Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Encrypted email is still a pain

incoherency.co.uk

Post reply on HN
Print view View original

71–80 of 450 posts

Re: Encrypted email is still a pain

#71

Post by Tepix »

lmm wrote: post #52
tptacek wrote: post #7

Encrypted email is pretty much over in 2017. The emerging consensus among experts is that it's not worth the trouble, or, worse, incapable of doing much more than generating a false sense of security. That's for a bunch of reasons: * An enormous installed base of clients that won't do encryption, meaning that at best you're attempting to tunnel encrypted messaging over an unencrypted transport. * A protocol that leak…

Maybe I'm paranoid, but I'm suspicious of how, just as crypto is having a cultural moment, this expert consensus is appearing against the one cryptosystem that has demonstrated itself to be genuinely effective even against the most powerful of adversaries (Snowden used it and, perhaps more significantly, leaked internal NSA complaints that they're unable to break it when used correctly). And we're being pushed toward…

I agree. Sure, PGP is somewhat outdated but it is still solid as long as keys aren't compromised. There is a good argument for new form of communication that is encrypted by default, but email has such a huge headstart that I'm not sure that's practical.

WhatsApp on the other hand is a proprietary platform restrained by commercial interests, closed source, and lack of verifiability as well as opaque key management.

Re: Encrypted email is still a pain

#72

Post by pdog »

tptacek wrote: post #7

Encrypted email is pretty much over in 2017. The emerging consensus among experts is that it's not worth the trouble, or, worse, incapable of doing much more than generating a false sense of security. That's for a bunch of reasons: * An enormous installed base of clients that won't do encryption, meaning that at best you're attempting to tunnel encrypted messaging over an unencrypted transport. * A protocol that leak…

Is WhatsApp secure? It's a totally closed protocol owned by a company (Facebook) known for rampant issues with privacy.

Re: Encrypted email is still a pain

#73

Post by Tepix »

gpg2 broke when I updated from Ubuntu 14.04 to Ubuntu 16.04. I had to export the keys using gpg and import them using gpg2.

Before the upgrade gpg2 was able to read the keys just fine.

Now, that's not the only problem after the upgrade, Enigmail is having some other issues...

It's a mess.

Re: Encrypted email is still a pain

#74

Post by Tepix »

pdog wrote: post #72
tptacek wrote: post #7

Encrypted email is pretty much over in 2017. The emerging consensus among experts is that it's not worth the trouble, or, worse, incapable of doing much more than generating a false sense of security. That's for a bunch of reasons: * An enormous installed base of clients that won't do encryption, meaning that at best you're attempting to tunnel encrypted messaging over an unencrypted transport. * A protocol that leak…

Is WhatsApp secure? It's a totally closed protocol owned by a company (Facebook) known for rampant issues with privacy.

Yes with no control over what happens to your key and you don't know if your message has been encrypted after it is sent and by default you aren't even told if the key of your recipient changes.

Re: Encrypted email is still a pain

#75

Post by tptacek »

problems wrote: post #62
tptacek wrote: post #48

Earlier quoted context omitted.

No, I fully understand the problem. If Google Mail vanished tomorrow, a pretty large number of people would probably stop emailing altogether. The number of people for whom that's true increases every year. If you find that unthinkable, consider the bubble you might be living in. I appreciate that there are people that require a decentralized service for messaging and understand where they're coming from. I don't den…

> No, I fully understand the problem. If Google Mail vanished tomorrow, a pretty large number of people would probably stop emailing altogether. The number of people for whom that's true increases every year. I highly doubt that's true. Email is pretty essential to the functionality of the internet, from signing up accounts to getting notifications, to just plain discussions with professionals. It's pretty much the o…

Three responses:

* Email remains important for middle-class Americans because it's used for business. But that is a small subset of the whole population, including very large numbers of Americans.

* For almost all those users, email might as well be a Google, Yahoo, or Microsoft product.

* Every year, the number of people and businesses that rely on email gets smaller --- in the last 5 years or so, by something like 15%.

There's no trend we're looking at that suggests that email is becoming more relevant.

We should be happy about this, not freaking out. Even if you think the future is decentralized messaging protocols (I like decentralized too; I just think we should figure the nuts and bolts out before we decentralize), email is a boat anchor holding us back.

