6 ms·

You can use it for communication, and it remains popular by first-mover advantage, so I suppose it “works” technically. But almost everyone is on a few, huge se

You can use it for communication, and it remains popular by first-mover advantage, so I suppose it “works” technically. But almost everyone is on a few, huge servers that can dictate the standards to everyone else, it’s not E2E encrypted and the few attempts to add E2E encryption are unusable, the anti-spam systems are so strict and flakey that it’s a crapshoot if any email actually arrives in someone’s inbox, and routing emails is based on domain names, which are a terrible way to manage data portability. In other words, it didn’t accomplish what any pro-Federation activist actually wants to accomplish.

Andrew_nenakhov 5y ago
Oh again this obsession with e2ee!! Email can be e2e encrypted easily if you want it. The fact is that you generally don't, because you want to access your mail from any device and you want a server-side search. All of this is made impossible by a proper e2ee. Also, proper e2ee requires identity verification of your contacts, where you check their key fingerprints using an uncompromised channel. If you skip this part, all e2ee you use is just a security theater.
- karatinversion 5y ago
  How can it be “easily” e2e? The protocol does not allow the sender to synchronously communicate with any host the receiver influences.
  - dane-pgp 5y ago
    Probably the best example of easy end-to-end email encryption (EoEE2EEE?) is Delta Chat[0] which uses Autocrypt[1]. [0] https://delta.chat/en/ https://delta.chat/en/ [1] https://delta.chat/en/help#which-standards-are-used-for-end-to-end-encryption https://delta.chat/en/help#which-standards-are-used-for-end-...
- hiq 5y ago
  > Email can be e2e encrypted easily if you want it. Not with the same security guarantees, the same usability, nor the absence of footguns that apps such as Signal provide. > Also, proper e2ee requires identity verification of your contacts, where you check their key fingerprints using an uncompromised channel. If you skip this part, all e2ee you use is just a security theater. Even if you don't check fingerprints, you're fully protected against passive attackers, as well as attackers who started being active only after the key exchange. For casual users, Signal is a good protection against dragnet surveillance. For advanced users, Signal with key fingerprint checks is a good protection against more powerful attackers that control the network.
  - Andrew_nenakhov 5y ago
    > For casual users, Signal is a good protection against dragnet surveillance. It is not a protection, just a security theater. If you don't trust your service provider not to spy on you, you must not trust it completely. Thus, Signal tells you that you are talking to Joe, but it can easily make it so that you talk to MitM who talks to Joe, for everyone, dragnet style. (those who do indeed verify fingerprints are excluded from this program) Nobody but the slim nerdy minority wants to burden themselves with proper e2ee, yet everyone insists on having some snake oil too. Don't want to be spied by your service provider - run you own server. That's what federation is for.
    - angus-prune 5y ago
      I feel like I'm missing something. If they introduced blanket MitM, it would only take one person to verify fingerprints for it to become public. You mention that people who verify fingerprints would be excluded, but I've no idea how you'd achieve that. My understanding is that proper fingerprint confirmation has to, by definition, be conducted out of band. With any FLOSS everyone is trusting that another geek somewhere is paying attention to a particular piece of software and will raise the alarm if there is something wrong. And I do mean everyone. I don't think its conceivable that even the most paranoid, technically proficient user could verify the integrity of their entire technology stack.
- notriddle 5y ago
