3 ms·
One of my suppliers sends me PGP encrypted email invoices using an automated system. It works perfectly well for my threat model. Security vulnerabilities in pr
by rlpb 7y ago
One of my suppliers sends me PGP encrypted email invoices using an automated system. It works perfectly well for my threat model. Security vulnerabilities in processing this may exist, but so they might in every other system; there's no special vulnerability in email or PGP here.
I understand that this article is for the secure human-to-human messaging use case. That's fine; I have no argument with this. But outside that context, it makes no sense, yet generic claims like "encrypted email is bad" are being made. This is too broad.
I understand that the majority of perceived demand* for encryption may be for secure messaging. On that basis, maybe you think it's OK to disparage encrypted email because a win in getting universal secure personal messaging with the modern desired properties would be worth the cost. But isn't this a strawman? Who exactly is a proponent of encrypted email for secure personal messaging anyway? Who is using PGP for personal encrypted communications today who is being harmed?
* Because most people don't care; it's only a minority of advocates who, rightly or wrongly, believe that everyone should.
- dfabulich 7y ago> It works perfectly well for my threat model. What threat model is this?! (In all honesty, I don't believe you. I presume you're paying those invoices, in which case whatever attacker you have in mind can just follow the money and monitor the metadata to learn everything they need to know about those invoices. Or, more likely, your threat model is "nobody's seriously gonna snoop on my payments to this supplier; I just think it's fun to play with PGP.")
- buildbuildbuild 7y agoThis is great. Which supplier if I might ask?