Stop Using Encrypted Email(latacora.com)
latacora.com
Stop Using Encrypted Email
https://www.latacora.com/blog/2020/02/19/stop-using-encrypted-email/
4 comments
Drilling down, one finds a link to a paper from Usenix Security 2018: "Efail: Breaking S/MIME and OpenPGP Email Encryption using Exfiltration Channels", by Damian Poddebniak et al. [0]
[0] https://www.usenix.org/system/files/conference/usenixsecurit...
[0] https://www.usenix.org/system/files/conference/usenixsecurit...
Hmmm. I am more sympathetic to the author, since they might expect familiarity with their previous post on the topic. Still, am glad that I stopped reading after that quote because I personally misunderstood their meaning.
I understood their claim to be about a bug in PGP. I did not interpret it as a reference to Efail, which was (IIRC) a misuse of PGP by certain email viewer. From the Efail paper:
I understood their claim to be about a bug in PGP. I did not interpret it as a reference to Efail, which was (IIRC) a misuse of PGP by certain email viewer. From the Efail paper:
> However, both
> S/MIME and PGP predate these developments and use
> no authentication at all (S/MIME) or do not strictly com-
> mit to the requirements of an AE, which makes them eas-
> ier to misuse (PGP).
This makes some good points - metadata and trackers are the main privacy leaks with email today.
However, email encryption today is about not trusting your ESP (Email Service Provider) to not scan your email. It's about encrypting from your ESP to your client in a way that the ESP cannot see what is in the email.
Is ESP protection a mainstream concern? Yes. Is lack of encryption the biggest privacy issue with email? No. Does encrypting emails address a real concern? Yes for some.
However, email encryption today is about not trusting your ESP (Email Service Provider) to not scan your email. It's about encrypting from your ESP to your client in a way that the ESP cannot see what is in the email.
Is ESP protection a mainstream concern? Yes. Is lack of encryption the biggest privacy issue with email? No. Does encrypting emails address a real concern? Yes for some.
> So, for example, it recently turned out to be possible for eavesdroppers to decrypt messages without a key, simply by tampering with encrypted messages. Most technologists who work with PGP don’t understand it at a low enough level to see what’s wrong with it.
without citation. Such a writing choice makes me pause.