I wonder how would one encrypt a conversation between say 15 people.
gpg -e -r recipient1@example.com -r recipient2@example.com
That products some ciphertext which can be decrypted by either recipient.
If you get a new public key for someone, and it's signed by someone else you don't know (most of the time this is the case) are you going to bother to utilise that signature to increase the trust? No. Are you going to assume increased trust somehow regardless? Yes. FAIL.
Modify it further, if it is signed by someone you do know what are the chances your UI is going to give you any sort of indication that this is more trusted that other message workflows? And if it doesn't give you any indication (most leave it up to you to check) who's gonna bother to look just passed "your friend <yourfiendsname@company>" ASCII and actually check the key? no one. FAIL.
PGP WoT fails miserably.
On a related note, I have a hard time understanding why a web site talking about digital security also doesn't have a certificate.
This may be true (I really have no idea) but isn't it like travelling on a highway at night with your normal lights turned off because you have a better system based on infrared? After reading about the story of that guy who hacked into a computer by MITMing the notepad++ site, I became even more convinced that all pages must have certificates. Nowadays it's also possible to get a basic ssl cert for free, I can't figure out what the catch is really.
gpg -o encrypted_file.gpg –encrypt -r original.file
# they didn't put recipient after -r ?gpg -e file
The output will be file.gpg. It will ask you for a recipient unless you have "default-recipient" or "default-recipient-selt" set in gpg.conf.