3 ms·

I think you're really missing the point here. > Moxie says that email is frozen, being why it is unencrypted, blaming the lack of progress on it being federate

I think you're really missing the point here. > Moxie says that email is frozen, being why it is unencrypted, blaming the lack of progress on it being federated. But you know, I'm willing to bet that in 10 years from now WhatsApp and Slack will be both dead, just like Yahoo Messenger and ICQ before them, while email and IRC will still be around. Yes, and email will still be unencrypted, while the WhatsApps and Slacks of the future will probably be encrypted end-to-end. > And I think that email is unbeatable, because it is federated, because it's governed by standards and because in spite of all constraints, it's quite adaptable, being the kind of platform supporting short term proprietary solutions because (and not in spite of) its client/server decoupling. It's not adaptable enough to introduce meaningful encryption to it.

bad_user 10y ago
Slack isn't encrypted and it doesn't make sense to pretend that it is. Introducing encryption is actually difficult for them, since they rely on a web interface connecting to a central server. But anyway, email can support encryption if you want it, not by one, but two protocols. Email is actually the main channel that journalists and businesses are using for communicating actual secrets over the wire. It's actually the only generally available "meaningful" channel, because even with WhatsApp's encryption, you still can't fully trust a binary blob communicating with a proprietary server, not without the ability to do third-party reviews. You can do S/MIME, which is encryption with certificates released by an authority (just like HTTPS), or you can do PGP/GPG which is more decentralized, putting the onus of establishing a chain of trust on you. S/MIME is supported out of the box in most email clients and setting up GPG in something like Thunderbird is actually not that hard: https://support.mozilla.org/en-US/kb/digitally-signing-and-encrypting-messages https://support.mozilla.org/en-US/kb/digitally-signing-and-e... ; And even for web interfaces there's this browser extension called Mailvelope that's pretty cool: https://www.mailvelope.com/ https://www.mailvelope.com/ You see, email does support encryption, just not by default. And the reason for why encryption isn't popular with email is because people don't freaking care. And the often dreaded protocol that Moxie usually speaks against is XMPP. XMPP apparently isn't good for delivering push notifications on mobile phones, but it does supports easy to use encryption. It's called OTR: http://wiki.xmpp.org/web/OTR http://wiki.xmpp.org/web/OTR ; Oh, and there are is of course an open-source Jabber / XMPP client for Android and it does support OTR, working quite well actually: https://play.google.com/store/apps/details?id=eu.siacs.conversations https://play.google.com/store/apps/details?id=eu.siacs.conve... You see, WhatsApp's progress is extraordinary, but only because of popularity, because they delivered encryption to people that don't care. Which is quite a feat, except that with another update they can also revert all of that, without users being able to do anything about it. And WhatsApp's progress is not extraordinary for its technical challenges.
- devishard 10y ago
  > Slack isn't encrypted and it doesn't make sense to pretend that it is. I didn't say it was. > But anyway, email can support encryption if you want it, not by one, but two protocols. Email is actually the main channel that journalists and businesses are using for communicating actual secrets over the wire. Yes, but they're using GPG over email. Another example of a nesting protocols approach are plugins that support OTR over XMPP. Nesting protocols is a valid approach for technical users, but the user experience is such that it will never catch on with non-technical users. And, in context, providing e2e encryption that non-technical users will use is a big part of moxie's goals. S/MIME can't be deployed meaningfully because major webmail providers will never support it; data-mining email is a huge part of their business model. So no, email does not support encryption. > And the reason for why encryption isn't popular with email is because people don't freaking care. Nobody cares about encryption in the abstract, but a great many people care about privacy. Many people who care about privacy simply don't have the technical knowledge to know what encryption they need and use it, and can't give up the communication that email/chat/etc give them. My dad, who has trouble bolding text in Word, learned how to use Signal because he cares about encryption.

bad_user 10y ago

Slack isn't encrypted and it doesn't make sense to pretend that it is. Introducing encryption is actually difficult for them, since they rely on a web interface connecting to a central server. But anyway, email can support encryption if you want it, not by one, but two protocols. Email is actually the main channel that journalists and businesses are using for communicating actual secrets over the wire. It's actually the only generally available "meaningful" channel, because even with WhatsApp's encryption, you still can't fully trust a binary blob communicating with a proprietary server, not without the ability to do third-party reviews. You can do S/MIME, which is encryption with certificates released by an authority (just like HTTPS), or you can do PGP/GPG which is more decentralized, putting the onus of establishing a chain of trust on you. S/MIME is supported out of the box in most email clients and setting up GPG in something like Thunderbird is actually not that hard: https://support.mozilla.org/en-US/kb/digitally-signing-and-encrypting-messages https://support.mozilla.org/en-US/kb/digitally-signing-and-e... ; And even for web interfaces there's this browser extension called Mailvelope that's pretty cool: https://www.mailvelope.com/ https://www.mailvelope.com/ You see, email does support encryption, just not by default. And the reason for why encryption isn't popular with email is because people don't freaking care. And the often dreaded protocol that Moxie usually speaks against is XMPP. XMPP apparently isn't good for delivering push notifications on mobile phones, but it does supports easy to use encryption. It's called OTR: http://wiki.xmpp.org/web/OTR http://wiki.xmpp.org/web/OTR ; Oh, and there are is of course an open-source Jabber / XMPP client for Android and it does support OTR, working quite well actually: https://play.google.com/store/apps/details?id=eu.siacs.conversations https://play.google.com/store/apps/details?id=eu.siacs.conve... You see, WhatsApp's progress is extraordinary, but only because of popularity, because they delivered encryption to people that don't care. Which is quite a feat, except that with another update they can also revert all of that, without users being able to do anything about it. And WhatsApp's progress is not extraordinary for its technical challenges.

devishard 10y ago
> Slack isn't encrypted and it doesn't make sense to pretend that it is. I didn't say it was. > But anyway, email can support encryption if you want it, not by one, but two protocols. Email is actually the main channel that journalists and businesses are using for communicating actual secrets over the wire. Yes, but they're using GPG over email. Another example of a nesting protocols approach are plugins that support OTR over XMPP. Nesting protocols is a valid approach for technical users, but the user experience is such that it will never catch on with non-technical users. And, in context, providing e2e encryption that non-technical users will use is a big part of moxie's goals. S/MIME can't be deployed meaningfully because major webmail providers will never support it; data-mining email is a huge part of their business model. So no, email does not support encryption. > And the reason for why encryption isn't popular with email is because people don't freaking care. Nobody cares about encryption in the abstract, but a great many people care about privacy. Many people who care about privacy simply don't have the technical knowledge to know what encryption they need and use it, and can't give up the communication that email/chat/etc give them. My dad, who has trouble bolding text in Word, learned how to use Signal because he cares about encryption.