Re:Now I understand why almost no one uses encrypted email
by lmm on Thursday April 16, 2020 @11:36PM
(#22895975)
> With transport encryption you have to trust that the infrastructure is secured on an ongoing basis.
If we're talking about a government bulk surveillance programme then not really - servers and infrastructure change all the time and sysadmins are naturally curious. An ever-expanding pool of people at Facebook (or wherever) would have to be on board with the surveillance programme for it to be worth setting up.
> With end-to-end encryption implemented in a real-world app (i.e. distributed through a walled garden) you need only trust that the version of the app delivered to you is based on the code it claims to be.
Those walled gardens don't let you pin a fixed version of that app, and OWS stops people from redistributing the APK or putting it up on open-source app stores, with their rationale being that they can't handle old versions of the app using their servers. So in reality you have to trust them on an ongoing basis.
> One of the things Signal does well that PGP systems don't is actually being usable by real humans, which for a security system is everything.
Being secure is everything. Usability is important, but better a secure system that only a few people can use than an insecure system that everyone can use.
If we're talking about a government bulk surveillance programme then not really - servers and infrastructure change all the time and sysadmins are naturally curious. An ever-expanding pool of people at Facebook (or wherever) would have to be on board with the surveillance programme for it to be worth setting up.
> With end-to-end encryption implemented in a real-world app (i.e. distributed through a walled garden) you need only trust that the version of the app delivered to you is based on the code it claims to be.
Those walled gardens don't let you pin a fixed version of that app, and OWS stops people from redistributing the APK or putting it up on open-source app stores, with their rationale being that they can't handle old versions of the app using their servers. So in reality you have to trust them on an ongoing basis.
> One of the things Signal does well that PGP systems don't is actually being usable by real humans, which for a security system is everything.
Being secure is everything. Usability is important, but better a secure system that only a few people can use than an insecure system that everyone can use.