3 ms·

The thing that's hard to swallow is that you're recommending a plan that maybe solves the problem by 2050. Remember, STARTTLS was standardized 22 years ago and

The thing that's hard to swallow is that you're recommending a plan that maybe solves the problem by 2050. Remember, STARTTLS was standardized 22 years ago and you still can't reject emails from servers that don't use it unless you're okay with missing business-critical messages, in my experience. Meanwhile, Signal works today. It would be cool if there was a group working on the solution you've laid out, and maybe it'll still be relevant when it arrives, but if you have any privacy needs before you retire we have to point you at Signal.

cipherboy 7y ago
Sure, but HTTP was started in '97, and yet we've gotten a decent replacement rate towards HTTPS. It's all about publicity and messaging. We made an explicit, coordinated push to get rid of HTTP. We're still working on it. Think of how many people were/are involved. We've not had a coordinated push for SMTP. TLS doesn't satisfy anything but a trivial threat and trust model (for secure messaging, when done at the SMTP layer). And that would involve a lot less people if we get it "right" (and it's only a new protocol and not a new app). If it were up to me (it's not), we'd have a solid technical spec and then try and make this happen. Rather than pushing STARTTLS. There is kinda a group working on a solution. I don't know what the current status is and what their funding levels are: https://darkmail.info/ https://darkmail.info/ For these purposes, the branding is all wrong. I've not read a recent version of the spec, but there's still commits as of 6 months ago.
- thedufer 7y ago
  Sure, but it seems to me that improving email is more similar to improving email than to improving HTTP. I think the STARTTLS push has gone more slowly than HTTPS for reasons that are fairly fundamental to email - it requires hitting more providers to get decent coverage. Chrome has >60% market share, while GMail is <30%.

cipherboy 7y ago

Sure, but HTTP was started in '97, and yet we've gotten a decent replacement rate towards HTTPS. It's all about publicity and messaging. We made an explicit, coordinated push to get rid of HTTP. We're still working on it. Think of how many people were/are involved. We've not had a coordinated push for SMTP. TLS doesn't satisfy anything but a trivial threat and trust model (for secure messaging, when done at the SMTP layer). And that would involve a lot less people if we get it "right" (and it's only a new protocol and not a new app). If it were up to me (it's not), we'd have a solid technical spec and then try and make this happen. Rather than pushing STARTTLS. There is kinda a group working on a solution. I don't know what the current status is and what their funding levels are: https://darkmail.info/ https://darkmail.info/ For these purposes, the branding is all wrong. I've not read a recent version of the spec, but there's still commits as of 6 months ago.

thedufer 7y ago
Sure, but it seems to me that improving email is more similar to improving email than to improving HTTP. I think the STARTTLS push has gone more slowly than HTTPS for reasons that are fairly fundamental to email - it requires hitting more providers to get decent coverage. Chrome has >60% market share, while GMail is <30%.