted back to an email was just tiresome.” – dylan604

3. The community pushes for purpose‑built, freely available alternatives

“Good ideas demand to be free. =3” – Joel_Mckay
(See also recommendations for replacements such as Signal, stateless sqop, XMPP+OMEMO, etc.)

🚀 Project Ideas

Generating project ideas…

KeySync: Decentralized PGP Key Management via WebAuthn and QR

Summary

  • Solves the painful key exchange and synchronization problem by letting users store PGP keys in a browser‑protected credential store and share them via QR‑code or WebAuthn attestation.
  • Core value proposition: one‑click, phishing‑resistant key distribution that works across devices without manual file handling.

Details

Key Value
Target Audience Developers, journalists, and privacy‑conscious professionals who need to manage PGP keys across laptops, phones, and hardware tokens
Core Feature Browser‑based key vault that exports/imports keys using WebAuthn‑protected credentials and optional QR‑code transfer for offline exchange
Tech Stack WebAssembly‑compiled OpenPGP.js, WebAuthn API, IndexedDB, optional Node.js sync server (optional self‑host)
Difficulty Medium
Monetization Revenue-ready: Subscription $5/user/mo for team vault and audit logs; free tier for individual use

Notes

  • HN users complained that “PGP identities come in the form of a file… lots of people don't have the concept of that anymore” (upofadown) and wished for a simpler workflow (boomlinde).
  • Provides a concrete usability improvement that could revive PGP adoption while addressing the “key database is an implementation detail” pain point.

ModularCrypto CLI: Task‑Specific Cryptographic Toolkit

Summary

  • Replaces the monolithic “one tool to rule them all” PGP approach with separate, auditable command‑line utilities for messaging, backups, and package signing, each built on modern primitives like libsodium/age.
  • Core value proposition: developers get the right crypto tool for the job without the legacy attack surface and confusing options of PGP.

Details

Key Value
Target Audience Sysadmins, DevOps engineers, and open‑source maintainers who need secure signing, encrypted backups, or ephemeral messaging
Core Feature Three focused CLI commands: msgenc (forward‑secret messaging), bakenc (content‑addressed deduplicated backups), sigpkg (transparent‑log package signatures)
Tech Stack Rust (for safety) + libsodium/age crates, Clap for CLI, optional WASM build for browser use
Difficulty Medium
Monetization Hobby

Notes

  • Commenters noted “PGP solves basically none of these problems… for messaging you want forward secrecy… for backups you want deduplication… for packages you want transparency logs” (tptacek).
  • A modular toolkit directly answers the call for “separate problems with their own cryptography” and would likely spark discussion on HN about best practices for each use case.

InlineEncrypt: Open‑Source UI Library for Transparent E2EE in Email & Chat

Summary

  • Provides a drop‑in React/Vue/Svelte component that handles key generation, storage, and transparent encryption/decryption inside existing email or chat UIs, eliminating the need for external copy‑paste steps.
  • Core value proposition: end‑to‑end encryption becomes invisible to the end user, boosting adoption without requiring them to manage keys manually.

Details

Key Value
Target Audience Product teams building webmail clients, internal communication platforms, or SaaS applications that want to offer E2EE as a feature
Core Feature UI wrapper that auto‑encrypts outgoing plaintext using stored OpenPGP.js keys and auto‑decrypts incoming ciphertext, with optional biometric lock
Tech Stack TypeScript, OpenPGP.js (wasm), IndexedDB/Web Crypto API, framework‑agnostic UI kit (React hooks)
Difficulty Low
Monetization Revenue-ready: Dual‑license – free GPL for community, commercial license $2000/year for proprietary embedding; optional hosted key‑management SaaS

Notes

  • HN thread highlighted usability barriers: “writing text in one app, encrypting in another app, copying encrypted back to an email was just tiresome” (dylan604) and the desire for “a E2EE usability standard” (upofadown).
  • InlineEncrypt would directly alleviate those frustrations and give commenters a concrete library to integrate and discuss, likely generating substantial interest and practical adoption.

Read Later