4 ms·

Lets consider Gmail as an example. It's trivially easy to configure a local Gmail client. Install Thunderbird, type in your username and password, and you're g

Lets consider Gmail as an example. It's trivially easy to configure a local Gmail client. Install Thunderbird, type in your username and password, and you're good to go. The result is a Gmail experience with an excellent UI, no ads, and the user is running only open-source software. Installing the Enigmail extension, GPG, and generating a GPG key provides a secured communication channel. The user need only tick a checkbox to send emails that are impervious to known interception methods. Thus it's already possible to use Gmail for secure communications. No changes on Google's part are required to enable secure emails in Gmail. So what are you actually asking for? It sounds like what you're saying is that Google ought to shut down the Gmail web UI because you don't think hosted services are sufficiently secure. But the thing is, almost nobody (excluding HN) actually cares. If Gmail moved to a secure model tomorrow, it would be effectively the same as shutting down the service because the userbase would migrate to Yahoo or Hotmail overnight. What benefit has the new "secure" Gmail then achieved?

Zigurd 13y ago
Using Thunderbird is not a solution. If Google or any of the other services had their own client that properly integrated with back-end services like key exchange, key signing, etc. you would not have to understand and implement identity verification yourself. You are setting up some straw men for demolition. As Skype showed, before it was nerfed, there is no need for a client interface, especially a mobile client interface not to support security that is so easy that it is equivalent to an unsecured product.
- jmillikin 13y ago
  > If Google or any of the other services had their own > client that properly integrated with back-end services > like key exchange, key signing, etc. you would not have > to understand and implement identity verification yourself. If key exchange and verification were handled by a third-party service, then a compromise of that service would threaten the security of all communications. To be secure, key exchange and verification must be handled offline at the level of individual users. Pre-acquisition Skype was not a secure communications system, any more than iMessage or Hangouts are today. If you believe it was, then you have not spent sufficient time considering how to compromise such a system.
  - Zigurd 13y ago
    Apart from meeting in person and exchanging keys, what other way do people have of finding someone else's public key? Securing that is what key signing and web-of-trust are for. Also, Skype in unlike iMessage or Hangouts in that messages traversed nodes that could capture and attack traffic. Skype had security requirements these other services did not have. A modern, verifiable service could be built that, to end users, resembled Skype in simplicity. Or, for that matter, Hangouts could open source their client and enable verifiable security that, to the end-user, would be no more complicated than using Hangouts is currently.

Zigurd 13y ago

Using Thunderbird is not a solution. If Google or any of the other services had their own client that properly integrated with back-end services like key exchange, key signing, etc. you would not have to understand and implement identity verification yourself. You are setting up some straw men for demolition. As Skype showed, before it was nerfed, there is no need for a client interface, especially a mobile client interface not to support security that is so easy that it is equivalent to an unsecured product.

jmillikin 13y ago
> If Google or any of the other services had their own > client that properly integrated with back-end services > like key exchange, key signing, etc. you would not have > to understand and implement identity verification yourself. If key exchange and verification were handled by a third-party service, then a compromise of that service would threaten the security of all communications. To be secure, key exchange and verification must be handled offline at the level of individual users. Pre-acquisition Skype was not a secure communications system, any more than iMessage or Hangouts are today. If you believe it was, then you have not spent sufficient time considering how to compromise such a system.
- Zigurd 13y ago
  Apart from meeting in person and exchanging keys, what other way do people have of finding someone else's public key? Securing that is what key signing and web-of-trust are for. Also, Skype in unlike iMessage or Hangouts in that messages traversed nodes that could capture and attack traffic. Skype had security requirements these other services did not have. A modern, verifiable service could be built that, to end users, resembled Skype in simplicity. Or, for that matter, Hangouts could open source their client and enable verifiable security that, to the end-user, would be no more complicated than using Hangouts is currently.