3 ms·
> the solution to things that are broken and hard is not to abandon them like a petulent child out of frustration. Are we trying to enable secure E2E encrypted
by danShumway 5y ago
> the solution to things that are broken and hard is not to abandon them like a petulent child out of frustration.
Are we trying to enable secure E2E encrypted messages, or are we trying to enable secure E2E email? Because those are two different goals.
If we're worried about fixing unencrypted messages, then I think it's completely valid to look at systems like Email and SMS and to say that they're just not suitable for secure conversations, and to advise people to move to other platforms/protocols for secure communication that doesn't have their flaws.
Signal is currently a good solution for a lot of people. That doesn't mean it doesn't have problems, but it has great encryption that is almost impossible for an ordinary user to accidentally mis-configure. Matrix is also coming into its own as a good solution, and while I don't necessarily recommend Matrix over Signal if encryption is absolutely important, it is very likely going to be a better solution in the future, and for casual encryption is a pretty good solution today.
Both Matrix and Signal are easier to use than PGP for ordinary users. They are both (frankly) more reliable even for advanced users. And with the amount of effort we could put into fixing PGP-encrypted emails, we could also make a platform like Matrix really good and push really hard for its adoption. Getting people to adopt Matrix is going to be easier than getting people to adopt encrypted emails. Incidentally Matrix also improves upon a number of other centralization and protocol problems with email as well, but we're focusing specifically on encryption here.
Sometimes working to a specific goal (encrypting plaintext communication) means recognizing when a strategy is bad, and pivoting to another strategy that's more pragmatic but that accomplishes the same goals. For example, I'm not going to waste time trying to "fix" SMS security for 2FA when I can tell people to install an Open Source 2FA app instead -- because the goal isn't to make email safe, and the goal isn't to make SMS safe, the goal is to make people safe. Broadening out our strategies and building cleaner, more fundamentally secure technologies is part of that.
- bscphil 5y agoI think you're both right. Email is subpar as a protocol for sending secure messages (what you said) and should therefore be abandoned as a protocol in favor of something better, and also many of the specific arguments made in the article are quite weak (what they said). E.g. PGP doesn't make dragnet surveillance harder?? Unless you assume that point-to-point encryption makes it entirely impossible (wrong), PGP clearly makes it much harder for anyone to read your message.
- deleted 5y ago[deleted]