4 ms·

It seems like email encryption should be a pretty solvable problem tech-wise. Does anyone here actually regularly send and receive such mail? If all the emails

by macrael 17y ago

It seems like email encryption should be a pretty solvable problem tech-wise. Does anyone here actually regularly send and receive such mail? If all the emails saved on servers were encrypted, we wouldn't have this problem.

epochwolf 17y ago
A friend and I use encrypted email from time to time for fun. We generated self-signed keys and we both added security exceptions for each other's keys to our email clients manually. While it works it took us both some time to figure out how to generate the keys. Our keys are also marked as untrusted so you have to manually add them to a trusted list. This method works okay for us but I doubt it would work for most people.
- CWuestefeld 17y ago
  The web-of-trust is really a pain in the tail, but for the purist it's the only approach you can have faith in (or, more correctly, it's the only approach in which you explicitly decide how much faith you're prepared to have).
notmyname 17y ago
Tech-wise, it's a solved problem. I sign all of my outgoing emails using Thawte (now Verisign) certificates. The problem with encryption is finding the other person's keys. I have yet to receive a signed email from someone else, so I cannot send encrypted messages. It seems to be a problem primarily with critical mass and secondarily from implementation. Not enough people use signed/encrypted email to spur others to using it. Additionally, certs cost something. Even free certs cost effort in understanding the need for them and figuring out how to generate/download/install them. Then there is the whole problem with "trusted" certs... Implementation wise, things are only a little better. Once the certs are installed, (desktop) mail clients handle the signing/encrypting pretty well. But I can't sign messages from a webmail client or from my phone.
- ars 17y ago
  Wrong problem. The issue here is not the sending of the message, but the storage of the message. You need your ISP to store the emails encrypted even if they were received in the clear.

by macrael 17y ago

epochwolf 17y ago

A friend and I use encrypted email from time to time for fun. We generated self-signed keys and we both added security exceptions for each other's keys to our email clients manually. While it works it took us both some time to figure out how to generate the keys. Our keys are also marked as untrusted so you have to manually add them to a trusted list. This method works okay for us but I doubt it would work for most people.

CWuestefeld 17y ago
The web-of-trust is really a pain in the tail, but for the purist it's the only approach you can have faith in (or, more correctly, it's the only approach in which you explicitly decide how much faith you're prepared to have).

notmyname 17y ago

Tech-wise, it's a solved problem. I sign all of my outgoing emails using Thawte (now Verisign) certificates. The problem with encryption is finding the other person's keys. I have yet to receive a signed email from someone else, so I cannot send encrypted messages. It seems to be a problem primarily with critical mass and secondarily from implementation. Not enough people use signed/encrypted email to spur others to using it. Additionally, certs cost something. Even free certs cost effort in understanding the need for them and figuring out how to generate/download/install them. Then there is the whole problem with "trusted" certs... Implementation wise, things are only a little better. Once the certs are installed, (desktop) mail clients handle the signing/encrypting pretty well. But I can't sign messages from a webmail client or from my phone.

ars 17y ago
Wrong problem. The issue here is not the sending of the message, but the storage of the message. You need your ISP to store the emails encrypted even if they were received in the clear.