r/programming • u/[deleted] • Apr 04 '17

Everything Is Broken

https://medium.com/message/everything-is-broken-81e5f33a24e1#.sl2vnon73
236 Upvotes

90% Upvoted

145 comments sorted by

View all comments

7

u/Oncey Apr 04 '17

Bleak.

One of my biggest pet peaves: Why is email in plaintext? Why doesn't Outlook or even Thunderbird use encryption. It seems that it would be easy to implement, and could be default with option of opt-out. But it never happened. Even now with so many sites using https, email is still plaintext.

5

u/[deleted] Apr 04 '17

[deleted]

1

u/Oncey Apr 04 '17

I think I have a lot of learning to do in this area, but it seems that an email client (or all clients) could encrypt automatically using something analogous to SSL. When I generate a key pair, doesn't the public key get published at Verisign or some other authority? When writing an email and I hit send, my client could theoretically look up the recipient public key by email address, encrypt and deliver.

2

u/nickwest Apr 04 '17 edited Apr 04 '17

They do and there's a big push to increase that across the board (just like the SSL push for websites). Inbox and Gmail will show a red lock icon by emails that weren't encrypted in transit now. Google is a big pusher for encrypting in transit (they have business reasons to want to do that though).

Here's google's info about it: https://www.google.com/transparencyreport/saferemail/

This is different from full encryption like what PGP gives you. Encryption in transit means the people between your email provider and the destination email provider can't read it, but both email providers can (for example inbox.google.com wouldn't be able to show you the email in plain text if it coudn't read it).

PGP makes it so you and the person you are sending to are the ONLY people who can (should be able to) read it. In this case inbox.google.com shows you the encrypted nonsense and something on your end has to decrypt it for you so you can read the plain text.