4 ms·

The point being made is that, if something is sensitive enough that you would hesitate to send it in the clear, you should send it over Signal or some other sys

The point being made is that, if something is sensitive enough that you would hesitate to send it in the clear, you should send it over Signal or some other system that doesn't have the security flaws that encrypted email has. Given that that option exists, and that encrypted email isn't suitable for many use cases that people are tempted to use it for (and is therefore an attractive nuisance securitywise), there's not much reason to use or support encrypted email at all.

sneak 5y ago
Normal people assume that email is a perfectly safe and secure way to transmit PII and other sensitive information, FWIW. The idea that "email is insecure" is not a widely known one.
- viraptor 5y ago
  One of the best ways for the "secure online communication with normies" idea to die is to try to buy a house, especially when not living in a city close to the relevant banks/lawyers/etc. If you don't stop caring and send some document scan full of PII as an email attachment after a few weeks - congratulations.
  - tinus_hn 5y ago
    Does it matter? If you send it securely or provide the documents for scanning at the office, they will go on and email it around themselves anyway. If this ever is to stop there needs to be a strict ban on using email for these things combined with checks and serious consequences for violations. But that will not happen anywhere soon because guess what, the government that would have to create these rules violates them routinely.
  - sneak 5y ago
    You have to set up a corporation that has your attorney (or other trustworthy authorized representative) as manager of the LLC. Then all the docs have their name/email/signature, and the LLC can just keep the name of the member in its own records. It's still PII, but at least it isn't your PII. The droids that process these things are not going to change their means of communication or list of requirements for your deal, so you just have to ensure that the information being plugged into their systems is the information of a placeholder person (ie your attorney/business manager) instead of your own.
mLuby 5y ago
And when you send it over Signal you ALWAYS do so as a disappearing message, because as the article says, "every archived message will eventually leak." (Also you hope nobody quote-replies to your message.)
gruez 5y ago
What about the use case of "I don't want my email provider to be able to read all my past transactional emails at a moment's notice"? Sure, there are "reputable" non-encrypting mail providers, but why not have a reputable mail provider AND encryption, so there's a barrier if they try to go rogue?
08-15 5y ago
Unfortunately, every device that has Signal installed, also has a root kit installed: the play store. If I use PGP-encrypted mail, I have to trust that the receiver is not stupid. If I use Signal, I have to trust that Google is not evil. Hmm...
- growse 5y ago
  Play services / store isn't needed to run Signal (try it on AOSP, works just fine) and none of the iOS devices that run Signal have the play store installed.

sneak 5y ago

Normal people assume that email is a perfectly safe and secure way to transmit PII and other sensitive information, FWIW. The idea that "email is insecure" is not a widely known one.

viraptor 5y ago
One of the best ways for the "secure online communication with normies" idea to die is to try to buy a house, especially when not living in a city close to the relevant banks/lawyers/etc. If you don't stop caring and send some document scan full of PII as an email attachment after a few weeks - congratulations.
- tinus_hn 5y ago
  Does it matter? If you send it securely or provide the documents for scanning at the office, they will go on and email it around themselves anyway. If this ever is to stop there needs to be a strict ban on using email for these things combined with checks and serious consequences for violations. But that will not happen anywhere soon because guess what, the government that would have to create these rules violates them routinely.
- sneak 5y ago
  You have to set up a corporation that has your attorney (or other trustworthy authorized representative) as manager of the LLC. Then all the docs have their name/email/signature, and the LLC can just keep the name of the member in its own records. It's still PII, but at least it isn't your PII. The droids that process these things are not going to change their means of communication or list of requirements for your deal, so you just have to ensure that the information being plugged into their systems is the information of a placeholder person (ie your attorney/business manager) instead of your own.

mLuby 5y ago

And when you send it over Signal you ALWAYS do so as a disappearing message, because as the article says, "every archived message will eventually leak." (Also you hope nobody quote-replies to your message.)

gruez 5y ago

What about the use case of "I don't want my email provider to be able to read all my past transactional emails at a moment's notice"? Sure, there are "reputable" non-encrypting mail providers, but why not have a reputable mail provider AND encryption, so there's a barrier if they try to go rogue?

08-15 5y ago

Unfortunately, every device that has Signal installed, also has a root kit installed: the play store. If I use PGP-encrypted mail, I have to trust that the receiver is not stupid. If I use Signal, I have to trust that Google is not evil. Hmm...

growse 5y ago
Play services / store isn't needed to run Signal (try it on AOSP, works just fine) and none of the iOS devices that run Signal have the play store installed.