Now I understand why almost no one uses encrypted email

Re:Now I understand why almost no one uses encrypted email by zokier on Thursday April 16, 2020 @07:39PM (#22894713)

> email does not have an equivalent to TLS

Email does have the equivalent of TLS, its TLS. Send a message to another user in Facebook or whatev over the web and its secured by TLS over the wire, but does not protect from the server reading it. Send a email to user on an email server and its secured by TLS over the wire, but does not protect the server from reading it. Exactly the same thing.

[ Parent | on HN ]

Re:Now I understand why almost no one uses encrypted email by austincheney on Thursday April 16, 2020 @08:02PM (#22894870)

> over the web

So this confuses a few things. Technically you are right in that TLS applies to the transport layer (layer 4) while both web and email are application layer (layer 7), but then the question is how to apply it for email in practice that differs from manual key exchange?

Web mail uses web (port 80 or 443) to communicate to a web server email application where the email is blasted out as regular email (most likely as SMTP over port 25). Since the first leg is regular web traffic regular web rules apply, but only to that first leg. Applications like Outlook and Thunderbird are not webmail and do not use web traffic to send/receive email.

[ Parent | on HN ]