Hacker News Reader

Comment by drzaiusapelord | Hacker News Reader

No s/mime, no pgp, so the hackers get everything nice and neat in plaintext. Not sure why we think email encryption is optional nowadays, especially for sensitive communications.

View on HN

I continue to be amazed that email continues to be used for anything important at all. It's got fundamental flaws that require herculean effort to overcome. It would seem ripe for replacement.

Could you elaborate on that? As in, the degree to which email is unsafe. I try to be security-conscious, but I just now realized that I often opt for email-type login even when presented with alternatives. Would using OAuth, Facebook or Github for login be safer than email? Or are the vectors of attack different, and is it difficult to compare the two? Or does it depend on whether I'm using GMail or something else?

Based on what I know, my impression is that email is significantly worse, and somehow I'd never considered that. But I'm not sure if I'm missing something...

Parent is saying that the content of email is almost always transmitted in the clear. While the connection from client to server is (hopefully) secure, the server can see the plaintext of all messages passing through it — which it helpfully uses to provide some server-side facilities like search and filtering — but if someone hacks the server they get all the mail.

Contrast with more recent messaging protocols (e.g. iMessage, WhatsApp) where the server doesn't have access to the message, they're decrypted on the client (while potentially also authenticating the sender).

Reply on news.ycombinator.com