15 ms·

Dark Mail seems to be dead. Are there any efforts to make e-mail secure by default and e2e encrypted?.

psiconaut 10y ago
A few projects that I'm aware of (disclaimer: I'm involved with LEAP): - https://pixelated-project.org/ https://pixelated-project.org/ - https://www.mailpile.is/ https://www.mailpile.is/ - https://modernpgp.org/memoryhole/ https://modernpgp.org/memoryhole/ - https://inbome.readthedocs.io/en/latest/ https://inbome.readthedocs.io/en/latest/ - https://leap.se/ https://leap.se/ Edit: btw, if you're in Berlin from 14-18 Dec, drop by the AME2016 unconf+hackaton https://github.com/mailencrypt/ame2016 https://github.com/mailencrypt/ame2016
- rakoo 10y ago
  That's a very nice list of links and overlaps with some idea I had, thanks a lot ! INBOME in particular looks to me to be (part of) the way forward, is there any way to follow progress ?
  - psiconaut 10y ago
    some discussiong going on in the ame2016 ML: https://lists.mayfirst.org/mailman/listinfo/ame2016 https://lists.mayfirst.org/mailman/listinfo/ame2016 you can also track the repo: https://github.com/mailencrypt/inbome/ https://github.com/mailencrypt/inbome/
- 102030485868 10y ago
  Hah: http://i.imgur.com/YphQVru.png http://i.imgur.com/YphQVru.png
  - raimue 10y ago
    It does not have a valid certificate just like any other custom domain hosted on GitHub Pages.
    - mixedCase 10y ago
      Then you shouldn't consider either GH pages for hosting a security-oriented project or a custom domain redirect.
deleted 10y ago
[deleted]
CalRobert 10y ago
Doesn't cover "default", but mailvelope is a project working on making email for real people (i.e. webmail) easy to secure. I use it often. https://www.mailvelope.com/ https://www.mailvelope.com/
- 45h34jh53k4j 10y ago
  Requires private keys to loaded into the browser extension. No thanks! Google's E2E is the same, which is to, say garbage.
  - mixedCase 10y ago
    There's no way of doing E2E without a key in the client, per its very definition.
kkl 10y ago
Most interesting e2e projects have abandoned email, specifically SMTP, as a secure messaging platform. I would look outside SMTP-based solutions if I were to start using a different project (assuming doing so is an option... I hope it is!). My recommendation here is Signal: https://whispersystems.org/ https://whispersystems.org/
- CmdrSprinkles 10y ago
  A big problem is that a lot of this is driven less by people who have a genuine need for encrypted communication and more by people who want one on principle. And the latter tend to include the people who are more likely to try The Next New Thing. And it also makes sense. A lot of these services are from companies that need to make money. And there isn't much money in the journalists and dissidents who don't have a bespoke solution.
- Freak_NL 10y ago
  The author of the article mentions Signal as well, but how do you handle communication from a laptop or desktop computer and/or with people who don't own an Android or IOS smartphone?
  - kkl 10y ago
    Signal does have a desktop application. I believe you can also register a Signal account using a phone number from a service like Twilio. I'm not 100% sure that will work with Signal desktop though. https://whispersystems.org/blog/signal-desktop/ https://whispersystems.org/blog/signal-desktop/
    - sliken 10y ago
      Signal in a chrome app can pair to signal on android/IOS. But I don't believe you can use chrome only. The chrome app just waits for you to pair with a phone and can't send/receive messages until you do so.
- NoGravitas 10y ago
  Signal is nice, and I use it. But it's an instant messaging system. Email has different use cases. I think what we're going to need is a new, non-SMTP protocol, which preserves all of the good things about email, while providing e2e encryption and (pseudonymous) identity assurance. I don't know enough to be involved in designing that protocol, though, other than saying what I want to see as an end-user.
CoryG89 10y ago
There is a reason they mostly don't exist, at least in the US. After Lavabit was so publicly shut down, it's going to be a losing proposition for anyone to put so much time and effort into it, just to then be given a choice between providing a backdoor or shutting down as soon as the government realizes they can't break your service. If your going to start such a service, it needs to be in a country that will respect free speech. And there aren't many.
- mixedCase 10y ago
  Lavabit didn't do E2E or at least stored the user's keys; since the owner did in fact have the keys needed to unencrypt the Snowden e-mails (and sent them to the FBI in paper using infinitely small character size, apparently).
