<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
</head>
<body>
<div class="moz-cite-prefix">On 31/08/2020 11:13 pm, Magnus Melin
wrote:<br>
</div>
<blockquote type="cite"
cite="mid:3d768300-e34a-6c13-4cd2-e50aefae20ac@iki.fi">On
2020-08-31 05:41, Mike Dewhirst wrote:
<br>
<blockquote type="cite">In general the concept of e2ee is good.
HOWEVER it solves a non-existent problem. Email has been
insecure from day 1 and everyone knows this and uses other
mechanisms for keeping real secrets. </blockquote>
<br>
What are they using, and is it an open, distributed system?
<br>
</blockquote>
<br>
In my case it is usually lunch if I don't wish to use email or VoIP
provided by my trusted provider. I also use NDAs. I don't use email
for sensitive communications because - one day - those emails will
emerge accidentally or deliberately. I send logins via email and
separately, passwords via SMS or verbally over the phone.<br>
<br>
<blockquote type="cite"
cite="mid:3d768300-e34a-6c13-4cd2-e50aefae20ac@iki.fi">
<br>
There are many that need this kind of security for keeping
confidentiality in business communications. There are many users
who rely on it to avoid persecution. There are also plenty of
competitors which provide (poorer) solutions to this problem. So
whether you want to use it or not - it's certainly solving a
problem.
<br>
</blockquote>
<br>
You are right. On re-reading what I wrote and after seeing @Wayne's,
@Patrick's and @Eyal's emails I must apologise for and admit to
exaggeration for dramatic effect. <br>
<br>
That said, I do believe phishing is a threat and signing email is a
solution. And signing is easy.<br>
<br>
A little while ago I saw in the news that the most egregious hacks
in recent times have been executed via exquisitely targeted phishing
attacks. I'm no expert but it seems to me you would be unlikely to
trust a link sent via email from a trusted colleague if the signing
was flagged as bogus or the mail was unsigned when it should be.<br>
<br>
I use Enigmail and I therefore have the option of e2ee but because I
don't see any confidentiality threat I don't use e2ee. But I do sign
my emails and advertise that in my sig because I believe it is
something everyone can do - once doing it is easy enough. Once
everyone (wishful thinking I know) is signing then everyone would
have access to e2ee as an added benefit when required. I believe
Enigmail is a public treasure. A Nobel prize should be on the cards!<br>
<br>
Therefore, if everyone can do it, all that is stopping everyone is
the usual set of barriers. Why should I do it? How easy is it? Do I
have to think about this? Aaah - can't be bothered! <br>
<br>
Motivation is obviously key. Everyone who understands the importance
of security is already motivated and only requires the know-how to
implement it. That just boils down to email client devs seeing that
signing is a much simpler marketing step than e2ee and wanting to
arrange the default settings and installed libs to make switching it
on as simple as possible. The same libs can handle e2ee and e2ee
settings can be similarly tweaked. <br>
<br>
I would be happy to assist in writing documentation aimed at people
who just need to know the minimum necessary to implement signing. I
think e2ee documentation is much harder and currently above my pay
grade.<br>
<br>
Cheers<br>
<br>
Mike<br>
<br>
<br>
<blockquote type="cite"
cite="mid:3d768300-e34a-6c13-4cd2-e50aefae20ac@iki.fi">
<br>
-Magnus
<br>
<br>
_______________________________________________
<br>
tb-planning mailing list
<br>
<a class="moz-txt-link-abbreviated" href="mailto:tb-planning@mozilla.org">tb-planning@mozilla.org</a>
<br>
<a class="moz-txt-link-freetext" href="https://mail.mozilla.org/listinfo/tb-planning">https://mail.mozilla.org/listinfo/tb-planning</a>
<br>
</blockquote>
<br>
<br>
<pre class="moz-signature" cols="72">--
Signed email is an absolute defence against phishing. This email has
been signed with my private key. If you import my public key you can
automatically decrypt my signature and be sure it came from me. Just
ask and I'll send it to you. Your email software can handle signing.
</pre>
</body>
</html>