31–40 of 54 posts
I don't think email encryption will ever be more widespread than it is today. People simply don't care, and even those few that can be convinced to use it will invariably do something that invalidates the whole exercise like bring their key to a public library, use it on their phone, resend the entire conversation in plain text accidentally, lose the key and generate a new one with you having no way to verify that it…
that's because they think email is already private. They don't understand that it's the electronic equivalent of printing their conversations on billboards and hope nobody will actually look at them. As soon as you demonstrate with a simple sniffer, they are outraged.
We just need "Firesheep for email" and then demand for privacy will explode.
The chances of this project succeeding or failing has nothing to do with the name. There are much bigger barriers which they need to overcome.
> PFS for message objects, as the description above suggests, is far more difficult, and contrary to the nature of email.
It recommends just rotating public keys every few days with a paranoid mode. A much better solution is to implement the Axolotl Ratchet pioneered by Open Whisper Systems for TechSecure:
https://www.whispersystems.org/blog/advanced-ratcheting/
https://github.com/trevp/axolotl/wiki
With Axolotl Ratchet, you get:
* forward secrecy - disclosure of private keys doesn't let an attacker in the future go back and read encrypted communication
* future secrecy - disclosure of ephemeral private keys doesn't disclose (much) future content
I also get the feeling from a glance reading the spec that way too much trust is being placed on service providers. That there is even such a category as "trustful" where the server has access to your private keys is a huge red flag and that was exactly the problem with lavabit: http://www.thoughtcrime.org/blog/lavabit-critique/
Is "Dark Mail" going to be the official name? I am no marketing expert, but I am pretty sure it's not a good name. People associate darkness with negative feelings, thus a lot of people might start thinking that encryption is for hiding "illegal" things, and not for keeping privacy. And please, don't even try using the silly X.0 naming, as some tech-ignorant journalists started doing over a decade ago. Besides the na…
3 of 5 comments so far mentioning that the name is a mistake. Allow me to make that 4 of 6. Come on guys, authoritarians are going to argue that this is just about defending criminals and terrorists, do you want to make that argument for them? Call it 'Liberty mail' or something.
Liberty Mail is an equally bad name. Don't conflate technology with freedom. Call it Electronic Messaging or something instead.
I don't think email encryption will ever be more widespread than it is today. People simply don't care, and even those few that can be convinced to use it will invariably do something that invalidates the whole exercise like bring their key to a public library, use it on their phone, resend the entire conversation in plain text accidentally, lose the key and generate a new one with you having no way to verify that it…
HTTPS appears available [1], interesting that they don't force a redirect. [1] http://darkmail.info
The proposal for forward secrecy in the spec ( https://darkmail.info/downloads/dark-internet-mail-environme... ) is not great and does not reflect the current state of the art: > PFS for message objects, as the description above suggests, is far more difficult, and contrary to the nature of email. It recommends just rotating public keys every few days with a paranoid mode. A much better solution is to implement the A…