Hacker News Reader

Comment by tho9Ohx1eo | Hacker News Reader

> It has no security

Little communication software out there can be made as secure and resilient as email.

Two people out there can run their mail servers on a laptop or a raspberry pi. Email is easily encrypted with TLS and GPG on top.

The initial setup for this could take less than 2 hours.

Bonus points: everything could be run from a *sh shell, 1 CPU core and 128 RAM is quite enough.

> bad tooling and software

Postfix (and HAProxy for that matter) are some of the best pieces of software I have the pleasure to work with. Very good docs, I personally haven't seen them crash and have a way to never take you by surprise.

View on HN

Resilient and secure compared to regular snail mail, you must mean.

You're dangerously wrong about the security of email...

If email is so insecure, how come almost every service uses email as a recovery tool?

There must be hundreds of thousands of very valuable accounts that could be accessed if you had access to someone's emails, so why doesn't that seem to happen?

You two are totally missing to use the threat model approach to security.

Email is "secure enough" for common people, whose threat model isn't high. We have Google and Microsoft to thank for that primarily, since they're the ones that pushed 2-factor auth, encryption in transit (HTTPS) and other features (that later on got implemented by all the email providers). Those features themselves would mean nothing if they weren't incorporated in the biggest free email hosting solutions.

Email is "completely insecure" to those who can't trust a third party (like Gmail). It has GPG on top of it, which is nasty to use from a user's perspective. Meanwhile, even if you do all the things perfectly and never screw up, you're still not getting the same level of protection you would get from using Signal (as a solution that doesn't retain any metadata), whose user experience is out of this world compared to GPG.

Is email secure enough, or does Google/Microsoft running people's mail servers make it secure enough?

I think it's the latter.

I would say it's in between.

Email by itself (as a protocol) is far from perfect, but you can have other mechanisms to improve on top of it where it falls short (while some other things, like metadata retention, are deal breakers). You can still host your own email with almost all the bells and whistles offered by Google/Microsoft, so you have that going for you.

On the other hand, even if you have the greatest and most secure emailing server imaginable, you would still be communicating with others who don't use it, and you're relying on them having some strong security mechanisms as well. Therefore, it's important for Google/Microsoft to make these improvements on top of emails as well.

So, if we're talking about email as a protocol, not secure enough for 21st century.

If we're talking about email as an end product, then yes, it's secure enough (under the assumption that you're using some well known email hosting service).

Reply on news.ycombinator.com