5 ms·
"Stop Using Encrypted Email" is mostly a weak restatement of "The PGP Problem". That anti-PGP rant has issues[1] that are relevant here. The new bit is the ide
by upofadown 5y ago
"Stop Using Encrypted Email" is mostly a weak restatement of "The PGP Problem". That anti-PGP rant has issues[1] that are relevant here.
The new bit is the idea that someone will leak an email with an unencrypted CC: or forward. That's an easy to resolve user factors issue. If we were actually encrypting our emails then attempts to send unencrypted emails could easily be highlighted and discouraged.
Long form asynchronous messaging is important and useful, particularly in business. You can't just wave it away. By nature it can be made much more secure than something like an instant messenger[2]. The Cellebrite attack against Signal is a good example of that. Cellebrite gets all the archived messages in the case of Signal and none of the PGP messages.
[1] https://articles.59.ca/doku.php?id=pgpfan:tpp https://articles.59.ca/doku.php?id=pgpfan:tpp
[2] https://articles.59.ca/doku.php?id=em:emailvsim https://articles.59.ca/doku.php?id=em:emailvsim
- tptacek 5y agoLong-form asynchronous messaging is important and useful. It's just that SMTP email makes it virtually impossible to do so securely. As the author of both documents you cited, I take issue with the idea that one is a restatement of the other; that's obviously not true. The concerns in "S.U.E.A." are endemic to all forms of encrypted SMTP email, and the concerns in "T.P.P." are endemic to most possible uses of PGP. They're related sets of problems, but not even close to perfectly intersecting sets; the MasterCard logo, not the Toyota logo as you'd have it.