4 ms·
My issue is not default encryption, which I think is a "good thing"™. It's that if you say "Thunderbird: Encrypted by Default"™, you give users a sense of secur
by stinkytaco 11y ago
My issue is not default encryption, which I think is a "good thing"™. It's that if you say "Thunderbird: Encrypted by Default"™, you give users a sense of security that is at least partially an illusion. This is something we would roundly criticize Google for if they were to say, for example, "your email and searching is secure because you are using SSL". I feel it's incumbent on an organization like Mozilla, one that I support at least partially because they are not building a platform to advance their own interests, to be very clear that email is encrypted en route, but not necessarily secure.
I'm guess I'm viewing it from a communications angle.
- digi_owl 11y agoHere we are back at the varying definition of "security". The encryption will defend against NSA style "grab everything, sort it out later" attacks. but it will not defend against targeted attacks where someone had compromised the remote sender somehow. The former is a boon for most people vs the present state, the latter is a hairy problem that has been with us since we first started sorting ourselves into ingroups and outgroups (how do you know that the email is not sent by someone with a gun pointed to their head?). Or as i was reminded by a different comment: perfect becomes the enemy of good.