  - CoryG89 10y ago
    IIRC, they did not store user's keys. What they wanted was for Lavabit to turn over their SSL key, which would have compromised security for the entire service, rather than just targeting Snowden specifically. Presumably they did not have the ability to turn over the emails themselves, so they wanted Lavabit to provide a vector to do a man in the middle attack.
drzaiusapelord 10y ago
Why not S/MIME? Most clients support it, its stupid easy, and has had a lot of eyes on it considering its age. Constantly re-inventing email encryption seems to be the problem here. None of them really make this stuff any better. Key distribution is still going to be PITA, but sticking with a supported standard makes the most sense.
- drdaeman 10y ago
  No one seem to want to touch anything that already exists. Never heard of anyone thinking of redesigning UI/UX for a typical MUA or browser's keystore (throwing in BTBV option or whatever), although I still believe that must be possible. Everyone's off with their own proprietary non-interoperable (occasionally, "open") standards. Also, _almost_ no client supports _any_ form of authentication and encryption on mobile, be it OpenPGP, S/MIME, PEP, SaltPack or whatever else. There are few, but that's not even remotely close to "most". Neither there is much choice of good desktop client software as well.
  - drzaiusapelord 10y ago
    iPhone supports S/MIME out of the box. Android has 3rd party mail clients that do. Several desktop clients do, including Outlook. Its not as dire as you make it to be. People just dont want the hassle and don't value their email privacy. Once they do value this, which they should considering all the breaches of late, then it'll catch on. I work with companies that have S/MIME internally for just this reason. Its completely feasible.
  - noinsight 10y ago
    > authentication and encryption on mobile The iOS built-in Mail application supports S/MIME. However, it doesn't support anything above TLS 1.0 for IMAP, curiously. K-9 and the Android mail client don't support S/MIME, however. On the desktop, Thunderbird and Outlook support S/MIME. So does mutt.
mtgx 10y ago
Google's End-To-End also seems dead. https://github.com/google/end-to-end https://github.com/google/end-to-end I would say ProtonMail or the miniLock-based Peerio.com are now the most interesting projects for encrypted email. EDIT: https://minilock.io/ https://minilock.io/ https://github.com/PeerioTechnologies/peerio-client https://github.com/PeerioTechnologies/peerio-client
- 45h34jh53k4j 10y ago
  Private keys accessible to the browser is the worst model. I don't think this was ever taken seriously at Google either...
  - mtgx 10y ago
    It's not the worst model. It's still significantly better than what Google/Microsoft/Yahoo are offering. And at least it's a model that can scale. When we'll get 10% of the email users to use (real) PGP, then we can talk about about switching everything else to it, too. But I assume that's never going to happen. The only way PGP would reach those numbers is if Google actually finishes the End-to-End tool, and not only that, but then it actually makes it part of the Chrome browser and automatically asks all Gmail users at sign-in if they want to set-up End-to-End, too. That's the only way I can see PGP reach 10% of the email market. But even then I assume you'd argue it's still "browser-based" encryption. So I guess it's pointless.
  - nickik 10y ago
    Private key required in the browser is bad. However if we had a system where those people that want or care can key their keys offline (or on a Smartcard) while those that don't want. Protonmail with SRP and 2FA where a attack has to pretty tricky stuff but you still get a e2e system is far better then what we have now. Its a far more involved attack to just look at your old emails, and its easier to detect. We will never have a useable experience for all user if we do not accept compromises. I would prefer if everybody of my family was on some system like that, compared to gmx or yahoo. There is a lot more you can do to protect the client from the server as well. Keybase is doing some interesting stuff in that direction. We just have the change our assumption of what it means if a email arrives encrypted with GPG. GPG is already not perfect and we should move away from it anyway, again, Keybase is offering some interesting steps in the right direction. Steps on a long road.
teddyh 10y ago
https://pep.foundation/ https://pep.foundation/ Commercial offerings for companies at https://www.prettyeasyprivacy.com/ https://www.prettyeasyprivacy.com/ (No, they are not, as far as I know “open core” – they are 100% free software.)

