5 ms·
This is encryption that accomplishes nearly nothing. Your email messages themselves may be encrypted but the addresses and other metadata -- who you converse w
by fernly 13y ago
This is encryption that accomplishes nearly nothing.
Your email messages themselves may be encrypted but the addresses and other metadata -- who you converse with, when, and how often -- is completely open. If you exchange mail with a person B, who exchanges mail with a person C, who exchanges mail with a person T that is the subject of a "terrorism" investigation, your mail will be collected and, whether encrypted or not, the fact that you are thus "implicated" will be noted. Indeed the fact that you are "hiding" your email will increase the level of interest in you.
In addition, email encryption does nothing to protect your text messages, web browsing, ftp transfers, skype calls etc.
- gyepi 13y ago> This is encryption that accomplishes nearly nothing. I disagree. Encryption, done correctly, maintains the secrecy of the message. > Your email messages themselves may be encrypted but the addresses and other metadata -- who you converse with, when, and how often -- is completely open. Absolutely true, but this is a secondary issue that requires a combination of technical and political solutions. > In addition, email encryption does nothing to protect your text messages, web browsing, ftp transfers, skype calls etc. Right. But there are other solutions to these problems. Security requires a layered approach. There's no way to protect all communications with a single solution, given our current systems.
- zeckalpha 13y agoForget the email model of public metadata. What about a new protocol where you encrypt your message and its metadata completely, and give it to everyone (for some N). The "address" is just the public key used to encrypt it.
- ketralnis 13y agoFor a small number of messages, maybe. For the number of email messages exchanged daily on the internet? Probably not. For voice calls? Certainly not.
- DennisP 13y agoSo then the "email" address can be the public key plus the forum you pull messages from.
- oakwhiz 13y agoI believe that this is what projects like Bitmessage are trying to solve. There are a few ways to go about this. One is to give everyone your message. To me, this seems inefficient, since not everyone wants your message. Another option is to use mix networks and distributed hashing, like Tor or Freenet. I suspect that something more useful and efficient could be created using rateless erasure forward error correction codes.
- InXorWeTrust 13y ago> To me, this seems inefficient, since not everyone wants your message. I would like to point out BitMessage uses streams. Streams are a collection of nodes that have a particular part of their address in common. If you have an address that is part of one of these streams, your computer will listen into that stream. So you won't download all streams keys and messages, only those that pertain to you.
- hnha 13y agoI don't trust the crypto to not be broken in 10 years so I would definitely not want everyone enabled to store my messages.
- fernly 13y agoThe NSA keeps encrypted data (e.g. HTTPS traffic) for five years in the event that they might be able to decrypt it later if they need to. This is extremely likely with respect to HTTPS because the keys are owned by the ISPs who can be directed to hand them over, if not today, then at least when their Certs expire and new keys are generated. So HTTPS traffic is effectively as open as plaintext. Your 4096-bit-encrypted email would probably not be crackable. However, the NSA would know from the metadata that your mails were "of interest" (because they know your correspondent was someone on whom they are trying to build a case) and they can come to you and demand the key, and impose secrecy on you making it a felony if you tell anyone you had surrendered your key.
- zby 13y agoThis is just the first step. We have a long way to go - but the first step is how we start the journey.