5 ms·

The issue with encrypted email a-la PGP even beyond security issues is the laughably bad UX. I'm not going to be able to convince people to adopt the best pract

The issue with encrypted email a-la PGP even beyond security issues is the laughably bad UX. I'm not going to be able to convince people to adopt the best practices involved in maintaining keys and using them to encrypt and decrypt the mail they send. Whether that is good or bad is immaterial- the cat is out of the bag and people are already used to the convenience of insecure incumbents. For messaging, we need something that is end to end encrypted by default, and is also only available in an e2ee format. Decentralization is an additional bonus, but really as long as the protocols are heavily audited and the clients are reasonably open (reproducible builds etc), it doesn't matter what your choice is and what networks your messages go through/who controls them.

JohnJamesRambo 5y ago
Could Signal ever do an email service? I’d switch to it in a second. I realize I’d be sending it to insecure addresses but at least my end wouldn’t spy on me? I just realized how dystopian that sentence is.
- Anunayj 5y ago
  even if they do, you have to maintain compatibility with "other" popular email providers. Protonmail encrypts all it's emails among it's own users. But at the end me with my gmail can't read them without jumping through hoops.
  - mmerlin 5y ago
    Mailvelope and it's browser plugin is fairly easy for encrypting gmail (and other major email providers) conversations: https://chrome.google.com/webstore/detail/mailvelope/kajibbejlbohfaggdiogboambcijhkke https://chrome.google.com/webstore/detail/mailvelope/kajibbe...
- approxim8ion 5y ago
  Thing with email is that you'd also have to get everyone you talk to to move to it and ensure they don't fall back to any of the services they have been using for all this time for convenience's sake. At which point, it doesn't even matter if it is email behind the scenes or something else. There's also the issue of SMTP being very metadata heavy and there being no option to mitigate or encrypt any of the metadata. Which is why something like Delta Chat (if you haven't heard of it, it's basically Signal/WhatsApp like IM piggybacking over email) isn't very private.
- mmerlin 5y ago
  The guerilla growth marketers working for Signal would probably be unable to resist the viral temptation of spamming all your email address list who have already joined signal to "let them know" about your newly installed contact channel. I was super-annoyed when two people from my distant past started trying to contact me via Signal purely because of the unwanted and un-asked for behaviour of vacuum-and-spam notification of my phone contact list (which had accumulated from before 2000) who were in the subset of already-Signal-members. In particular one huckster I lost $22k to, and who I came close to being liable for taking illegal action on behalf, through his fraudulent lack of full disclosure, who I had thoroughly removed from all my social media, plus filtered his email straight to trash, and permanently blocked from calling my phone. Because his phone number was in my address book (so I could block him) Signal thought it had the right to let him know he can now contact me. Poor form there Signal...
  - egberts1 5y ago
    write a big report?
    - wizzwizz4 5y ago
      They already know about the problem; they've known for years now.
  - egberts1 5y ago
    i am going to stop you there. The mere fact that you had a phone number in your address book is what made your locally client-side Signal app made the notification… locally. This newly discovered mechanism does not alert the remote Signal app. Just the mere fact that you allowed Signal app access to your local address book and actually ran all numbers against the central server is not clearly stated in their type of service (TOS). This is the primary reason why i never let Signal app have access to my Contacts/address-book. This is why we have no idea what else Signal is doing with remote phone numbers found in our address book. I was able to ascertain between two phones of this one-sided aspect (but for how long)?
    - 5y ago

JohnJamesRambo 5y ago

Could Signal ever do an email service? I’d switch to it in a second. I realize I’d be sending it to insecure addresses but at least my end wouldn’t spy on me? I just realized how dystopian that sentence is.

Anunayj 5y ago
even if they do, you have to maintain compatibility with "other" popular email providers. Protonmail encrypts all it's emails among it's own users. But at the end me with my gmail can't read them without jumping through hoops.
- mmerlin 5y ago
  Mailvelope and it's browser plugin is fairly easy for encrypting gmail (and other major email providers) conversations: https://chrome.google.com/webstore/detail/mailvelope/kajibbejlbohfaggdiogboambcijhkke https://chrome.google.com/webstore/detail/mailvelope/kajibbe...
approxim8ion 5y ago
Thing with email is that you'd also have to get everyone you talk to to move to it and ensure they don't fall back to any of the services they have been using for all this time for convenience's sake. At which point, it doesn't even matter if it is email behind the scenes or something else. There's also the issue of SMTP being very metadata heavy and there being no option to mitigate or encrypt any of the metadata. Which is why something like Delta Chat (if you haven't heard of it, it's basically Signal/WhatsApp like IM piggybacking over email) isn't very private.
mmerlin 5y ago
The guerilla growth marketers working for Signal would probably be unable to resist the viral temptation of spamming all your email address list who have already joined signal to "let them know" about your newly installed contact channel. I was super-annoyed when two people from my distant past started trying to contact me via Signal purely because of the unwanted and un-asked for behaviour of vacuum-and-spam notification of my phone contact list (which had accumulated from before 2000) who were in the subset of already-Signal-members. In particular one huckster I lost $22k to, and who I came close to being liable for taking illegal action on behalf, through his fraudulent lack of full disclosure, who I had thoroughly removed from all my social media, plus filtered his email straight to trash, and permanently blocked from calling my phone. Because his phone number was in my address book (so I could block him) Signal thought it had the right to let him know he can now contact me. Poor form there Signal...
- egberts1 5y ago
  write a big report?
  - wizzwizz4 5y ago
    They already know about the problem; they've known for years now.
- egberts1 5y ago
  i am going to stop you there. The mere fact that you had a phone number in your address book is what made your locally client-side Signal app made the notification… locally. This newly discovered mechanism does not alert the remote Signal app. Just the mere fact that you allowed Signal app access to your local address book and actually ran all numbers against the central server is not clearly stated in their type of service (TOS). This is the primary reason why i never let Signal app have access to my Contacts/address-book. This is why we have no idea what else Signal is doing with remote phone numbers found in our address book. I was able to ascertain between two phones of this one-sided aspect (but for how long)?
  - 5y ago