3 ms·

> It's probably worth asking why in 2022, people still don’t use encryption systems to exchange emails, Because mail MITM is extremely rare. It's much more lik

> It's probably worth asking why in 2022, people still don’t use encryption systems to exchange emails, Because mail MITM is extremely rare. It's much more likely your cell phone texts will get intercepted during 2FA rather than your mail. And actually, if I had to send an encrypted email, I wouldn't use PGP. I'd send an encrypted zip file.

jqpabc123 5y ago
I'd send an encrypted zip file. Good idea but too complicated for the average Joe. It could be made much easier by building all the necessary steps right into the email client. Just select "Encrypt attachments". Most of the attempts to address the issue have missed the boat by trying to encrypt the entire email in some non-standardized way.
- upofadown 5y ago
  Attachments are always encrypted if the email is encrypted. So clients are already there...
  - jqpabc123 5y ago
    What happens if the recipient doesn't have one of these clients? An encrypted Zip attachment works with any email client software.
dspillett 5y ago
> I'd send an encrypted zip file. That itself has a standards problem. Most people don't have anything more than the archive reader installed with the OS which for Windows means nothing better than ZipCrypto is supported IIRC. ZipCrypto can be broken so trivially, that it isn't worth bothering with. 7zip and other tools support stronger methods, even with .zip archives, but many people can't read the result. There is also the good old key exchange problem as you are using symmetric encryption: you need a second channel to send the key over. Fine for friends and others you already have more than one contact route between, there are a number of ways to communicate after all, but not for general comms. It is scary how many people in a supposedly security aware industry I see sending encrypted archives by mail then sending the password in another mail, or sending the password and a link to the content hosted elsewhere in the same email.

jqpabc123 5y ago

I'd send an encrypted zip file. Good idea but too complicated for the average Joe. It could be made much easier by building all the necessary steps right into the email client. Just select "Encrypt attachments". Most of the attempts to address the issue have missed the boat by trying to encrypt the entire email in some non-standardized way.

upofadown 5y ago
Attachments are always encrypted if the email is encrypted. So clients are already there...
- jqpabc123 5y ago
  What happens if the recipient doesn't have one of these clients? An encrypted Zip attachment works with any email client software.

dspillett 5y ago

> I'd send an encrypted zip file. That itself has a standards problem. Most people don't have anything more than the archive reader installed with the OS which for Windows means nothing better than ZipCrypto is supported IIRC. ZipCrypto can be broken so trivially, that it isn't worth bothering with. 7zip and other tools support stronger methods, even with .zip archives, but many people can't read the result. There is also the good old key exchange problem as you are using symmetric encryption: you need a second channel to send the key over. Fine for friends and others you already have more than one contact route between, there are a number of ways to communicate after all, but not for general comms. It is scary how many people in a supposedly security aware industry I see sending encrypted archives by mail then sending the password in another mail, or sending the password and a link to the content hosted elsewhere in the same email.