6 ms·

I use Keybase + Thunderbird + Enigmail. It's not the most user-friendly approach but honestly I think whoever is not willing to go the distance now doesn't real

by noobie 11y ago

I use Keybase + Thunderbird + Enigmail. It's not the most user-friendly approach but honestly I think whoever is not willing to go the distance now doesn't really value encryption/their privacy and thus won't quite care when encryption is more usable/ mainstream.

adrianN 11y ago
I agree with you, but I think that we should try to make encryption something that you don't have to "do". HTTPS is widely used even by people who don't really care about their privacy, because it just happens automatically. I'm not sure whether it will ever be possible to do the same with e-mail, but I think it would be cool if all messages where encrypted and authenticated by default.
- Freak_NL 11y ago
  The challenge here with authenticated end-to-end encryption, is that it depends on having the user's private key available. Whereas for HTTPS no secret knowledge factor belonging to the user is needed (unless you use client-side certificates). That simplifies matters quite a bit.
  - chopin 11y ago
    That's of course only possible with the (imho) broken CA system.
  - XorNot 11y ago
    Trust would be a better problem to solve then encryption, at least initially. The big problem plenty of people have with email (and for me at least, the phone) is establishing who I'm actually talking to when dealing with a business. It would be really great if when my bank emailed me, the message was signed with the key they use on their website so we could seamlessly establish that it was really from them.
    - Freak_NL 11y ago
      Unfortunately, banks (at least in The Netherlands) seem to favour a different solution altogether, which is not to send e-mails at all, but expect you to log on frequently on their on-line banking environment to look in your banking 'inbox' there. Banks, insurance companies, pension funds, the revenue service, the local municipal government; they all expect you to frequently log on to their portals, and look at their digital correspondence addressed to you there. Some do send a notification e-mail stating that 'a message is waiting for you', but you never know if that message is actually important or merely trivial noise. They have declared e-mail dead. I abhor this situation, because with e-mail (and coincidentally, old-fashioned paper mail) all correspondence addressed to me comes to me in a single inbox, where I can archive and backup important stuff. I really wish I had the option to simply upload my GPG public key to these portals so that all these phony inboxes simply mailed me my correspondence encrypted!
aluhut 11y ago
Then we'll have to make it op-out. Honestly, I would love to have it working on my parents Thunderbird without any further popups. They have no idea and are regularly confused. Especially if the popup is in a language they don't understand.

by noobie 11y ago

adrianN 11y ago

I agree with you, but I think that we should try to make encryption something that you don't have to "do". HTTPS is widely used even by people who don't really care about their privacy, because it just happens automatically. I'm not sure whether it will ever be possible to do the same with e-mail, but I think it would be cool if all messages where encrypted and authenticated by default.

Freak_NL 11y ago
The challenge here with authenticated end-to-end encryption, is that it depends on having the user's private key available. Whereas for HTTPS no secret knowledge factor belonging to the user is needed (unless you use client-side certificates). That simplifies matters quite a bit.
- chopin 11y ago
  That's of course only possible with the (imho) broken CA system.
- XorNot 11y ago
  Trust would be a better problem to solve then encryption, at least initially. The big problem plenty of people have with email (and for me at least, the phone) is establishing who I'm actually talking to when dealing with a business. It would be really great if when my bank emailed me, the message was signed with the key they use on their website so we could seamlessly establish that it was really from them.
  - Freak_NL 11y ago
    Unfortunately, banks (at least in The Netherlands) seem to favour a different solution altogether, which is not to send e-mails at all, but expect you to log on frequently on their on-line banking environment to look in your banking 'inbox' there. Banks, insurance companies, pension funds, the revenue service, the local municipal government; they all expect you to frequently log on to their portals, and look at their digital correspondence addressed to you there. Some do send a notification e-mail stating that 'a message is waiting for you', but you never know if that message is actually important or merely trivial noise. They have declared e-mail dead. I abhor this situation, because with e-mail (and coincidentally, old-fashioned paper mail) all correspondence addressed to me comes to me in a single inbox, where I can archive and backup important stuff. I really wish I had the option to simply upload my GPG public key to these portals so that all these phony inboxes simply mailed me my correspondence encrypted!

aluhut 11y ago

Then we'll have to make it op-out. Honestly, I would love to have it working on my parents Thunderbird without any further popups. They have no idea and are regularly confused. Especially if the popup is in a language they don't understand.