The risk is that someone steals your laptop while you're signed in and then your disk encryption doesn't do squat. There are ways to deal with this, but very few people are actually doing them.
> Correct me if I misunderstood you, but I don't think emails should be ephemeral. I am have currently several emails from my landlord, the police, etc. that I have to keep for years as evidence in case of a future dispute. While I cannot prove that they are not fake, it's the same for physical letters, yet both are admissible in court as evidence. If I tried to get more reliable proof out of either of them, they might send me a hand-signed letter by post but they'd never figure out PGP.
You did not misunderstand me, but emails absolutely should be considered ephemeral. Google can kill your gmail accounts. Providers come and go. Email chain of custody is difficult and in most cases are easily faked.
Email is an absolutely shit system to use for any kind of identity work. And yet we do, at our own peril. Billions have been lost to email fraud.
With the goal posts having shifted to someone gaining full access to your powered on, unlocked device, we have arrived at XKCD 538.
You're offloading all of your risk upstream and basically hoping and praying that your provider or however many relay services in between don't default SMTP sans-TLS. Or that rogue employees don't go reading your shit. You're one misconfigured server from showing your ass all over the internet.
Remember that Google literally uses the contents of your gmail to market to you. Google being a company with a highly-politicized employee base with lots of motivated engineers & product people looking to "change the world".
Suppose myself and the recipient are using x509 certs with outlook and our laptops have encrypted disks with bitlocker or equivalent - my impression is that it mostly covers the basis, is that unjustified?
"It's actually better that people start to treat their mailboxes as somewhat ephemeral, as communicating that you are you encourages use of things like PGP signatures"
Correct me if I misunderstood you, but I don't think emails should be ephemeral. I am have currently several emails from my landlord, the police, etc. that I have to keep for years as evidence in case of a future dispute. While I cannot prove that they are not fake, it's the same for physical letters, yet both are admissible in court as evidence. If I tried to get more reliable proof out of either of them, they might send me a hand-signed letter by post but they'd never figure out PGP.