How to make e-mail encrypted for everyone
friendlybit.com
How to make e-mail encrypted for everyone
1–10 of 47 posts
Re: How to make e-mail encrypted for everyone
#2> When you send an e-mail today it’s sent in plaintext. This means that when you connect to your local coffee shop’s WiFi they can intercept all e-mail that is sent through their router. This is probably not the relationship you have with your barista…
Um, how many users use native clients on unencrypted ports as opposed to https based web-clients or TLS?
Re: How to make e-mail encrypted for everyone
#3It's too late to fix email. Neither using GPG (as the article points out) nor anything else.
Ubiquitous, opportunistic transport encryption is the best it'll get, and we're pretty close to that.
The future of secure communication isn't email, it's incompatible, centralized silos of low-latency protocols with forward secrecy. Think WhatsApp or Signal.
Re: How to make e-mail encrypted for everyone
#4DNS-based key discovery has already been invented twice: PKA and OPENPGPKEY. Nobody is using it.
It has an obvious problem: DNS is not secure. There is DNSSEC, but it's practically undeployed on clients, therefore building on it doesn't make sense.
GPG recently added support for key discovery via HTTPS (Web Key Service, WKS). That goes in the right direction, because it takes the best deployed working authentication system - the web pki - and bootstraps from there.
Re: How to make e-mail encrypted for everyone
#5It's too late to fix email. Neither using GPG (as the article points out) nor anything else. Ubiquitous, opportunistic transport encryption is the best it'll get, and we're pretty close to that. The future of secure communication isn't email, it's incompatible, centralized silos of low-latency protocols with forward secrecy. Think WhatsApp or Signal.
I hate this, federated systems feel so much better for controlling your own security, your own policy.. everything.
Third parties should be avoided imho, it's like nobody has ever suffered vendor lock-in these days.
Re: How to make e-mail encrypted for everyone
#6> When you send an e-mail today it’s sent in plaintext. This means that when you connect to your local coffee shop’s WiFi they can intercept all e-mail that is sent through their router. This is probably not the relationship you have with your barista… Um, how many users use native clients on unencrypted ports as opposed to https based web-clients or TLS?
I don't have any stats, but I imagine lots of users still connect over unencrypted ports directly to their ISP. We have to remember that most users are not like the HackerNews demographics. If you have stats that points to this conclusion being wrong I'm happy to change my mind.
Re: How to make e-mail encrypted for everyone
#7DNS-based key discovery has already been invented twice: PKA and OPENPGPKEY. Nobody is using it. It has an obvious problem: DNS is not secure. There is DNSSEC, but it's practically undeployed on clients, therefore building on it doesn't make sense. GPG recently added support for key discovery via HTTPS (Web Key Service, WKS). That goes in the right direction, because it takes the best deployed working authentication…
I don't think this is about inventing a new protocol. It's about getting Gmail and Thunderbird on board. Has anyone put them in a room together?
Re: How to make e-mail encrypted for everyone
#8It's too late to fix email. Neither using GPG (as the article points out) nor anything else. Ubiquitous, opportunistic transport encryption is the best it'll get, and we're pretty close to that. The future of secure communication isn't email, it's incompatible, centralized silos of low-latency protocols with forward secrecy. Think WhatsApp or Signal.
I don't agree, people have declared the death of e-mail for many many years now, it's not going anywhere. It's definitely not to late to fix it.
Re: How to make e-mail encrypted for everyone
#9> You need to install software on your computer. Most e-mail providers are moving to the web, having to install a browser plugin just to send e-mail is not the experience we should strive for. I understand that this is means your e-mail provider can read your e-mail, so it won’t work for everyone. But I think most people will accept that the same way they accept that their bank can read their bank statement. If we can trade this for usability it’s still a HUGE step up for privacy.
Yea we have that, it's called STARTTLS. If the keys arent only held by the user then there really isn't any end-to-end encryption. It's just the same as SSL.
Re: How to make e-mail encrypted for everyone
#10It's too late to fix email. Neither using GPG (as the article points out) nor anything else. Ubiquitous, opportunistic transport encryption is the best it'll get, and we're pretty close to that. The future of secure communication isn't email, it's incompatible, centralized silos of low-latency protocols with forward secrecy. Think WhatsApp or Signal.
I don't agree, people have declared the death of e-mail for many many years now, it's not going anywhere. It's definitely not to late to fix it.
not death of all email - i think lima talks about that it's too late for per-default end-to-end encrypted email. encrypted transport to/from the server is relatively easy, but client-to-client? email wasn't really built that way and now the barrier of entry for broad adoption is too high.