I looked at Vaultlet, igone and r.p.ruiz, and sadly, it seems Vaultlet is comparing itself to PGP in earlier versions, such as PGP v.5 or v.6.
I will not offer any comment on PGP v.7, as not even PGP's original developer, Phil Zimmerman, would make a statement of PGP v.7 -- saying it was free of backdoors or gateways for NSA, CIA, or other alphabet soup agencies to sneak in an monitor a user's actions. In fact, Phil left NAI, Inc., which owned the rights to PGP during the PGP v.7 days.
Since PGP v.8, though, the process for installing, using, and kicking PGP has become much simpler. In fact, PGP v.9 has been made so easy to "install and forget about it" that all the people I encouraged to try it, people who were looking for a solution, were surprised how simple it is.
To install it, the process is much like any other program. Click the icon, select your installation directory, and choose your email client(s). You let PGP know if you have existing keys or if you are a new user. If you're a new user, it pops up a screen to create a new key, then automatically uploads the key to keyservers.
After a restart, PGP v.9 automatically monitors specific ports on your computer, checking for incoming and outgoing email. It scans and monitors for signatures in email and documents, then verifies the signings on the documents or email automatically, and adds a message if the signature is valid or not.
Most everyone who uses PGP v.9 stays with it. There are very few people -- and I've talked with more than 400 people about it now about just this specific version -- and only a handful have
notnot opted to keep it and/or use it. Then again, these people are not using any other product now, either. They "don't really see the need" for encryption, validation, and other features in PGP.
I've played wit5h Vaultlet on one machine and a laptop. It didn't do anything that PGP and the Enigmail and GPG combination can't do. In fact, there are things that it cannot do that PGP and the Enigmail and GPG combination
can do.
First, to use it, you must allow Java to run.
"Requires Java Runtime v1.4.2++" -- from
https://www.vaultletsoft.com/products/index.html
Only uses 2048-bit RSA public key. RSA is old. Yes, it hasn't been cracked, and yes, a 2048-bit key is strong, but I prefer the newer Diffie/Hellman, but I also like stronger keys. By default, until a year or so ago, the "default" size for any key in any encryption tool, such as PGP, GPG, etc., was 1024. That's fine, but why stay with something everyone else uses?
In today's society, it should be the norm, but sadly, it isn't. Yet.
If you're looking at encryption, you should look for strength. As I said, RSA is good, solid, and hasn't been cracked. But DH/DSA is newer, stronger, and RSA is referred to as "legacy," just like Windows98 and Windows2000 are referred to as "legacy" operating systems.
For my keys, the weakest key that I use is 2048, but that's my "default" public key I use for signing all my "standard" email. When it comes to sensitive documents, or anything where I am discussing something or negotiating terms, I sign with a key that is
not stored in a keyserver, with very limited permissions, and has very strong restrictions.
Vaultlet's site also gave me concern when I first read it when it launched, and still does, to this day.
If you visit the site at
https://www.vaultletsoft.com/, you will see a menu at the top. One item in that menu is "About Us" and leads you to a
new page, which should give information about the company, such as where it's based, specific details about the corporation, and who is behind the company. Instead, it is a Question and Answer page, featuring a re-phrased quote from Phil Zimmerman ("Who said that every message must be a postcard?"). There's nothing on that page that would convince me this is a sound product, backed by people who are serious about encryption, involved with a corporation of reputable standing.
Using Java raised my red flags. I don't allow anything Java-based to run without permission. Paranoid? Not really. But let's say that I've only had one virus hit any computer I've ever used in over 25 years of using computers. That happened in a work environment, back in the early 90s, on a machine that was used by three people. Someone brought in a floppy from home and the employer was too cheap to install anti-virus software. But allowing anything java to run, freely, unchecked, also presents far too many possible malicious issues. For more information, although from a less-than-clearly written source, check out
Java Security Basics. So, in essence, someone running a site, telling me to use this Java-based encryption suite, and that I must trust them with potentially confidential or worse, very sensitive and/or personal or corporate information, but provides absolutely no information about who they are, at a very minimum, is a major red flag for me.
Next, the site pushes "vanishing" email. Sure, that sounds "cute," and yes, a couple of similar sites use this same concept, but what's the use, especially in business? If you're Martha Stewart, sure, you may have wanted to use this before your investor gave you some close-to-the-chest info, but other than that, you do not want vanishing email. Well, maybe you do. Take a look at Apple and the "restating" of options. Vanishing email where questionable ethics come into play may be cool. In a professional, ethical environment, especially in a non-profit environment where transparency should be the rule, this is
not the answer. In fact, it's the antithesis of what one should ever consider.
If you're a terrorist, this is exactly what you want. After Osama bin Laden sends you the message, he gets the confirmation receipt you read the message. You message magically vanishes after you read it, per his option to have that happen when he created the message, and there's no proof of anything. Yep, this sounds exactly like what ethical business people want to use in their offices for the conduct of business.
To carry encrypted files, passwords, or "encrypted drives," even ones where you decide the size, such as five megs or two gigs -- is all possible in PGP, as well. As I said, in PGP v8 and PGP v9 (the current version), this is all very simple, and has been since PGP 8. In fact, PGP 6.5 and the various hacks of it, including PGP6.5.8(ckt) had terrific implementations and was feature-rich. In terms of usability, many people new to encryption could learn to use it with very little practice. Sure, you may have had to read just a little to understand a few terms and concepts, but past that, it was fairly straightforward. That's when the graphical user interface (GUI) was strongly becoming integrated into the product.
In today's PGP, though, everything is drag-and-drag when you must use the GUI. Most things, as I said, are done like anything else in Windows (and I believe Mac, but since I don't have one, I can't say authoritatively, but rely on what I hear), it's a simple right-click and you're done.
Disclaimer: Aside from being a long-time user of PGP, and a publicly-known PGP user for about five years or so, I have no ties or affiliations with PGP. I also receive no funding, compensation, or gratuities from PGP or any other company involved in security and/or encryption. I firmly believe in the principles that private information should remain private, and am willing to help anyone clearly understand the issues, pro and con, of security, encryption, and such.