2 ms·
If you want to send something securely, I’m not sure email is the best method. Even if you understand all the risks and pitfalls and side-step the minefields it
by beermonster 5y ago
If you want to send something securely, I’m not sure email is the best method. Even if you understand all the risks and pitfalls and side-step the minefields it’s still insecure in non-fixable ways. ProtonMail make a service out if it mitigating those issues as best they can (but even they explain their threat-model and what they DON’T mitigate. Others such as Silent Circle ended up giving up.
You could recommend to those non-technical people to either:
- Use Signal
- Sign up to two free ProtonMail accounts and use those to exchange with one another. That way they’re both e2e and don’t leave the eco-system. And no setting up of PGP keys and such like, and a nice web UI.
If they’re non-technical I wouldn’t suggest PGP IMHO. It’s actually easier to setup S/MIME for non-technical people (I’ve had some success there myself).
Of course part of this is that no one has solved the UX and usability and that it never reached mainstream in most ‘typical’ email clients. To set it all up you have to be fairly technical. When it should just work out of the box - like Signal.
- swiley 5y agoSignal is not secure if you're concerned about the App Store maintainer or Signal themselves having access to your data (you can't know what the contents of the app on the app store are and it my exfiltrate keys. This has been done with other similar apps in the past.)
- throwaway45209 5y ago// This has been done with other similar apps in the past. Such as?