True, but getting everyone on signed/encrypted email is a much more massive undertaking than just sending an https link. To your point, as long as straight SMT

True, but getting everyone on signed/encrypted email is a much more massive undertaking than just sending an https link. To your point, as long as straight SMTP is involved, there will always be a gaping hole. But, sending https links is a very cheap way to prevent making the hole even bigger. Anyway, all of this underscores the fact that virtually nothing that Evernote did was secure. But, most companies probably wouldn't have done much better.