Re: Encrypted email is still a pain

#76

Post by drdaeman »

pmlnr wrote: post #63
mrfregg wrote: post #61

Earlier quoted context omitted.

Forgive my ignorance, but what caused XMPP to fail? Simply the lack of uptake or is there some other reason?

I've been running my email server for a decade without serious glitches. Setting up my own federated XMPP instance is much more problematic and people are already complaining about how hard email is. I'd love to see an up-to-date tutorial that opposes my statement, eg. setting up prosody (or something lightweight) on debian (or similar) with multiple domains for multiple accounts, sending and receiving test messages…

> Setting up my own federated XMPP instance is much more problematic

Actually, I believe it's the contrary.

With email you have to obtain a valid TLS certificate, set up SPF, DKIM, and keep eye on the DNSRBLs so you're in good standing. And if Big Company's mail service suddenly decides they don't like you, it won't help. Oh, and spamassasin/rspamd/milter/greylisting/etc stuff so your email server doesn't get thousands of emails per day few weeks after some bot detects your host is listening on tcp/25.

XMPP has less adoption, spam exists but is much rare, so there's less stuff to do. Install a package, get a TLS cert, publish an SRV record (IIRC that's not even strictly required), and that's it. A bit fewer steps.

Not to say email is MTA+MDA combo (+some fancier LDA, +Sieve if you want more that a simple system) while XMPP is a single piece of software (unless you want transports or external extra services).

Re: Encrypted email is still a pain

#77

Post by problems »

RyanZAG wrote: post #70
mrfregg wrote: post #61

Earlier quoted context omitted.

Forgive my ignorance, but what caused XMPP to fail? Simply the lack of uptake or is there some other reason?

Google's embrace-extend-extinguish destroyed XMPP. They made their chat system XMPP compatible for a short time which caused many people to swap to their solution. When they ended support, most users simply stopped using XMPP.

Did you also notice that Google's messaging system pretty much died out around that point in favor of Skype and similar?

I used to see people mention GTalk all the time, but I haven't seen anything similar in years. No one has mentioned G+ or Allo. That decision by Google may have been the thing that killed its user base.

Re: Encrypted email is still a pain

#79

Post by pmlnr »

problems wrote: post #62
tptacek wrote: post #48

Earlier quoted context omitted.

No, I fully understand the problem. If Google Mail vanished tomorrow, a pretty large number of people would probably stop emailing altogether. The number of people for whom that's true increases every year. If you find that unthinkable, consider the bubble you might be living in. I appreciate that there are people that require a decentralized service for messaging and understand where they're coming from. I don't den…

> No, I fully understand the problem. If Google Mail vanished tomorrow, a pretty large number of people would probably stop emailing altogether. The number of people for whom that's true increases every year. I highly doubt that's true. Email is pretty essential to the functionality of the internet, from signing up accounts to getting notifications, to just plain discussions with professionals. It's pretty much the o…

Wechat is what's doing this is China, and it's working fairly well for them. It's obviously impossible to do the same in the West (companies won't be trusted by people in Europe, nation-level apps won't be trusted in US) but it's not impossible to replace email. Note: mobile is gigantic compared to desktop in China, so this might also be a reason.

I still believe email will outlast all the current solutions though, but the crushing presence of a few big providers is not doing any good for the protocol.

Re: Encrypted email is still a pain

#80

Post by pmlnr »

problems wrote: post #62
tptacek wrote: post #48

Earlier quoted context omitted.

No, I fully understand the problem. If Google Mail vanished tomorrow, a pretty large number of people would probably stop emailing altogether. The number of people for whom that's true increases every year. If you find that unthinkable, consider the bubble you might be living in. I appreciate that there are people that require a decentralized service for messaging and understand where they're coming from. I don't den…

> No, I fully understand the problem. If Google Mail vanished tomorrow, a pretty large number of people would probably stop emailing altogether. The number of people for whom that's true increases every year. I highly doubt that's true. Email is pretty essential to the functionality of the internet, from signing up accounts to getting notifications, to just plain discussions with professionals. It's pretty much the o…

re @tptacek

> Every year, the number of people and businesses that rely on email gets smaller --- in the last 5 years or so, by something like 15%.

Are you sure that's not just the spam decreasing?

Post reply on HN