11 ms·

> It doesn’t matter whether or not these emails are safe, which is why they’re encrypted so shoddily. Right now my bank, pension fund, utility supplier etc reg

> It doesn’t matter whether or not these emails are safe, which is why they’re encrypted so shoddily. Right now my bank, pension fund, utility supplier etc regularly e-mail me to inform me that a new statement is available. But they don't attach the statement to the e-mail... because "it isn't secure" So there is real-world demand for a properly secured e-mail system. If we could jump in a time machine, go back 50 years and add end-to-end encryption to e-mail, I'd be getting my bank statements by e-mail. (The chance of my bank deciding to deploy PGP is approximately one in a billion - which is why we'd need a time machine)

moviuro 5y ago
Does your bank at least use STARTTLS? I know banks that don't. https://try.popho.be/email.html#tests https://try.popho.be/email.html#tests
danShumway 5y ago
> So there is real-world demand for a properly secured e-mail system. There is real-world demand for a properly secured messaging system (either real-time or asynchronous) that is as ubiquitous, as accessible, and as technologically neutral/decentralized as email. I think you hit the nail on the head that if we could go back in time and email was encrypted from the start, it would be great, and there is a demand for that. But people keep trying to do that time travel by adding encryption after the fact, and like you I just don't think PGP works for that, I think it's throwing duck tape on top of a technology that is just not designed to handle it. I'm not saying we should drop all email and move to something like Matrix, I still use email today for a lot of stuff. And I'm definitely not saying everyone should use Signal as a full email replacement (the phone number requirement and centralization problems make it unsuitable). But in the long, long term it would very likely be easier to drop email and move everyone everywhere to Matrix (or something else, it doesn't have to be an instant messenger), than it would be to try and retroactively make email encryption work well.
- andi999 5y ago
  What seems to be the problem with pgp (apart from nobody using it)
  - michaelt 5y ago
    https://latacora.micro.blog/2019/07/16/the-pgp-problem.html https://latacora.micro.blog/2019/07/16/the-pgp-problem.html
    - upofadown 5y ago
      I have a canned response to this hoary old chestnut: * https://articles.59.ca/doku.php?id=pgpfan:tpp https://articles.59.ca/doku.php?id=pgpfan:tpp
      - encryptluks2 5y ago
        I think most people complaining about GPG just don't want to be bothered with figuring anything out. They'd rather input their phone number into some cloud app that says it is secure and feel more secure than actually be bothered with understanding security in the first place.
        akerl_ 5y ago
        This is pretty wild. I’ve spent a decade working in the industry, most of it unwinding complex infrastructure and codebases. I don’t hate GPG because I can’t be bothered to figure it out. I understand it and it’s bad at handling the problems it claims to solve.
        encryptluks2 5y ago
        Such as? Can you provide any examples?
        akerl_ 5y ago
        https://latacora.micro.blog/2019/07/16/the-pgp-problem.html https://latacora.micro.blog/2019/07/16/the-pgp-problem.html
intothemild 5y ago
Yes... I agree that can work.... But look at it from the banks perspective. If they email you and ask for you to log in the bank can see who you are, and capture any info in case of fraud. If they sent it as a secure message, they cannot capture any info on who saw it... They just know it was sent.

moviuro 5y ago

Does your bank at least use STARTTLS? I know banks that don't. https://try.popho.be/email.html#tests https://try.popho.be/email.html#tests

danShumway 5y ago

> So there is real-world demand for a properly secured e-mail system. There is real-world demand for a properly secured messaging system (either real-time or asynchronous) that is as ubiquitous, as accessible, and as technologically neutral/decentralized as email. I think you hit the nail on the head that if we could go back in time and email was encrypted from the start, it would be great, and there is a demand for that. But people keep trying to do that time travel by adding encryption after the fact, and like you I just don't think PGP works for that, I think it's throwing duck tape on top of a technology that is just not designed to handle it. I'm not saying we should drop all email and move to something like Matrix, I still use email today for a lot of stuff. And I'm definitely not saying everyone should use Signal as a full email replacement (the phone number requirement and centralization problems make it unsuitable). But in the long, long term it would very likely be easier to drop email and move everyone everywhere to Matrix (or something else, it doesn't have to be an instant messenger), than it would be to try and retroactively make email encryption work well.

andi999 5y ago
What seems to be the problem with pgp (apart from nobody using it)
- michaelt 5y ago
  https://latacora.micro.blog/2019/07/16/the-pgp-problem.html https://latacora.micro.blog/2019/07/16/the-pgp-problem.html
  - upofadown 5y ago
    I have a canned response to this hoary old chestnut: * https://articles.59.ca/doku.php?id=pgpfan:tpp https://articles.59.ca/doku.php?id=pgpfan:tpp
    - encryptluks2 5y ago
      I think most people complaining about GPG just don't want to be bothered with figuring anything out. They'd rather input their phone number into some cloud app that says it is secure and feel more secure than actually be bothered with understanding security in the first place.
      - akerl_ 5y ago
        This is pretty wild. I’ve spent a decade working in the industry, most of it unwinding complex infrastructure and codebases. I don’t hate GPG because I can’t be bothered to figure it out. I understand it and it’s bad at handling the problems it claims to solve.
        encryptluks2 5y ago
        Such as? Can you provide any examples?
        akerl_ 5y ago
        https://latacora.micro.blog/2019/07/16/the-pgp-problem.html https://latacora.micro.blog/2019/07/16/the-pgp-problem.html

intothemild 5y ago

Yes... I agree that can work.... But look at it from the banks perspective. If they email you and ask for you to log in the bank can see who you are, and capture any info in case of fraud. If they sent it as a secure message, they cannot capture any info on who saw it... They just know it was sent.