Some may only want encryption between their key custodian and the recipient or their custodian. Email without encryption cannot guarantee it won't be snooped on by any of the other parties involved in transporting it. In practice big providers may be able to ensure that, but email is federated so it's impractical to do that with every provider unless there's a standard.

The point that Fastmail made in the article, though, is that if Fastmail is handling the encryption, then they know your key. So Fastmail cannot protect you against Fastmail's servers being compromised[0].

And the article linked from their article (hilarious itself) pointed out that this basically comes down to State Actors (Mossad as the example) or Everyone Else. If it's Mossad then there's nothing anyone else can do to protect you (because they can do secret-squirrel things through special security courts and stuff like installing black boxes on undersea cable routers). If Everyone Else, then the normal run-of-the-mill transport encryption is probably good enough, just don't click on any herbal boner-pill adverts.

tldr; If you want to be protected, you have to do PGP at the local machine level yourself.

[0] Given that Fastmail are Aussies, and that our idiotic government have given the spooks full, secret, access to anything they want, then this is a very real prospect for anyone that five-eyes might be interested in.

>this basically comes down to State Actors ... or Everyone Else

This is oversimplification if not misleading. There are also Bad Guys (who aren't state actors), who usually can't reach for your data. But occasionally they can, when rare Planet Parades like Heartbleed or Meltdown make the news. And they are happy to use this one-in-a-lifetime chance to sell access to your data to everyone else.

I guess I don't understand how something like Heartbleed can hit you if you don't click on boner-pill ads, Fastmail's servers don't get hit, and you're not installing random apps from random internet folks?

> won't be snooped on by any of the other parties involved in transporting it.

There was a time, long, long ago, when mail from your email provider to your recipient's provider would often go through other providers in transit. Nowadays (and for the last 20 years) all of the intermediary mail-servers in the Received: headers belong to either the sender's provider or the recipient's provider. They're usually spam-filters, application gateways, secondary servers.

I guess the major exception is people who use gmail or Mailchimp as an outbound relay. But that's deliberate, and entirely under the sender's control.

However, the wide use of MTA-STS is quite recent so downgrade attacks have been possible. In fact, Fastmail seems to currently be messing up MTA-STS, I'm not sure if they are intending to enable it or not.

https://www.mailhardener.com/kb/mta-sts

As I read it, that's their point. They're responding to people who are asking them "why don't you do PGP?" (like Proton does), and their answer is a pretty well-reasoned "because that doesn't make much sense - it doesn't mitigate against any actual threats".

Which kinda begs the question about what Proton thinks they're doing by implementing PGP on behalf of their users...?

We implement OpenPGP client-side, on the user's devices. Their central complaint of

> If it’s running in the browser with code downloaded from our servers, then if we get compromised, we can serve up a version of the PGP code which leaks keys or plaintext.

is well-known but only applicable to the web app, the other clients are less susceptible to this. Even for the web app, we are proposing to solve this problem: https://github.com/twiss/source-code-transparency

thanks for the clarification. I'm a happy Fastmail user, but I appreciate that other people have different ideas