I wrote about email privacy in general a few days ago and after talking to a few friends who have read the article they asked about actual email privacy - what

I wrote about email privacy in general a few days ago and after talking to a few friends who have read the article they asked about actual email privacy - what happens to the content (my article was mostly focused around obscuring your real address and I don't talk about securing the contents of the emails). The problem when approaching the issue especially with not-so-technical people is the difficulty of explaining how encryption would work in this scenario. Unlike Signal where a user A sends a message to a user B and the transmission is encrypted because they are using the same protocol, email is a bit trickier to explain. It would be like sending a Telegram message to Signal. Someone needs to do some conversion from one to another. Even when they use encryption, the methodology applied to encryption can be different. So while I agree with "we should use encryption by default" for non-technical users, this isn't as straightforward. The top comment highlights an issue of the current "send a link to their server" approach, which is what Tutanota uses for example. Everyone moving on to encrypted emails would entail a mass education of users to use PGP keys for example, managing the keys themselves, understanding encryption at rest and the list goes on... Finally, users are horrible at remembering/maintaining their passwords. Fully encrypted services such as Protonmail and Tutanota (I know proton doesn't encrypt the subject line) do not really offer password resets in the classical way - "Oh I forgot my password, well, here's my phone number give me a new password" or "just send me a reset link to this other email". This means that there is a very real risk of losing complete access to your email address or potentially losing a lot of emails. I believe Protonmail allowed password resets but it would wipe your inbox and Tutanota only allows reset using the account key that you have to generate and save somewhere, but again, a user would need to be aware of this and manage it well... Great idea. We should. We won't, or at least, the majority won't.