Let's ignore for the moment the paternalistic and I-know-it-all tone permeating the whole post...
> Most email encryption on the Internet is performative, done as a status signal or show of solidarity.
Where is the data supporting this statement?
Where can I read an quantitative analysis on how many emails on the Internet are encrypted, and - out of those - the motivation for having them encrypted, all by percentage?
Really, I am willing to pay for it.
Or is the author basing it on personal anectodes, by looking at the few mails in his personal mailbox?
Because at that point also my experience in the corporate world is as good as theirs, and it actually proves the opposite on most points.
Over multiple years, I have seen PGP being used to secure all email exchanges about product security with customers, suppliers, partners, security researchers, and even competitors.
Not a single day passes without a PGP email being sent or received.
As far as I can tell, 100% of the emails contain information for objectively sensitive topics (like security flaws, trade secrets, material under NDA, etc).
Even though emails are exchanged with professionals that are skilled and trained in IT security more than your average Joe, new contacts consistently have PGP keys already and they know how to correctly use PGP.
Any suggestion to use Signal or wormholes won't make you look very good(for good reasons), even though it is clear they are great security products.
Security is good enough: we know that because we do objective risk assessments, where sensationalist articles on the Internet don't play a big role.
I can't recall the last time people replied in the clear - though yes, it happened in the past some times.
It also happened that people copy & paste & share paragraphs from sensitive emails though, which is as bad.
The main problem I see is not email encryption per se, but the first key exchange. PGP keyservers are bad and avoided.
The second problem is usability, and it is appalling that nobody is able to tackle this for PGP. It is not really rocket science and certainly people are willing to pay for it.
>> Email is end-to-end unencrypted [1] by default.
>> Serious secure messengers foreclose on this possibility. Secure messengers are encrypted by default
TCP is unencrypted by default too; actually and, you know what, it doesn't even support encryption!
You use TLS on top of it (in a hop-by-hop way unfortunately).
Same thing for email. The fact that the underlying message is unsecured, does not mean you need to throw it away.
>> Metadata is as important as content, and email leaks it.
This depends on your threat model. In ours, metadata largely doesn't matter.
>> Secure messaging systems make arrangements for “disappearing messages”.
You do understand that this is a big no-no for corporate right?
You must be able to set retention and escrow policies.
You must use data formats that are very likely to be around or re-implementable in the years to come, not hipster apps that will disappear from circulation next year. We love public standards or industry standards.
Sometimes retention rate is "never delete": that's necessary and it is OK.
> Most email encryption on the Internet is performative, done as a status signal or show of solidarity.
Where is the data supporting this statement?
Where can I read an quantitative analysis on how many emails on the Internet are encrypted, and - out of those - the motivation for having them encrypted, all by percentage? Really, I am willing to pay for it.
Or is the author basing it on personal anectodes, by looking at the few mails in his personal mailbox?
Because at that point also my experience in the corporate world is as good as theirs, and it actually proves the opposite on most points.
Over multiple years, I have seen PGP being used to secure all email exchanges about product security with customers, suppliers, partners, security researchers, and even competitors.
Not a single day passes without a PGP email being sent or received.
As far as I can tell, 100% of the emails contain information for objectively sensitive topics (like security flaws, trade secrets, material under NDA, etc).
Even though emails are exchanged with professionals that are skilled and trained in IT security more than your average Joe, new contacts consistently have PGP keys already and they know how to correctly use PGP.
Any suggestion to use Signal or wormholes won't make you look very good(for good reasons), even though it is clear they are great security products.
Security is good enough: we know that because we do objective risk assessments, where sensationalist articles on the Internet don't play a big role.
I can't recall the last time people replied in the clear - though yes, it happened in the past some times. It also happened that people copy & paste & share paragraphs from sensitive emails though, which is as bad.
The main problem I see is not email encryption per se, but the first key exchange. PGP keyservers are bad and avoided.
The second problem is usability, and it is appalling that nobody is able to tackle this for PGP. It is not really rocket science and certainly people are willing to pay for it.
>> Email is end-to-end unencrypted [1] by default.
>> Serious secure messengers foreclose on this possibility. Secure messengers are encrypted by default
TCP is unencrypted by default too; actually and, you know what, it doesn't even support encryption! You use TLS on top of it (in a hop-by-hop way unfortunately).
Same thing for email. The fact that the underlying message is unsecured, does not mean you need to throw it away.
>> Metadata is as important as content, and email leaks it.
This depends on your threat model. In ours, metadata largely doesn't matter.
>> Secure messaging systems make arrangements for “disappearing messages”.
You do understand that this is a big no-no for corporate right?
You must be able to set retention and escrow policies.
You must use data formats that are very likely to be around or re-implementable in the years to come, not hipster apps that will disappear from circulation next year. We love public standards or industry standards.
Sometimes retention rate is "never delete": that's necessary and it is OK.