Email cannot be encrypted at rest
migadu.com
Email cannot be encrypted at rest
1–10 of 35 posts
Re: Email cannot be encrypted at rest
#2> at rest
So we're talking about after it's received and processed by a server.
> Email is built on top of plain text protocols and messages flow in plain text. If you encrypt, you cannot scan for spam or viruses...
But you can? Just scan and process before encrypting.
> ...index messages for searching
This indeed is a problem. Encrypting emails individually makes search difficult. Why not just encrypt entire hard drives? Encryption at rest is a very broad term.
> or recover messages when a password gets lost. Not to mention the usability issues of changing passwords and encryption keys.
This has nothing to do with email. This is encryption in general, and these security details are a feature.
> Some other providers automatically encrypt messages as they arrive using users’ public keys. That sounds exciting but in practice that means you cannot access your messages using the webmail unless you pasted your private key into a browser, and have it handled by script and a myriad of third party code. Ouch.
Huh? I haven't heard of copy-pasting private keys. Use passwords. But more importantly, this is specific to webmail, not email in general.
Re: Email cannot be encrypted at rest
#3> at rest So we're talking about after it's received and processed by a server. > Email is built on top of plain text protocols and messages flow in plain text. If you encrypt, you cannot scan for spam or viruses... But you can? Just scan and process before encrypting. > ...index messages for searching This indeed is a problem. Encrypting emails individually makes search difficult. Why not just encrypt entire hard dr…
But you can? Just scan and process before encrypting.
You can't. End-to-end encryption for email means the messages are encrypted by the sending client and decrypted by the receiving client. The server has no chance to scan anything because it cannot decrypt the messages.
Re: Email cannot be encrypted at rest
#4Email can certainly be encrypted at rest, server or client side, maybe not as quickly or with little resources, but it can be encrypted.
Re: Email cannot be encrypted at rest
#5About 2FA. Protomail does have it, by having their own proxy app on client's side. Your mail apps do not connect to mail server directly, instead, they connect to the proxy app, and proxy app is authed with 2FA.
Re: Email cannot be encrypted at rest
#6> at rest So we're talking about after it's received and processed by a server. > Email is built on top of plain text protocols and messages flow in plain text. If you encrypt, you cannot scan for spam or viruses... But you can? Just scan and process before encrypting. > ...index messages for searching This indeed is a problem. Encrypting emails individually makes search difficult. Why not just encrypt entire hard dr…
But you can? Just scan and process before encrypting. You can't. End-to-end encryption for email means the messages are encrypted by the sending client and decrypted by the receiving client. The server has no chance to scan anything because it cannot decrypt the messages.
End-to-end encryption and encryption at rest are two very different things.
Re: Email cannot be encrypted at rest
#7> at rest So we're talking about after it's received and processed by a server. > Email is built on top of plain text protocols and messages flow in plain text. If you encrypt, you cannot scan for spam or viruses... But you can? Just scan and process before encrypting. > ...index messages for searching This indeed is a problem. Encrypting emails individually makes search difficult. Why not just encrypt entire hard dr…
The title is throwing off how we’re reading the article. It’s really about why they, an email provider, can’t meaningfully encrypt email at rest. FTA:
>If you are interested in real encryption, please use end-to-end encryption tools such as GPG or fetch locally all your messages periodically and encrypt them yourself.
I would say their standard for being ‘encrypted at rest’ is including a requirement that they are unable to open it.
This is textbook ‘perfect being the enemy of the good’. There are a lot of threats outside of malicious insiders that could be deterred or slowed down by a practical encrypted storage mechanism.
Re: Email cannot be encrypted at rest
#8whats the problem with GnuPG and mailvelope ?
Re: Email cannot be encrypted at rest
#9whats the problem with GnuPG and mailvelope ?
none - but they are not "encryption at rest by the mail server provider" which is what the article is about
Re: Email cannot be encrypted at rest
#10> at rest So we're talking about after it's received and processed by a server. > Email is built on top of plain text protocols and messages flow in plain text. If you encrypt, you cannot scan for spam or viruses... But you can? Just scan and process before encrypting. > ...index messages for searching This indeed is a problem. Encrypting emails individually makes search difficult. Why not just encrypt entire hard dr…
The title is throwing off how we’re reading the article. It’s really about why they, an email provider, can’t meaningfully encrypt email at rest. FTA: >If you are interested in real encryption, please use end-to-end encryption tools such as GPG or fetch locally all your messages periodically and encrypt them yourself. I would say their standard for being ‘encrypted at rest’ is including a requirement that they are un…
yeah that gets clear when they talk about their certified physical security: there is a strong assumption that drives can not be stolen and will be destroyed at their EOL. Such assumptions often don't hold. Encryption and physical protection are not redundant, they are defense in depth.
I agree with the GPG part and that a mail provider can not reasonably create something similar, however they have a weird understanding of "encryption at rest" at the base of their argument why they don't do it.