News for hackers. Stuff that matters.
Re:The Dream of Usable Email Encryption Is Still a Work in P... by rubyfan on Sunday March 27, 2016 @07:57AM (#11369692)
It's not just Google and Yahoo, it's the other email providers, i.e. Your employer.

It's pretty common for corporations to use their own root certificate so they can snoop your HTTPS, one would have to assume security officers wouldn't be really interested in individual employees encrypting their mail at the MUA and the company losing visibility on outbound messages.

The thing I never got though, is why signing messages never really caught on. You'd think banks and financial service providers would have an interest here. Maybe they don't want to deal with the support headache.

Re:The Dream of Usable Email Encryption Is Still a Work in P... by XorNot on Sunday March 27, 2016 @08:51AM (#11369802)
That one constantly perplexes me. The GPG signature, or X.509 even, means nothing in the message. But if you go to the trouble of putting it in there, then I can actually run checks.

Conversely....I can see the argument not to. Uploading 50,000 1-character name mismatch to bank encryption keys would definitely happen.

Re:The Dream of Usable Email Encryption Is Still a Work in P... by tptacek on Sunday March 27, 2016 @01:15PM (#11370640)
Employers that care about this will simply ban origination of E2E secure messages from their networks. Plenty of large companies already ban web mail providers entirely, for similar reasons. So this isn't much of a factor in adoption of encrypted mail.
Re:The Dream of Usable Email Encryption Is Still a Work in P... by rubyfan on Sunday March 27, 2016 @03:35PM (#11371167)
Right but my point is, big corporations are actively opposed to E2E secure messages and that's a barrier to adoption.

Few if any big companies are going to be sending you GPG/PGP encrypted or signed email or be willfully receiving it. Take the Fortune 1000 off the list of potential secure email users and you've got a large portion of the professional class who won't know how to use this technology. I think that's a barrier to adoption.

Re:The Dream of Usable Email Encryption Is Still a Work in P... by tptacek on Sunday March 27, 2016 @04:12PM (#11371337)
Big employers don't care; web mail is already problematic for them, and E2E doesn't significantly change things.
Re:The Dream of Usable Email Encryption Is Still a Work in P... by rubyfan on Monday March 28, 2016 @07:01PM (#11378164)
Different issues entirely.
Re:The Dream of Usable Email Encryption Is Still a Work in P... by mike_hearn on Sunday March 27, 2016 @01:21PM (#11370663)
Most mail is now signed with DKIM.
Re:The Dream of Usable Email Encryption Is Still a Work in P... by rubyfan on Sunday March 27, 2016 @03:24PM (#11371128)
Great, if you trust your middle man email provider to get this right and want no visibility on the message's authenticity.

DKIM is much more a spam fighting tool than a substitute for E2E authenticity validation.

Re:The Dream of Usable Email Encryption Is Still a Work in P... by mike_hearn on Sunday March 27, 2016 @03:43PM (#11371197)
If you don't trust your send gateway then you are without a doubt hosed anyway, as they can just strip your signature anyway (or, replace it with one linked to a key they generated in your name on the fly). Yes, if your correspondant is super on the ball and notices that you didn't sign/encrypt this specific message, maybe you win. But if I were a bad MITM I'd just put "Sent from my iPhone" at the bottom and there is the plausible explanation.