5 ms·
>kind of wish we could just pass a law that says you have to validate email addresses before attaching them to accounts at all. We did, the government can onl
by Jerrrry 2y ago
>kind of wish we could just pass a law that says you have to validate email addresses before attaching them to accounts at all.
We did, the government can only collect the data it needs to complete it's stated objective. fedramp compliance. This exact exploit has happened at nearly every Fortune500 company.
> otherwise, competitive pressure will keep pushing people towards not doing it and aiming this gun at their foot in the name of conversions
Market forces, people should be pressured to use more secured services.
- zacmps 2y agoOne of the (many) problems with the market is that consumers have imperfect information. In this case specifically it's almost never possible to have an accurate picture of a company's security in advance of a mistake like this one.
- warkdarrior 2y ago> Market forces, people should be pressured to use more secured services. There is no such pressure in the market right now. Look at the email-provider market, where secure offering like Proton Mail are nowhere close to less secure ones like Gmail, Outlook/Live.com, etc. Why don't people just flock to Proton Mail?
- rstupek 2y agoWhat makes Proton Mail more secure than Gmail et. al.?
- warkdarrior 2y agoProton offers E2EE for mail, files, and calendar events. Gmail does not.
- sieabahlpark 2y ago[dead]
- account42 2y agoE2EE is a meme when you are using the provider's on-line auto-updating software to access the mail.
- rompledorph 2y agoAre there any schemes that could allow e2ee seamlessly across email providers without compromise in privacy?
- dvzk 2y agoIn theory, S/MIME and SMIMEA. In reality, normal users demand account data recovery in cases of lost encryption keys and passwords. So key escrow is required, which isn't E2EE. ProtonMail tells forgetful users to shove it, which limits its adoption; meanwhile ProtonMail also supports webmail (another feature requirement) which decrypts messages in the browser, weakening any E2EE claims.