A few projects that I'm aware of (disclaimer: I'm involved with LEAP): - https://pixelated-project.org/ https://pixelated-project.org/ - https://www.mailpile.is/ https://www.mailpile.is/ - https://modernpgp.org/memoryhole/ https://modernpgp.org/memoryhole/ - https://inbome.readthedocs.io/en/latest/ https://inbome.readthedocs.io/en/latest/ - https://leap.se/ https://leap.se/ Edit: btw, if you're in Berlin from 14-18 Dec, drop by the AME2016 unconf+hackaton https://github.com/mailencrypt/ame2016 https://github.com/mailencrypt/ame2016

rakoo 10y ago
That's a very nice list of links and overlaps with some idea I had, thanks a lot ! INBOME in particular looks to me to be (part of) the way forward, is there any way to follow progress ?
- psiconaut 10y ago
  some discussiong going on in the ame2016 ML: https://lists.mayfirst.org/mailman/listinfo/ame2016 https://lists.mayfirst.org/mailman/listinfo/ame2016 you can also track the repo: https://github.com/mailencrypt/inbome/ https://github.com/mailencrypt/inbome/
102030485868 10y ago
Hah: http://i.imgur.com/YphQVru.png http://i.imgur.com/YphQVru.png
- raimue 10y ago
  It does not have a valid certificate just like any other custom domain hosted on GitHub Pages.
  - mixedCase 10y ago
    Then you shouldn't consider either GH pages for hosting a security-oriented project or a custom domain redirect.

deleted 10y ago

[deleted]

CalRobert 10y ago

Doesn't cover "default", but mailvelope is a project working on making email for real people (i.e. webmail) easy to secure. I use it often. https://www.mailvelope.com/ https://www.mailvelope.com/

45h34jh53k4j 10y ago
Requires private keys to loaded into the browser extension. No thanks! Google's E2E is the same, which is to, say garbage.
- mixedCase 10y ago
  There's no way of doing E2E without a key in the client, per its very definition.

kkl 10y ago

Most interesting e2e projects have abandoned email, specifically SMTP, as a secure messaging platform. I would look outside SMTP-based solutions if I were to start using a different project (assuming doing so is an option... I hope it is!). My recommendation here is Signal: https://whispersystems.org/ https://whispersystems.org/

CmdrSprinkles 10y ago
A big problem is that a lot of this is driven less by people who have a genuine need for encrypted communication and more by people who want one on principle. And the latter tend to include the people who are more likely to try The Next New Thing. And it also makes sense. A lot of these services are from companies that need to make money. And there isn't much money in the journalists and dissidents who don't have a bespoke solution.
Freak_NL 10y ago
The author of the article mentions Signal as well, but how do you handle communication from a laptop or desktop computer and/or with people who don't own an Android or IOS smartphone?
- kkl 10y ago
  Signal does have a desktop application. I believe you can also register a Signal account using a phone number from a service like Twilio. I'm not 100% sure that will work with Signal desktop though. https://whispersystems.org/blog/signal-desktop/ https://whispersystems.org/blog/signal-desktop/
  - sliken 10y ago
    Signal in a chrome app can pair to signal on android/IOS. But I don't believe you can use chrome only. The chrome app just waits for you to pair with a phone and can't send/receive messages until you do so.
NoGravitas 10y ago
Signal is nice, and I use it. But it's an instant messaging system. Email has different use cases. I think what we're going to need is a new, non-SMTP protocol, which preserves all of the good things about email, while providing e2e encryption and (pseudonymous) identity assurance. I don't know enough to be involved in designing that protocol, though, other than saying what I want to see as an end-user.

