3 ms·
I think the real meat of the question is the extent to which they cooperate with law enforcement. Do they respond to requests to extract keys from the client? O
by manfredo 7y ago
I think the real meat of the question is the extent to which they cooperate with law enforcement. Do they respond to requests to extract keys from the client? Or used compromised keys for select users? If the government orders them to build such a mechanism to their client then encryption doesn't help. Even things like tracking the dates that messages are sent and received can make users vulnerable to correlation attacks.
I stand by the claim that the only truly secure mail is to do your own encryption and decryption client-side with open source tools. Anything done by a 3rd party service should be assumed to be compromised.
- sorokod 7y agoNothing prevents you from attempting your own client side security. This is in no way related to the issue at hand.
- everdrive 7y agoIf the government could force them to extract keys from clients, to utilize compromise keys, or build a mechanism into a silent update, what makes you think and other company would have a different choice? Wouldn't such a government pose the same threat to any email provider?
- manfredo 7y ago> what makes you think and other company would have a different choice? A company that operates in a country where the government is legally forbidden from doing such things would be more resilient to attack through the judicial or law enforcement system. Granted, there's always the suspicion that surveillance maybe be conducted extra-judicially, but it's still better. I don't know of any such countries. I think the Apple v. FBI case was going to set precedence in this matter, but that never went to trial.