4 ms·

Does it matter if your email is encrypted at rest when every recipient you email will store it unencrypted and it is unencrypted in transit?

by beart 8y ago

finnthehuman 8y ago
The first step of getting a critical mass on the other side of the encryption line is a slow stream of people migrating and seeing no immediate benefit. This defeatist attitude is something the surveillance companies have taught you to have. Stemming the tide is possible.
- beart 8y ago
  In the case of email, the only way I can see a critical mass being reached is if both Google and Microsoft start encrypting. Does anyone else even compare to them in terms of volume of email accounts? I just find it very difficult to imagine the general public making this happen. I think it must come from the top down as most people don't understand or don't care. For SSL to hit critical mass, it took the major browsers to start flagging pages as insecure coupled with the proliferation of let's encrypt. All the personal web pages in the world switching to SSL would not have forced the major players in the same way.
  - lucideer 8y ago
    Encryption is done at the client level, not the account level. Yes, a large majority of Google and MS users probably use the web uis of the service itself, or Google/ms clients, but the point is that switching client doesn't mandate switching provider. You can even manage your Google account via a 3rd-party web ui.
phicoh 8y ago
Mail is very often encrypted in transit. There is a lack of authentication, so a man-in-middle attack is often possible. But passively listening doesn't work. It is not clear how mail should be stored at rest. A mail server at your own home is one solution. Encrypting all mail with pgp another. Neither solution is likely to scale in the coming years. Maybe it is better to say truely private things only over encrypted chat at the moment.
hopler 8y ago
No, but it's not your email provider's job to police your associates' use of data you share with them. Don't give information to people you don't trust.

Does it matter if your email is encrypted at rest when every recipient you email will store it unencrypted and it is unencrypted in transit?

by beart 8y ago

Does it matter if your email is encrypted at rest when every recipient you email will store it unencrypted and it is unencrypted in transit?

finnthehuman 8y ago

The first step of getting a critical mass on the other side of the encryption line is a slow stream of people migrating and seeing no immediate benefit. This defeatist attitude is something the surveillance companies have taught you to have. Stemming the tide is possible.

beart 8y ago
In the case of email, the only way I can see a critical mass being reached is if both Google and Microsoft start encrypting. Does anyone else even compare to them in terms of volume of email accounts? I just find it very difficult to imagine the general public making this happen. I think it must come from the top down as most people don't understand or don't care. For SSL to hit critical mass, it took the major browsers to start flagging pages as insecure coupled with the proliferation of let's encrypt. All the personal web pages in the world switching to SSL would not have forced the major players in the same way.
- lucideer 8y ago
  Encryption is done at the client level, not the account level. Yes, a large majority of Google and MS users probably use the web uis of the service itself, or Google/ms clients, but the point is that switching client doesn't mandate switching provider. You can even manage your Google account via a 3rd-party web ui.

phicoh 8y ago

Mail is very often encrypted in transit. There is a lack of authentication, so a man-in-middle attack is often possible. But passively listening doesn't work. It is not clear how mail should be stored at rest. A mail server at your own home is one solution. Encrypting all mail with pgp another. Neither solution is likely to scale in the coming years. Maybe it is better to say truely private things only over encrypted chat at the moment.

hopler 8y ago

No, but it's not your email provider's job to police your associates' use of data you share with them. Don't give information to people you don't trust.