  > Oh again this obsession with e2ee This is a post on the Signal blog. They are obsessed with E2E encryption, and will never be talked down from it. Also, I presented several problems with email, not just poor support for encryption. > Email can be e2e encrypted easily if you want it. E2E encryption should have forward secrecy. The way that’s usually implemented requires “handshake” messages to be exchanged before the payload is sent anywhere, which cannot be easily retrofitted onto PGP (adding it would be less “encrypted email” and more “an entirely different communication protocol, tunneled over SMTP”). The Axolotl ratchet that Signal uses requires the key for a communication channel to change over time, which is also pretty far away from what PGP and S/MIME currently do. > The fact is that you generally don't, because you want to access your mail from any device and you want a server-side search Signal and WhatsApp both exist and people use them, so they obviously aren’t deal-breakers. > Also, proper e2ee requires identity verification of your contacts, where you check their key fingerprints using an uncompromised channel It requires you to verify the identity of one, initial contact to bootstrap your social network. From then on, the “uncompromised channel” can be the previous E2E encrypted channel you already created.
  - Andrew_nenakhov 5y ago
    > This is a post on the Signal blog. I'm not responding to a person who writes the Signal blog. I'm arguing with a silly statement 'but but email doesn't have e2ee'. Spam problem is big, and can be solved in other federated protocol like XMPP by requirement to authenticate sender before sending a message. > E2E encryption should have forward secrecy. That is an arbitrary requirement imposed by you just now. For many people it absolutely SHOULD NOT have forward secrecy, and a message signed by a public trusted key would be much better. Regarding that 'axolotl ratched', my developers have implemented it on at least 2 platforms, that protocol can absolutely be ported to email. But nobody will do it because in practice nobody really needs it, just some obsessed nerds. > Signal and WhatsApp both exist and people use them, so they obviously aren’t deal-breakers. ... And Telegram CRUSHES them with BY FAR superior user experience precisely because they DON'T have e2ee for regular chats. > It requires you to verify the identity of one, initial contact to bootstrap your social network. No, this is a security theater again. If you need e2ee you should not trust someone else to do a verification work for you. Not your contacts, not a Signal's CA, nobody. Imagine you are a gangster in a sinister organization. All it would take to compromise your communications is just one mole coerced to work with the police. And if you aren't willing to do this work because it is too burdensome, you should honestly face the fact that nobody is interested in your communications, and that your insistence on e2ee does not, in fact, increase your privacy, but just makes you feel more safe.
- danShumway 5y ago
  This is a never-ending debate, but you really shouldn't be doing E2EE for emails, and you really shouldn't be using it as a backbone for encrypted chat. There are just too many foot-guns. Other people more qualified than me can have that debate if they want, but that's the consensus I see from security people that I respect, and I think there reasoning is sound. I think Signal's derision towards federated protocols should be taken with a grain of salt, but email is genuinely kind of bad on multiple axes. It's difficult to encrypt well, the network is difficult to federate with as an independent user because of anti-spam measures, there's a lot of stuff that providers have kind of stapled on top of it to get around the problem of embedding remote images/resources, message verification, etc... there's just so much duck-taping over problems with the protocol. > If you skip this part, all e2ee you use is just a security theater. No, not at all. It's better if you take that step, but skipping it doesn't necessarily mean there are no benefits elsewhere. Proper E2EE does require verification, however, proper E2EE implementations only require additional verification for new devices, movement, etc... verifying something once, even verifying poorly once, is still a lot more secure than verifying it multiple times in a row. We can get into big debates about the technical side of E2EE, but the short version of that debate is that if E2EE didn't matter, attackers wouldn't be making as much of a big deal about it. This is a good general metric to use when thinking about privacy measures, whether that's sandboxing improvements in iOS, or DNS over HTTPS, or ESNI, or E2EE. If the primary attackers are freaking out about it, there's probably a reason for that. And all of them are freaking out over E2EE so unless you think this is some kind of giant coordinated conspiracy, probably the reason they're freaking out about it is because E2EE does make it harder to monitor people.
dec0dedab0de 5y ago
A few huge services is still better than one really huge service

