Hacker News Reader

Comment by xyst | Hacker News Reader

e2e encryption with s/mime is the answer, unless y’all think otherwise.

I played around with it the other day. Installed actalis/digicert s/mime cert on client. Sent emails between the 2 addresses. Emails decrypted locally on clients but same message sent on webmail client is encrypted/unreadable (besides subject line)

View on HN

Tony the tiger says "that's grrrrreat." Now, send an e2e encrypted to another email that is not yours and see how long it takes them to understand what you sent. PGP for email has been around for a very long time, and there's a reason it is unheard of by the general public. it is a pain in the ass.

S/MIME on the other hand is supported by majority of common email clients. PGP sucks in other (cryptographic) ways as well.

What's difficult is long-term key management. This is being solved in the context of Passkeys and the same infrastructure could be used for S/MIME keys.

Provisioning should become significantly easier with ACME for S/MIME, we'll see about that though.

Nothing really says it has to be difficult, even for the layperson.

Or, it's just too good. Why did it take so long to have encrypted DNS? Another example, https, which uses tls for secure communication still manages to leak the domain name because the Server Name Indication in the ClientHello is sent in plain text before encryption is established. The solution, ECH, is no where to be seen.

The folks that read your e-mail and monitor your online presence do not want you to use these tools.

https took so long because it was so damn expensive. once that expense went away, https became ubiquitous.

Indeed it is, for now.

Even Zimmermann appeared to have given up on it.

https://www.vice.com/en/article/even-the-inventor-of-pgp-doe...

It's been going on at least as long as Year of the Linux Desktop. Stop trying to make fetch happen.

Yeah, well, I might know something you don’t :)

Remind me: 18 months.

As a bonus your emails will stay protected from the person you send them to as well.

It's easier to get someone to install Signal than all of that.

If e2ee became common, Google would offer a way to upload your private key or generate it for you (like proton mail does, IIRC), so you can conveniently read your mail in the web client, undermining the whole idea behind e2ee.

Does it undermine the whole idea? You can just assume that everyone with a @gmail account may be compromised (just like people with work email don't really own their mailbox), and keep your secure communication with the others.

I mean yeah, the point the article is making would be true non the less, so e2ee is not the answer to the problem.

Reply on news.ycombinator.com