CoryG89 10y ago

There is a reason they mostly don't exist, at least in the US. After Lavabit was so publicly shut down, it's going to be a losing proposition for anyone to put so much time and effort into it, just to then be given a choice between providing a backdoor or shutting down as soon as the government realizes they can't break your service. If your going to start such a service, it needs to be in a country that will respect free speech. And there aren't many.

mixedCase 10y ago
Lavabit didn't do E2E or at least stored the user's keys; since the owner did in fact have the keys needed to unencrypt the Snowden e-mails (and sent them to the FBI in paper using infinitely small character size, apparently).
- CoryG89 10y ago
  IIRC, they did not store user's keys. What they wanted was for Lavabit to turn over their SSL key, which would have compromised security for the entire service, rather than just targeting Snowden specifically. Presumably they did not have the ability to turn over the emails themselves, so they wanted Lavabit to provide a vector to do a man in the middle attack.

drzaiusapelord 10y ago

Why not S/MIME? Most clients support it, its stupid easy, and has had a lot of eyes on it considering its age. Constantly re-inventing email encryption seems to be the problem here. None of them really make this stuff any better. Key distribution is still going to be PITA, but sticking with a supported standard makes the most sense.

drdaeman 10y ago
No one seem to want to touch anything that already exists. Never heard of anyone thinking of redesigning UI/UX for a typical MUA or browser's keystore (throwing in BTBV option or whatever), although I still believe that must be possible. Everyone's off with their own proprietary non-interoperable (occasionally, "open") standards. Also, _almost_ no client supports _any_ form of authentication and encryption on mobile, be it OpenPGP, S/MIME, PEP, SaltPack or whatever else. There are few, but that's not even remotely close to "most". Neither there is much choice of good desktop client software as well.
- drzaiusapelord 10y ago
  iPhone supports S/MIME out of the box. Android has 3rd party mail clients that do. Several desktop clients do, including Outlook. Its not as dire as you make it to be. People just dont want the hassle and don't value their email privacy. Once they do value this, which they should considering all the breaches of late, then it'll catch on. I work with companies that have S/MIME internally for just this reason. Its completely feasible.
- noinsight 10y ago
  > authentication and encryption on mobile The iOS built-in Mail application supports S/MIME. However, it doesn't support anything above TLS 1.0 for IMAP, curiously. K-9 and the Android mail client don't support S/MIME, however. On the desktop, Thunderbird and Outlook support S/MIME. So does mutt.

mtgx 10y ago

Google's End-To-End also seems dead. https://github.com/google/end-to-end https://github.com/google/end-to-end I would say ProtonMail or the miniLock-based Peerio.com are now the most interesting projects for encrypted email. EDIT: https://minilock.io/ https://minilock.io/ https://github.com/PeerioTechnologies/peerio-client https://github.com/PeerioTechnologies/peerio-client

45h34jh53k4j 10y ago
Private keys accessible to the browser is the worst model. I don't think this was ever taken seriously at Google either...
- mtgx 10y ago
  It's not the worst model. It's still significantly better than what Google/Microsoft/Yahoo are offering. And at least it's a model that can scale. When we'll get 10% of the email users to use (real) PGP, then we can talk about about switching everything else to it, too. But I assume that's never going to happen. The only way PGP would reach those numbers is if Google actually finishes the End-to-End tool, and not only that, but then it actually makes it part of the Chrome browser and automatically asks all Gmail users at sign-in if they want to set-up End-to-End, too. That's the only way I can see PGP reach 10% of the email market. But even then I assume you'd argue it's still "browser-based" encryption. So I guess it's pointless.
- nickik 10y ago
  Private key required in the browser is bad. However if we had a system where those people that want or care can key their keys offline (or on a Smartcard) while those that don't want. Protonmail with SRP and 2FA where a attack has to pretty tricky stuff but you still get a e2e system is far better then what we have now. Its a far more involved attack to just look at your old emails, and its easier to detect. We will never have a useable experience for all user if we do not accept compromises. I would prefer if everybody of my family was on some system like that, compared to gmx or yahoo. There is a lot more you can do to protect the client from the server as well. Keybase is doing some interesting stuff in that direction. We just have the change our assumption of what it means if a email arrives encrypted with GPG. GPG is already not perfect and we should move away from it anyway, again, Keybase is offering some interesting steps in the right direction. Steps on a long road.

teddyh 10y ago

https://pep.foundation/ https://pep.foundation/ Commercial offerings for companies at https://www.prettyeasyprivacy.com/ https://www.prettyeasyprivacy.com/ (No, they are not, as far as I know “open core” – they are 100% free software.)