3 ms·
This is a good discussion. You're absolutely right in describing the theory behind PGP (or GPG for the purists :), but unfortunately there is not yet a way to
by yajoe 13y ago
This is a good discussion.
You're absolutely right in describing the theory behind PGP (or GPG for the purists :), but unfortunately there is not yet a way to build a messaging service that has both features AND privacy. The should in your statement "Party B should be constructing their service" implies and expects a capability that is not (yet) possible to build. The point of my posts were to illuminate the reasoning companies make it easy to decrypt for the US government due to their exposure from in-demand content-aware features and fear of legal action.
Like you said, PGP+Gmail sucks for all parties included on a chain. Clients stop working. Non-users can't read the emails. Gmail spam filtering, ads, search indexing, and labeling all break. The same is true for PGP+Exchange, and most corporate customers much prefer Exchange features to the privacy offered to individuals with PGP.
I'm also not aware of 'more streamlined services' that offer true privacy -- please illuminate them if they exist. Services like Voltage suffer from the same root cause of reversible encryption.
So, customers have to choose: use a service with content-aware features OR use a dumb service that (currently) does not have the features. Most people choose features, and I would venture in this case Microsoft opted for features over pure privacy.
I would be among the first to welcome a way to accomodate both pure privacy and features in a service, and I encourage all to find a way. Please build it!