Andrew_nenakhov 5y ago

Oh again this obsession with e2ee!! Email can be e2e encrypted easily if you want it. The fact is that you generally don't, because you want to access your mail from any device and you want a server-side search. All of this is made impossible by a proper e2ee. Also, proper e2ee requires identity verification of your contacts, where you check their key fingerprints using an uncompromised channel. If you skip this part, all e2ee you use is just a security theater.

karatinversion 5y ago
How can it be “easily” e2e? The protocol does not allow the sender to synchronously communicate with any host the receiver influences.
- dane-pgp 5y ago
  Probably the best example of easy end-to-end email encryption (EoEE2EEE?) is Delta Chat[0] which uses Autocrypt[1]. [0] https://delta.chat/en/ https://delta.chat/en/ [1] https://delta.chat/en/help#which-standards-are-used-for-end-to-end-encryption https://delta.chat/en/help#which-standards-are-used-for-end-...
hiq 5y ago
> Email can be e2e encrypted easily if you want it. Not with the same security guarantees, the same usability, nor the absence of footguns that apps such as Signal provide. > Also, proper e2ee requires identity verification of your contacts, where you check their key fingerprints using an uncompromised channel. If you skip this part, all e2ee you use is just a security theater. Even if you don't check fingerprints, you're fully protected against passive attackers, as well as attackers who started being active only after the key exchange. For casual users, Signal is a good protection against dragnet surveillance. For advanced users, Signal with key fingerprint checks is a good protection against more powerful attackers that control the network.
- Andrew_nenakhov 5y ago
  > For casual users, Signal is a good protection against dragnet surveillance. It is not a protection, just a security theater. If you don't trust your service provider not to spy on you, you must not trust it completely. Thus, Signal tells you that you are talking to Joe, but it can easily make it so that you talk to MitM who talks to Joe, for everyone, dragnet style. (those who do indeed verify fingerprints are excluded from this program) Nobody but the slim nerdy minority wants to burden themselves with proper e2ee, yet everyone insists on having some snake oil too. Don't want to be spied by your service provider - run you own server. That's what federation is for.
  - angus-prune 5y ago
    I feel like I'm missing something. If they introduced blanket MitM, it would only take one person to verify fingerprints for it to become public. You mention that people who verify fingerprints would be excluded, but I've no idea how you'd achieve that. My understanding is that proper fingerprint confirmation has to, by definition, be conducted out of band. With any FLOSS everyone is trusting that another geek somewhere is paying attention to a particular piece of software and will raise the alarm if there is something wrong. And I do mean everyone. I don't think its conceivable that even the most paranoid, technically proficient user could verify the integrity of their entire technology stack.
notriddle 5y ago
> Oh again this obsession with e2ee This is a post on the Signal blog. They are obsessed with E2E encryption, and will never be talked down from it. Also, I presented several problems with email, not just poor support for encryption. > Email can be e2e encrypted easily if you want it. E2E encryption should have forward secrecy. The way that’s usually implemented requires “handshake” messages to be exchanged before the payload is sent anywhere, which cannot be easily retrofitted onto PGP (adding it would be less “encrypted email” and more “an entirely different communication protocol, tunneled over SMTP”). The Axolotl ratchet that Signal uses requires the key for a communication channel to change over time, which is also pretty far away from what PGP and S/MIME currently do. > The fact is that you generally don't, because you want to access your mail from any device and you want a server-side search Signal and WhatsApp both exist and people use them, so they obviously aren’t deal-breakers. > Also, proper e2ee requires identity verification of your contacts, where you check their key fingerprints using an uncompromised channel It requires you to verify the identity of one, initial contact to bootstrap your social network. From then on, the “uncompromised channel” can be the previous E2E encrypted channel you already created.
- Andrew_nenakhov 5y ago
  > This is a post on the Signal blog. I'm not responding to a person who writes the Signal blog. I'm arguing with a silly statement 'but but email doesn't have e2ee'. Spam problem is big, and can be solved in other federated protocol like XMPP by requirement to authenticate sender before sending a message. > E2E encryption should have forward secrecy. That is an arbitrary requirement imposed by you just now. For many people it absolutely SHOULD NOT have forward secrecy, and a message signed by a public trusted key would be much better. Regarding that 'axolotl ratched', my developers have implemented it on at least 2 platforms, that protocol can absolutely be ported to email. But nobody will do it because in practice nobody really needs it, just some obsessed nerds. > Signal and WhatsApp both exist and people use them, so they obviously aren’t deal-breakers. ... And Telegram CRUSHES them with BY FAR superior user experience precisely because they DON'T have e2ee for regular chats. > It requires you to verify the identity of one, initial contact to bootstrap your social network. No, this is a security theater again. If you need e2ee you should not trust someone else to do a verification work for you. Not your contacts, not a Signal's CA, nobody. Imagine you are a gangster in a sinister organization. All it would take to compromise your communications is just one mole coerced to work with the police. And if you aren't willing to do this work because it is too burdensome, you should honestly face the fact that nobody is interested in your communications, and that your insistence on e2ee does not, in fact, increase your privacy, but just makes you feel more safe.
danShumway 5y ago
This is a never-ending debate, but you really shouldn't be doing E2EE for emails, and you really shouldn't be using it as a backbone for encrypted chat. There are just too many foot-guns. Other people more qualified than me can have that debate if they want, but that's the consensus I see from security people that I respect, and I think there reasoning is sound. I think Signal's derision towards federated protocols should be taken with a grain of salt, but email is genuinely kind of bad on multiple axes. It's difficult to encrypt well, the network is difficult to federate with as an independent user because of anti-spam measures, there's a lot of stuff that providers have kind of stapled on top of it to get around the problem of embedding remote images/resources, message verification, etc... there's just so much duck-taping over problems with the protocol. > If you skip this part, all e2ee you use is just a security theater. No, not at all. It's better if you take that step, but skipping it doesn't necessarily mean there are no benefits elsewhere. Proper E2EE does require verification, however, proper E2EE implementations only require additional verification for new devices, movement, etc... verifying something once, even verifying poorly once, is still a lot more secure than verifying it multiple times in a row. We can get into big debates about the technical side of E2EE, but the short version of that debate is that if E2EE didn't matter, attackers wouldn't be making as much of a big deal about it. This is a good general metric to use when thinking about privacy measures, whether that's sandboxing improvements in iOS, or DNS over HTTPS, or ESNI, or E2EE. If the primary attackers are freaking out about it, there's probably a reason for that. And all of them are freaking out over E2EE so unless you think this is some kind of giant coordinated conspiracy, probably the reason they're freaking out about it is because E2EE does make it harder to monitor people.

dec0dedab0de 5y ago

A few huge services is still better than one really huge service