4 ms·
Email does use TLS for encryption to the server but once it hits the server (usually owned by a mega corp like google) it gets decrypted so they can read it. E
by SilverRed 6y ago
Email does use TLS for encryption to the server but once it hits the server (usually owned by a mega corp like google) it gets decrypted so they can read it.
Email encryption is different because HTTPS certifies that you are connected to the owner of that domain name. How do I certify to you that the email you just received came from me and not someone pretending to be me?
The only bullet proof secure way is if I visit you in person and hand you a copy of my public key and then you use that key to verify my emails. We have had tools to do this with email for over a decade but they are so inconvenient that no one uses it outside of a few privacy nuts.
- berkes 6y agoThanks for the namecalling. I use PGP quite often. And I know how hard it is and how much it lacks. But I'm no 'privacy nut'. A legitimate easy and underused option is how kraken employs it. I've uploaded my public key. They now send all transactional, security and other mail signed and encrypted. This is a solid solution to phishing. The only part 'missing' is how I get my pub key on my kraken account. For me it was an export+copy+paste. But it should probably as easy as an OAUTH alike flow between kraken and my mailprovider. 'Kraken wants to import your public key to sign and encrypt it's emails to you'. An UI thing.