3 ms·

I appreciate the clarification, thanks. It’s interesting that you feel email has a lot of traction and is broken, but you see that as an argument for moving aw

I appreciate the clarification, thanks. It’s interesting that you feel email has a lot of traction and is broken, but you see that as an argument for moving away from it. I would think it’s an opportunity to fix that system, since users are unlikely to switch. I’ve thought quite a bit about what making email like Signal would look like, but I’m curious what’s your take on the overall problem.

lvh 7y ago
I do not think it is meaningfully possible to fix that system (I say meaningfully, because I'm excepting the pathological senses I mentioned above). If you want it to look, feel like email and be compatible, you can't secure it. MTA-STS works because it does not require end users to do anything. If you need end users to change their workflow, you could try to do that with e-mail (which fundamentally can't do all the things you need it, per the post and the PGP post), or you can just make them use a non-broken protocol.
- leshokunin 7y ago
  I guess I don’t understand why you would think that the following wouldn’t work: - use random email addresses - encrypt the content with something more secure than PGP (on the client) - receive the email and decrypt it (on the client) Sure, it’s plaintext, but I don’t see the downside?
  - lvh 7y ago
    How do I securely communicate what the new email address is? How do I hide IP-level metadata? How do I hide time-level metadata? How do I do PFS? At some point you're going to keep adding lipstick to the pig until eventually you have something morally equivalent to the pathological example I gave.
    - leshokunin 7y ago
      That's interesting. Thanks for taking the time to expand on it.
the_hoser 7y ago
The security flaws with email are completely fundamental. It is not possible to "fix" email without disrupting the existing users. If you're forced to disrupt existing users, then you might as well switch to a more securely designed protocol.

lvh 7y ago

I do not think it is meaningfully possible to fix that system (I say meaningfully, because I'm excepting the pathological senses I mentioned above). If you want it to look, feel like email and be compatible, you can't secure it. MTA-STS works because it does not require end users to do anything. If you need end users to change their workflow, you could try to do that with e-mail (which fundamentally can't do all the things you need it, per the post and the PGP post), or you can just make them use a non-broken protocol.

leshokunin 7y ago
I guess I don’t understand why you would think that the following wouldn’t work: - use random email addresses - encrypt the content with something more secure than PGP (on the client) - receive the email and decrypt it (on the client) Sure, it’s plaintext, but I don’t see the downside?
- lvh 7y ago
  How do I securely communicate what the new email address is? How do I hide IP-level metadata? How do I hide time-level metadata? How do I do PFS? At some point you're going to keep adding lipstick to the pig until eventually you have something morally equivalent to the pathological example I gave.
  - leshokunin 7y ago
    That's interesting. Thanks for taking the time to expand on it.

the_hoser 7y ago

The security flaws with email are completely fundamental. It is not possible to "fix" email without disrupting the existing users. If you're forced to disrupt existing users, then you might as well switch to a more securely designed protocol.