3 ms·
The encryption of the connection is orthogonal. That's what HTTPS is for. And client-side encryption is managed by solutions like PGP. Doing it on the server-s
by bad_user 7y ago
The encryption of the connection is orthogonal. That's what HTTPS is for.
And client-side encryption is managed by solutions like PGP. Doing it on the server-side is incompatible with the email protocol IMO.
- chiefalchemist 7y agoSo server side is secured how?
- bad_user 7y agoNot sure I understand the question. What's your threat model?
- chiefalchemist 7y agoOn the server, the emails are all encrypted like say passwords? Or are they stored as text?
- TazeTSchnitzel 7y agoPasswords aren't encrypted, they are hashed. Every email service out there stores email in what by password standards is plaintext, but hopefully encrypted at rest.
- LeonM 7y agoJMAP (or IMAP for that matter) is the transport format. JMAP runs over HTTPS, so the connection is encrypted. The transport protocol says nothing about how data is stored on the MDA (the server). That's up to the implementation of the MDA, of which no standard exist. The MDA is something that you should trust, if you cannot trust the MDA, you shouldn't use it in the first place. What you need to worry about it transport, and that has been fixed by mandating HTTPS.