3 ms·
isn't the bigger issue that encrypted email is only encrypted in transit and not in place? After you send an encrypted email and it is decrypted on the other si
by pge 7y ago
isn't the bigger issue that encrypted email is only encrypted in transit and not in place? After you send an encrypted email and it is decrypted on the other side, odds are very high that it is sitting unencrypted on the mail server or local mail client. Most email breaches are not intercepting emails in transit but rather getting credential access to email servers.
- ipython 7y agoNot in this case. PGP mail or S/MIME are encrypted end to end. That said you may have a mail client which stores an unencrypted search index locally.
- SamWhited 7y agoThis is an orthogonal issue, not a bigger issue. The point of end to end encrypted email is that it doesn't sit unencrypted on the mail server. Whether it sits unencrypted on your client or not is something clients should work on, but it doesn't mean that using encrypted email in general isn't hard. I could equally say that the fact that metadata such as senders isn't encrypted is a problem, but that's not what this article is about. We can have that discussion, here just probably isn't the right place unless you're going to tie it back into why GPG is so hard to use somehow.
- floatingatoll 7y agoThere are no indications in this article that the user has at-rest plaintext on their mail server or in their local mail client. It's possible they aren't removing 'my-msg.txt' after they're done using it, or that the remote recipient is vulnerable to those issues, but that's unrelated to the user interface focus of this post.