News for hackers. Stuff that matters.
Re:The Dream of Usable Email Encryption Is Still a Work in P... by tptacek on Sunday March 27, 2016 @01:24PM (#11370677)
Another reasonable way to look at this situation is to conclude that trying to provide safely encrypted email is not a good idea. The protocol is, in this argument, simply too hostile to sound cryptography to reliably encrypt things. Instead, we should focus on:

* Getting providers to safely engage TLS for MTA-MTA mail relaying, for instance by deploying key pinning.

* Making existing non-seamless cryptography (PGP) functional enough that it can be used in exceptional cases.

* Deploying new asynchronous encrypted messaging systems --- things like what Adam Langley was shooting for with Pond --- that were designed from the start with security in mind.

Secure-by-default email would be nice to have, but it's not the only option. We could, instead, deprecate SMTP email.

Re:The Dream of Usable Email Encryption Is Still a Work in P... by atmosx on Sunday March 27, 2016 @03:01PM (#11371035)
> Making existing non-seamless cryptography (PGP) functional enough that it can be used in exceptional cases.

Hm, I don't believe it's a technical problem, although it's a recurrent theme among techies. PGP is hard to explain to someone who didn't spend the time to digest certain concepts but installing GPGTools on your mac, generating a key and using it is not hard, nor complicated... You can even store the passphrase in the keychain.

I believe that most people using email don't feel there's any added value in using GPG, that's all. This might change in the future, but we're not there yet.

Re:The Dream of Usable Email Encryption Is Still a Work in P... by smt88 on Sunday March 27, 2016 @03:24PM (#11371127)
> Deploying new asynchronous encrypted messaging systems

Couldn't Google, Microsoft, Yahoo, Apple, and any other large email providers at least agree to transparently use a different, secure protocol among themselves? It could be something open-source (perhaps Pond) that other providers could also choose to adopt.

The mail-sending server could ping the recipient server, find out if it's a user of this new protocol or not, and then fall back to email if it doesn't receive the predetermined response.

Even if that only means that only 80% of emails were encrypted on average, that would be an improvement, wouldn't it?