Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

Perhaps we need to start normalizing encrypted email. Just like https everywhere is no longer considered necessarily "tin-foil hat" SOP, moving this direction for email needs to be socially normalized.

Going further, given that an encrypted email to Gmail will simply be unencrypted and then available to GMail, include in the protocol authorized (via both white and black list means) agents of the recipient. So, if you are hosting your own email but the intended recipient is expected to be not hosting their own email, the sender can blacklist "agents" such as Gmail and Yahoo! Mail, or blacklist all except for those chosen to be white-listed such as Proton Mail.



Sure, except the recipient will read your email in Google Chrome, while sitting on a Google Sofa sipping Google Coffee? :)


ha, so true. one prob at a time :)


I was thinking about this just yesterday. It would be great if email providers made tools to painlessly create encryption keys and get them synced up to all your devices securely. From there each email you send can include an automatic signature of where to find your public key. On the other side when you receive emails from others with such a signature you can then choose to have the email reader fetch the key and let you start trusting it with a single confirmation click. From then on your emails to that person will be encrypted without you having to think about it.

For almost all users getting a message from someone you personally know containing a message that they would legitimately send would be sufficient to trust the referenced key. If you are a little paranoid you could ask them over the phone or in person to send a specific message that you would then trust, or just ask for the URL itself. I believe that in-person key exchanges utilizing large trust networks are overkill for the vast majority of people sending everyday communications.

Make it so simple as 1) one time key creation and copying to each device 2) one time trust per other person that is completely streamlined by the software. If the gmail team implemented this for example other email providers would soon do the same and it would spread like wildfire. Very quickly a huge amount of email would be encrypted. Of course this would require an open design that anyone can implement.

Maybe there's a fundamental flaw with this idea that I'm not seeing. If so, please say so because otherwise I'm going to just be disappointed in five years when email is still 99% unencrypted.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: