5 ms·
Imagine HTTPS but where the site name and the URL of the resource were in plaintext and only the body was encrypted. That’s what PGP email feels like. It’s us
by gorgoiler 6y ago
Imagine HTTPS but where the site name and the URL of the resource were in plaintext and only the body was encrypted. That’s what PGP email feels like.
It’s useful for closed circuits though, where you have a group of correspondents needing to prove their authenticity. One company I use will sign their invoices, for example. I’ve never verified the signatures.
If you need to go to the technical effort of private group communication, running your own webmail service seems a lot easier and a lot more private.
I love PGP for other infra. I love my smartcards. But I can’t remember the last time I’ve used it for email :)
- gsich 6y agoThis is somewhat the case as SNI is unencrypted.
- m-p-3 6y agoBut there's eSNI.
- thayne 6y agoWhich is a very new technology, and not widely deployed yet.
- zaarn 6y agoI get about 5k unique visitors from my websites, additional 20k visitors from a community project I'm in. We see about 30 - 40% eSNI Adoption.
- thayne 6y agoAnd that is just client support. For eSNI to work, both client and server must support it.
- zaarn 6y agoAdoption, not support, meaning the clients and server both support it. I bet most of the non-supporting clients are simply either a bit outdated or had it disabled (probably by the client local AV engine).
- gsich 6y agoUnlikely. Since OpenSSL has no support for it (by extension this includes Apache and Nginx) because it's not a standard yet, adoption is very low. Also Chromium and by extension Chrome has no support for it. Firefox does support a draft, but since Firefox usage numbers are somewhat low depending on what statistic you believe, this amounts to not much.
- gsich 6y agoA draft. OpenSSL devs wait for it to be finished.
- BrandoElFollito 6y agoCould you expand on that please? SNI is not the full URL or am I missing something?
- thayne 6y agoOf course the other option with email is that everything is in plaintext... There are more secure options of course, but none of them are compatible with each other, and the most popular ones are more like instant messaging than email. I wish there was a secure communication channel similar to email, but as ubiquitous as https.
- gorgoiler 6y agoTrue. But mostly I’m cool knowing that I delivered over TLS.