3 ms·
I think he's trying to address more than just people intercepting emails in transit but there are a lot of things a government body could do to compromise your
by calpaterson 12y ago
I think he's trying to address more than just people intercepting emails in transit but there are a lot of things a government body could do to compromise your suggestion, for example: MITM the connection at a network level (mail daemons normally don't check certificates came from CAs), take control of the receiving SMTP server or maybe even just use an unpatched OpenSSL bug (heartbleed is still unpatched on quite a lot machines, including mail servers).
Securing email will require a lot more than just turning encryption on, IMO.
- rythie 12y agoI'm taking it as read that users would use message encryption - which already exists. Would creating a new protocol force daemons to check certificates came from CA? stop third parties controlling servers? or using unpatched OpenSSL though? anymore than a properly setup SMTP server though?