Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Encrypted email is still a pain

incoherency.co.uk

Post reply on HN
Print view View original

81–90 of 450 posts

Re: Encrypted email is still a pain

#81

Post by pmlnr »

drdaeman wrote: post #76
pmlnr wrote: post #63

Earlier quoted context omitted.

I've been running my email server for a decade without serious glitches. Setting up my own federated XMPP instance is much more problematic and people are already complaining about how hard email is. I'd love to see an up-to-date tutorial that opposes my statement, eg. setting up prosody (or something lightweight) on debian (or similar) with multiple domains for multiple accounts, sending and receiving test messages…

> Setting up my own federated XMPP instance is much more problematic Actually, I believe it's the contrary. With email you have to obtain a valid TLS certificate, set up SPF, DKIM, and keep eye on the DNSRBLs so you're in good standing. And if Big Company's mail service suddenly decides they don't like you, it won't help. Oh, and spamassasin/rspamd/milter/greylisting/etc stuff so your email server doesn't get thousan…

> XMPP has less adoption, spam exists but is much rare, so there's less stuff to do. Install a package, get a TLS cert, publish an SRV record (IIRC that's not even strictly required), and that's it. A bit fewer steps.

That's what I thought as well. Please link tutorial on this.

Re: Encrypted email is still a pain

#82

Post by clishem »

jstanley wrote: post #57
cookie0 wrote: post #15

Your key is not importable :D $ gpg --import stanley.asc gpg: CRC error; C68D2A - 29357C gpg: read_block: read error: Invalid keyring gpg: import from `stanley.asc' failed: Invalid keyring gpg: Total number processed: 0 Edit: Your key is way too short.

This was my mistake! It's not too short. I search-and-replaced my h2 tags with h3, which broke the key. Oops. I've fixed it now.

What a shitfest.

Re: Encrypted email is still a pain

#83

Post by drdaeman »

tptacek wrote: post #22
pmlnr wrote: post #14

Earlier quoted context omitted.

> But: why bother? Email is just one of dozens of messaging systems available to Internet users. No, it's not. It's the only widely available, decentralized system, with which you can send to anyone, if you know the address. None of the big ones is this open. XMPP tried to address this and failed; now Matrix is trying again.

WhatsApp has over a billion users. There are big places where its market share exceeds that of SMS --- another big centralized service that has a userbase comparable to that of email. My conclusion is that the people who care about "decentralized" systems are a rounding error. I care about non-technologists managing to send asynchronous messages to each other that are well-encrypted by default. That's a solved proble…

Isn't it also true that the people who care about "secure" systems are a rounding error?

Average Joe is perfectly fine with just "100% secure" label. Add some "military grade hurr durr" nonsense (okay, maybe it's a bit outdated buzzword) and Joe's even willing to pay for it. No need for any actual security.

Re: Encrypted email is still a pain

#84

Post by tptacek »

pmlnr wrote: post #80
problems wrote: post #62

Earlier quoted context omitted.

> No, I fully understand the problem. If Google Mail vanished tomorrow, a pretty large number of people would probably stop emailing altogether. The number of people for whom that's true increases every year. I highly doubt that's true. Email is pretty essential to the functionality of the internet, from signing up accounts to getting notifications, to just plain discussions with professionals. It's pretty much the o…

re @tptacek > Every year, the number of people and businesses that rely on email gets smaller --- in the last 5 years or so, by something like 15%. Are you sure that's not just the spam decreasing?

Yes.

Re: Encrypted email is still a pain

#85

Post by jecxjo »

bpicolo wrote: post #8
nmat wrote: post #5

Earlier quoted context omitted.

> little green lock === safe Which is not true. Little green lock means the site has HTTPS, being safe requires much more than that. Security is hard to explain.

Of course, but this is nonetheless the view for typical end users.

And THIS is the problem. Yeah the app is a pain to install, but security is a mindset, not just an app.

I even wonder how many people download an ISO or installer from a website, and do any sort of due diligence to find the signer's key from another 3rd party location, then verify previous builds, or require multiple signers of a key to give any semblance that the key is not fake? Or do we all just download the ISO and the .iso.asc file from the links provided and call it good? Even security minded people can be lazy in this situation.

