3 ms·

Whoever wrote what you quoted avoided to mention that the plugin (and I’d expect this new implementation) can protect the user from replying in plaintext to the

by acqq 7y ago

Whoever wrote what you quoted avoided to mention that the plugin (and I’d expect this new implementation) can protect the user from replying in plaintext to the encrypted message. And using PGP in some scenarios has an advantage for the users and is indeed less convenient for eavesdroppers. It seems that the later are especially motivated to promote fear against PGP.

dfabulich 7y ago
"The plugin" (which plugin? I'm referring to the GPG plugin for macOS mail) doesn't prevent forwarding as far as I can see. The point isn't "use non-PGP email", the point is "don't use email at all for secure communications. Use a secure messaging app instead."
- heavenlyblue 7y ago
  So let’s say I copy a message from WhatsApp to a message board, does that disqualify WhatsApp from being a “secure messaging app”?
  - dfabulich 7y ago
    The point isn't that you forwarded the secret (indeed, that was on purpose). The point is that you forwarded the secret in plaintext, because email is plaintext by default, and the forwarding person probably didn't realize that, because no email client (even with GPG plugins) posts a big red warning label saying "stop! this is plaintext" because that's 99% of all emails.
    - acqq 7y ago
      > because no email client (even with GPG plugins) posts a big red warning label saying "stop! this is plaintext" I've used a plugin that did exactly that: warned when the encrypted e-mail is replied to or forwarded as plain text. If such a plugin is not commonly used with e-mail clients that can't be a proof that e-mail encryption is inherently bad, just that that feature should exist. Mozilla implementers, I hope you're inspired.
tptacek 7y ago
That'd be me, and I avoided to mention that because it doesn't matter. People aren't making up the plaintext-reply problem; a person on HN that tells me they've never seen it is more loudly communicating that they rarely actually use PGP.

by acqq 7y ago

dfabulich 7y ago

"The plugin" (which plugin? I'm referring to the GPG plugin for macOS mail) doesn't prevent forwarding as far as I can see. The point isn't "use non-PGP email", the point is "don't use email at all for secure communications. Use a secure messaging app instead."

heavenlyblue 7y ago
So let’s say I copy a message from WhatsApp to a message board, does that disqualify WhatsApp from being a “secure messaging app”?
- dfabulich 7y ago
  The point isn't that you forwarded the secret (indeed, that was on purpose). The point is that you forwarded the secret in plaintext, because email is plaintext by default, and the forwarding person probably didn't realize that, because no email client (even with GPG plugins) posts a big red warning label saying "stop! this is plaintext" because that's 99% of all emails.
  - acqq 7y ago
    > because no email client (even with GPG plugins) posts a big red warning label saying "stop! this is plaintext" I've used a plugin that did exactly that: warned when the encrypted e-mail is replied to or forwarded as plain text. If such a plugin is not commonly used with e-mail clients that can't be a proof that e-mail encryption is inherently bad, just that that feature should exist. Mozilla implementers, I hope you're inspired.

tptacek 7y ago

That'd be me, and I avoided to mention that because it doesn't matter. People aren't making up the plaintext-reply problem; a person on HN that tells me they've never seen it is more loudly communicating that they rarely actually use PGP.