News for hackers. Stuff that matters.
Re:Stop Using Encrypted Email by buzzkillington on Thursday February 20, 2020 @12:45AM (#22372980)
>keys are negotiated completely external to email (in which case, why bother with email?)

Because I've been using that method for close to 15 years now?

Re:Stop Using Encrypted Email by tptacek on Thursday February 20, 2020 @12:51AM (#22373014)
People used FTP for decades, too.
Re:Stop Using Encrypted Email by buzzkillington on Thursday February 20, 2020 @01:07AM (#22373056)
And they still do. I worked at a market maker that used ftp over ssh to move over 10b a year in trades between its various offices.
Re:Stop Using Encrypted Email by phaemon on Thursday February 20, 2020 @08:43AM (#22374983)
I hope there is no such thing because that would be insane. If you mean SFTP, that's actually a completely different protocol and is part of SSH.

If you mean FTPS (which I suspect you do as I actually had to set up something similar at one time), that's FTP over SSL and has nothing to do with SSH.

Your point still stands though: some of the background "FTP a CSV file with a cronjob" crap that goes on in the background would horrify anyone.

Re:Stop Using Encrypted Email by kortilla on Friday February 21, 2020 @01:53PM (#22385671)
You forgot that SSH can be used to tunnel arbitrary TCP streams. FTP over ssh, http over ssh, etc.
Re:Stop Using Encrypted Email by wglb on Thursday February 20, 2020 @04:24PM (#22378786)
Sadly, all three are used and none of them should be.
Re:Stop Using Encrypted Email by buzzkillington on Thursday February 20, 2020 @04:39PM (#22378899)
Nope, ssh tunnel.
Re:Stop Using Encrypted Email by angry_octet on Thursday February 20, 2020 @02:07AM (#22373274)
Has anyone told them there might be a better way?
Re:Stop Using Encrypted Email by yread on Thursday February 20, 2020 @03:38AM (#22373629)
What is better than (S)FTP? Or do you mean MFT, AS2?
Re:Stop Using Encrypted Email by whoopdedo on Thursday February 20, 2020 @08:14AM (#22374809)
SFTP shares only those three letters with FTP but is otherwise a completely different protocol.

It's also a counterpoint to one of the OP's points which is that trying to secure email is a dead-end that we should give up on. It may be possible, though very difficult, to transition to secure email. But it would have to be a brand new protocol not tacked-on to the current system. The way that SFTP is the appropriate upgrade path for FTP and not FTPS.

Re:Stop Using Encrypted Email by jimktrains2 on Thursday February 20, 2020 @09:06AM (#22375111)
The interface of sftp is largely the same as ftp. You can give someone an sftp client, username, and password and they wouldn't be able to tell the difference.

A new e2e protocol that works just like email does would be excellent, but we don't yet have that. Signal &co are chat apps with a different feel and purpose and other than matrix and xmpp not federated, which is a non starter for many entities.

Re:Stop Using Encrypted Email by angry_octet on Thursday February 20, 2020 @09:17AM (#22375185)
Yes I hope it is SFTP and not FTPS.

There are some things we could easily give up to get encrypted mail. For example, setting a max delivery time to allow ephemeral keys.

But there are other problems with encrypted messaging, and I'm particularly thinking of spam. How does Signal/WhatsApp manage to keep a lid on it? Would that be possible in a federated system?