3 ms·

"... during transport" Who cares? I'm more interested in knowing the percentage encrypted _before_ transport. "During transport" requires authentication; oth

by jingo 12y ago

"... during transport" Who cares? I'm more interested in knowing the percentage encrypted _before_ transport. "During transport" requires authentication; otherwise all bets are off. "Before transport" at least minimizes the damage if the email is sent to the wrong recipient. I have yet to see an authentication mechanism that looks "trustworthy" (decentralized and simple), other than a pre-sharing some identifier face-to-face.

Sami_Lehtinen 12y ago
"Before transport" at least minimizes the damage if the email is sent to the wrong recipient. Doesn't really help, because most of email clients do encryption automatically. Which means that then the message is encrypted to wrong recipient as well.
- jingo 12y ago
  Well, that's another type of error (human error). And TLS will not address that type of error either. I was referring to the case where the email is redirecting to (or through) an unintended recipient. Before my comment is further misinterpreted, let me make clear: I am not saying "Do not use SSL/TLS." By all means use it; regardless of the bugs, the complexity and the lack of an acceptable authentication mechanism. But encrypting before transport is even more important, IMO. And so that is a more interesting statistic. The two are not mutually exclusive. Not to mention one could use SSH for encryption "in transit". It has better authentication than SSL/TLS, but that's only my opinion.
- sp4rki 12y ago
  Really helps a whole lot because the wrong recipient can't read the email you sent encrypted "before transport".
magicalist 12y ago
> "... during transport" > Who cares? uh, the more than a billion (maybe more than two billion) people who use email and get their email swept up in casual dragnet surveillance otherwise?
xenophonf 12y ago
The message envelope cannot be encrypted, so traffic analysis or other kinds of tampering can still be performed on GPG- or CMS-encrypted emails. It'd be like doing client-side encryption in JavaScript, but all of the HTTP requests and responses go out in the clear. Message encryption and transport encryption are complimentary. They protect against different kinds of attacks.

by jingo 12y ago

Sami_Lehtinen 12y ago

"Before transport" at least minimizes the damage if the email is sent to the wrong recipient. Doesn't really help, because most of email clients do encryption automatically. Which means that then the message is encrypted to wrong recipient as well.

jingo 12y ago
Well, that's another type of error (human error). And TLS will not address that type of error either. I was referring to the case where the email is redirecting to (or through) an unintended recipient. Before my comment is further misinterpreted, let me make clear: I am not saying "Do not use SSL/TLS." By all means use it; regardless of the bugs, the complexity and the lack of an acceptable authentication mechanism. But encrypting before transport is even more important, IMO. And so that is a more interesting statistic. The two are not mutually exclusive. Not to mention one could use SSH for encryption "in transit". It has better authentication than SSL/TLS, but that's only my opinion.
sp4rki 12y ago
Really helps a whole lot because the wrong recipient can't read the email you sent encrypted "before transport".

magicalist 12y ago

> "... during transport" > Who cares? uh, the more than a billion (maybe more than two billion) people who use email and get their email swept up in casual dragnet surveillance otherwise?

xenophonf 12y ago

The message envelope cannot be encrypted, so traffic analysis or other kinds of tampering can still be performed on GPG- or CMS-encrypted emails. It'd be like doing client-side encryption in JavaScript, but all of the HTTP requests and responses go out in the clear. Message encryption and transport encryption are complimentary. They protect against different kinds of attacks.