Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: Why Are We Ignoring the Urgent Need for End-to-End Encrypted Emails?

news.ycombinator.com

Post reply on HN
Print view View original

1–10 of 20 posts

Ask HN: Why Are We Ignoring the Urgent Need for End-to-End Encrypted Emails?

#1

Post by kbns »

We're all obsessed with making sure our chat apps like WhatsApp and Signal have end-to-end encryption (E2E), but we completely ignore emails. Emails can reveal a person's entire life story, far more than any chat app ever could.

Right now, if you want your emails to be E2E encrypted, you have to jump through hoops with third-party tools. It's clear that email giants like Google, Microsoft, and Yahoo are raking in profits and don't want to disrupt their spyware operations by adding E2E. It's infuriating! I demand to see E2E encryption as a standard for emails within my lifetime.

Re: Ask HN: Why Are We Ignoring the Urgent Need for End-to-End Encrypted Emails?

#3

Post by ghoshbishakh »

You have already answered your question. Unless Google and Microsoft agree to implement a common E2E encryption standard for Gmail and Outlook, there is no hope.

The other hope is if some EU law does it for us :) . I am not aware if there are any discussions going in this direction.

Re: Ask HN: Why Are We Ignoring the Urgent Need for End-to-End Encrypted Emails?

#4

Post by nullindividual »

The mail server has to read the body of the mail message, which throws out any E2E use. SMTP is from the 1980s. There are countless SMTP servers on the Internet. You want spam filtering? Server-side rules? Can't have E2E.

That, and more, is why E2E isn't available for SMTP-based email. Many modern SMTP servers support opportunistic-TLS, potentially securing email traffic between two SMTP servers. Or forced TLS when you know the target supports TLS connections.

This isn't some "money making" or "spyware" conspiracy. It is a product of history, decentralization, and momentum.

Comparing that to modern chat apps which can be built from the ground up and their messaging protocol doesn't rely on a 40 year old standard is disingenuous at worst, ignorant at best.

Re: Ask HN: Why Are We Ignoring the Urgent Need for End-to-End Encrypted Emails?

#5

Post by al_borland »

It's difficult, because no one company can do it on their own. Proton has encrypted email, but if you send an email to someone's Gmail account, or someone's email box at their personal domain, it's sitting on that server unencrypted at the end of the day.

Gmail owns a huge percentage of the market, which would go a long way, but like you alluded to, they aren't going to give up the email scanning they can do. Without that, I'm not sure Gmail is still worth it for them to run. They'd probably shut it down.

Re: Ask HN: Why Are We Ignoring the Urgent Need for End-to-End Encrypted Emails?

#6

Post by kbns »

nullindividual wrote: post #4

The mail server has to read the body of the mail message, which throws out any E2E use. SMTP is from the 1980s. There are countless SMTP servers on the Internet. You want spam filtering? Server-side rules? Can't have E2E. That, and more, is why E2E isn't available for SMTP-based email. Many modern SMTP servers support opportunistic-TLS, potentially securing email traffic between two SMTP servers. Or forced TLS when y…

While I understand the challenges with SMTP-based email, dismissing privacy concerns as ignorance is unhelpful. It's not at all a technical difficulty—Modern threats demand updated solutions, and opportunistic-TLS isn't enough. Financial incentives and data monetization do play a role in the reluctance of major providers. If new protocols can secure chat apps, similar efforts should be made for email.

Users deserve better privacy protections despite historical constraints.

Re: Ask HN: Why Are We Ignoring the Urgent Need for End-to-End Encrypted Emails?

#7

Post by nullindividual »

kbns wrote: post #6
nullindividual wrote: post #4

The mail server has to read the body of the mail message, which throws out any E2E use. SMTP is from the 1980s. There are countless SMTP servers on the Internet. You want spam filtering? Server-side rules? Can't have E2E. That, and more, is why E2E isn't available for SMTP-based email. Many modern SMTP servers support opportunistic-TLS, potentially securing email traffic between two SMTP servers. Or forced TLS when y…

While I understand the challenges with SMTP-based email, dismissing privacy concerns as ignorance is unhelpful. It's not at all a technical difficulty—Modern threats demand updated solutions, and opportunistic-TLS isn't enough. Financial incentives and data monetization do play a role in the reluctance of major providers. If new protocols can secure chat apps, similar efforts should be made for email. Users deserve b…

> It's not at all a technical difficult

Tell us how you'd implement it and be backwards compatible with existing SMTP servers.

> Financial incentives and data monetization do play a role in the reluctance of major providers.

Do you have evidence that they're preventing E2E SMTP from becoming an RFC?

Re: Ask HN: Why Are We Ignoring the Urgent Need for End-to-End Encrypted Emails?

#8

Post by reify »

I dont send emails to anyone who has a gmail, googlemail. yahoo mail or microsoft or any of the other careless email providers.

It really is as simple as telling people that I do not reply to emails unless they respect my privacy and use an encrypted privacy oriented email provider.

I use the Protonmail SimpleLogin addon account to send them an annonymous email stating my terms for email correspondence.

It does work. then those same people move permanently to those email providers and start respecting my privacy and their own privacy.

One person at a time.

Its about time we imposed our own values regarding confidentiality and privacy.

you cannot wait for the brainwashed to move away from a life of giving up their privacy

Re: Ask HN: Why Are We Ignoring the Urgent Need for End-to-End Encrypted Emails?

#10

Post by mike_hearn »

nullindividual wrote: post #4

The mail server has to read the body of the mail message, which throws out any E2E use. SMTP is from the 1980s. There are countless SMTP servers on the Internet. You want spam filtering? Server-side rules? Can't have E2E. That, and more, is why E2E isn't available for SMTP-based email. Many modern SMTP servers support opportunistic-TLS, potentially securing email traffic between two SMTP servers. Or forced TLS when y…

You technically can have spam filtering with e2e encryption by using confidential computing. It's just really hard and there isn't much market demand.
Post reply on HN