Comment by sybercecurity | Hacker News Reader

Comment by sybercecurity | Hacker News Reader

Parent Full thread

Worked on projects dealing with digitally signed/encrypted email. The main technical hurdles I always found were around key management:

1. How do you discover someone's encrypting key? There is no simple way and it involves understanding how it all works. Solutions using the DNS were proposed but never really workable or saw wide deployment (I tried). Gets more complex when someone updates keys.

2. Multi-device - not only do I have to mange keys, but now I have to make sure I have the same keys on my laptop mail agent and phone. That sucks. Using a web client also complicates this.

and a non-technical issue:

3. Large email provides and specialized service found things that sorta work enough. Every bank/medical office has a "secure messaging portal" that you can use that aren't as simple as email, but works well enough that there is no pressure to move to more standard email. Large providers like Microsoft have internal solutions to send secure email that works in their service and if it is free to get an account, it works (even if it's annoying).

     1. How do you discover someone's encrypting key?

They give it (the public key) to you or publish it where everyone can find it. You would keep and verify all your friends, colleagues, businesses, etc email..

These are all solvable problems. Much like voting. Someone does not want these problems solved.

> Someone does not want these problems solved.

I don't think it's a conspiracy; I think the people who don't want these problems solved are typical email users, for whom the increased security would only increase complexity without solving any actual problems they have with email.

All email users deal with the tyranny of email. They are just used to it. They don’t know how much better it could be.

I don't think that adding end-to-end encryption would make things meaningfully better for most of the people who use email.

Digital signatures would. Makes it real easy to sort your email.

If proton mail can do it so can everyone else. The ad-tech companies clearly don't want to.

How do you solve the problem of needing to pass an email address via phone? Happened to me dozens of times over the last year. Also, how do you solve the problem of shared inboxes where employees need to access emails and they may get replaced over time? How do you solve the problem of people just straight up losing or breaking their keys/laptops/phones? I knew people who had a new phone every few months because something happened to it.

The average user is very, very far away from being able to use a nearly irreplacible item for communication. And yes, it's irreplacible since there is no rollover mechanism in just publishing the public key.

Reply on news.ycombinator.com