Hacker News Reader

Comment by belorn | Hacker News Reader

We need default secure email, and we need it yesterday. It is long past the days where email was treated as private communication, as if it was a mailed letter going through the post office.

Default encryption is not that hard. In the earlier days, key management was seen as the major hindrance to ubiquitous encryption but in 2013 that is not as big issue anymore. There are workable solutions, be that through extending what's in DNS, exchanging QR codes between smartphones, BTNS or even the mess of using the centralized systems of CA's.

Mail servers can have certificates. Domain names can have DNSSEC. DNS can even have keys for mail addresses (RFC 4398). So how hard would it really be to for mail relays to automatically retrieve a key and encrypt the email before sending it forward to its destination?

View on HN

"It is long past the days where email was treated as private communication, as if it was a mailed letter going through the post office."

Was email ever 'secure' in the way you're describing? As far as I'm aware, email gets sent in the clear. The analogy to the postal system would be sending postcards (as opposed to sealed letters).

Edit: fwiw I'm thinking about mail servers, online identity and DNSSEC with a view to pulling together a product in this space.

There has been a shift in privacy with cloud storage. When everyone was using POP3 to get email with a 2MB quota on the mail server email didn't stick around on the ISP's computers for long - it was generally stored on a device owned by the recipient, and searching that required all the usual fourth amendment protections.

The Stored Communications Act [1] makes a distinction between unread mail stored on a server for more than 180 days, and does not require a warrant to access such email. It appears that read email still does require a warrant, however, as it is considered a "Remote Computing Service." I didn't know that until just now, and am not sure how the legal requirements for accessing that differ from a hard drive sitting on my desk at home.

A secure email product would be interesting. I'd be interested to know where deniability (i.e. OTR) would fit into your plans.

[1] http://en.wikipedia.org/wiki/Stored_Communications_Act

Kim dotcom is working on a secure, easy to use email[1].And until then , if you're interested in security , it's probably best to use a secure messaging app like textSecure.

[1]http://www.itnews.com.au/News/342446,kim-dotcoms-mega-workin...

Reply on news.ycombinator.com