Re: Encrypted email is still a pain

#87

Post by mikecb »

lmm wrote: post #60
tptacek wrote: post #56

Earlier quoted context omitted.

What on earth could you possibly be talking about? No cryptosystem has proven itself less capable of standing up to state-level adversaries than email, and nothing demonstrates that more clearly than the progenitor of this "cultural moment", the saga of Edward Snowden.

Plaintext email doesn't resist state-level adversaries. Email with OpenPGP does.

If you are an active target of a tier 1 state, your endpoint will be compromised, your decrypted communication will be read, and no cryptosystem will prevent this.

Re: Encrypted email is still a pain

#88

Post by problems »

pmlnr wrote: post #81
drdaeman wrote: post #76

Earlier quoted context omitted.

> Setting up my own federated XMPP instance is much more problematic Actually, I believe it's the contrary. With email you have to obtain a valid TLS certificate, set up SPF, DKIM, and keep eye on the DNSRBLs so you're in good standing. And if Big Company's mail service suddenly decides they don't like you, it won't help. Oh, and spamassasin/rspamd/milter/greylisting/etc stuff so your email server doesn't get thousan…

> XMPP has less adoption, spam exists but is much rare, so there's less stuff to do. Install a package, get a TLS cert, publish an SRV record (IIRC that's not even strictly required), and that's it. A bit fewer steps. That's what I thought as well. Please link tutorial on this.

Just install prosody and open up the config file. It includes lots of comments and I believe there's even a web admin interface you can enable.

XMPP SRV record documentation can be found here, if you need to use it:

https://wiki.xmpp.org/web/SRV_Records

If you're finding the documentation to be insufficient, let me know, I might write something more detailed up.

Re: Encrypted email is still a pain

#89

Post by lmm »

tptacek wrote: post #64
lmm wrote: post #58

Earlier quoted context omitted.

People who care about encryption are a rounding error too. I care about non-technologists managing to send asynchronous messages to each other that are not controlled by a centralized entity (especially not one based in a country who's interests are often adverse to my own). That's a solved problem that you seem to be trying very hard to unsolve.

That's exactly the point. Take a step back and think about what you just said. It's true: most people don't care about crypto. But here's are two other true statements: * In modern messaging protocols, they don't have to care about encryption. The protocols are designed to reliably encrypt messages without user intervention, and security isn't "opt-in". * The people who most need encryption are not the ones who are m…

> In modern messaging protocols, they don't have to care about encryption. The protocols are designed to reliably encrypt messages without user intervention, and security isn't "opt-in".

Sounds good. Doesn't sound worth giving up decentralisation for. Doesn't even seem like something we'd need to give up OpenPGP to get - if client design were equal (and it isn't at the moment, but I see no reason it can't be) I'd far rather have that client experience but with the more established/tested protocol.

> The people who most need encryption are not the ones who are most aware of the need. In fact, the Venn diagram of "need" and "want" for crypto has very little overlap.

I think that's even more true for decentralization than it is for encryption.

Re: Encrypted email is still a pain

#90

Post by problems »

tptacek wrote: post #75
problems wrote: post #62

Earlier quoted context omitted.

> No, I fully understand the problem. If Google Mail vanished tomorrow, a pretty large number of people would probably stop emailing altogether. The number of people for whom that's true increases every year. I highly doubt that's true. Email is pretty essential to the functionality of the internet, from signing up accounts to getting notifications, to just plain discussions with professionals. It's pretty much the o…

Three responses: * Email remains important for middle-class Americans because it's used for business. But that is a small subset of the whole population, including very large numbers of Americans. * For almost all those users, email might as well be a Google, Yahoo, or Microsoft product. * Every year, the number of people and businesses that rely on email gets smaller --- in the last 5 years or so, by something like…

> * Every year, the number of people and businesses that rely on email gets smaller --- in the last 5 years or so, by something like 15%.

If that's true then where's that stat from and how are these businesses getting contacted online?

There's no decent replacement for email in that department at all to my knowledge.

Post reply on HN