4 ms·

> It might be worthwhile to bring Signal (or at least the idea) to other protocols like E-Mail. I'm glad to see someone else thinking the same way as me on thi

> It might be worthwhile to bring Signal (or at least the idea) to other protocols like E-Mail. I'm glad to see someone else thinking the same way as me on this! I got myself an idea for Yet Another Secure Messaging App a while back. After a little market research, I kinda decided, well, everything that I want to do can already be done by PGP, or Signal, or Whisper... except that where they are easy to use, they don't integrate with e-mail, and where the integrate with e-mail, they are not easy to use. So, there's still room for more diversity in the market of providing easy-to-use secure, verifiable messaging, especially without trying to replace e-mail wholesale like so many messaging platforms (secure and otherwise) do. And maybe I'll actually get around to building it someday.

tscs37 10y ago
The easy part is the crypto, that's been done to death and back. Signal has managed to do the "How can we exchange keys while atleast one of us is always offline?" part. So a good and somewhat PFS key exchange should be possible too. Integrating that seamlessly with email is gonna be hard and require a service to register emails or domains that support the new protocol. Otherwise you end up with the PGP situation. One want people's mail to automagically encrypt when both have it. Automagically is the best security there is for Joe Average. On the big list of security problems you face for Jane Average, "Werks Automagically" is Point 1 written in golden ink by the pope himself in 72pt fontsize and "Secure against State Adversaries" is Point 2 written in silver by the pope's cat on the second page in 16pt fontsize. One might also want to introduce a benefit, like disabling it for spammers by having some kind of verification (Phone Number or something?) and heavily police HTML formatting so that little Green Icon next the email means more than "this one spent 30 seconds to find a large prime pair" and more like "this email is probably safe to open, nobody will track you and nobody is going to sell you fake viagra". People should want to use it, not have to use it to be secure or something. But as you said, that all requires work and 99% of my time I personally like being unproductive, so I guess it'll never happen.

tscs37 10y ago

The easy part is the crypto, that's been done to death and back. Signal has managed to do the "How can we exchange keys while atleast one of us is always offline?" part. So a good and somewhat PFS key exchange should be possible too. Integrating that seamlessly with email is gonna be hard and require a service to register emails or domains that support the new protocol. Otherwise you end up with the PGP situation. One want people's mail to automagically encrypt when both have it. Automagically is the best security there is for Joe Average. On the big list of security problems you face for Jane Average, "Werks Automagically" is Point 1 written in golden ink by the pope himself in 72pt fontsize and "Secure against State Adversaries" is Point 2 written in silver by the pope's cat on the second page in 16pt fontsize. One might also want to introduce a benefit, like disabling it for spammers by having some kind of verification (Phone Number or something?) and heavily police HTML formatting so that little Green Icon next the email means more than "this one spent 30 seconds to find a large prime pair" and more like "this email is probably safe to open, nobody will track you and nobody is going to sell you fake viagra". People should want to use it, not have to use it to be secure or something. But as you said, that all requires work and 99% of my time I personally like being unproductive, so I guess it'll never happen.