Open Sourcers Pitch Secure Email in Dark Age of PRISM

[bemildred]

With the specter of government surveillance hanging over this post-PRISM world, people are beginning to wonder if the idea of secure email is complete nonsense.

Ever since the former National Security Agency contractor Edward Snowden leaked documents revealing the extent of the spy agency’s monitoring activities, many are convinced that email can never be completely safe from prying eyes, and some have even given it up entirely. In recent weeks, two services that promised to offer completely secure email — Lavabit and Silent Circle — have shutdown, apparently because they couldn’t stop the government from breaking their security.

But the reality is that email is an integral part of both our personal and professional lives — something that most of us can’t give up without alienating friends and family and ditching our day jobs. We have no choice but to find new ways making it safe. “E-mail is going to be with us for a long time,” says Bjarni Rúnar Einarsson, a software developer and member of the Icelandic Pirate Party. “We need to do what we can to make it more secure.”

Einarsson is doing his part with Mailpile, an open source web-based e-mail client that you can run on your own computer or in the cloud. With this creation, he hopes to make it easier for every day users to encrypt their mail — without giving up the sort of search tools they get from a service like Google’s Gmail. The team has already raised over $100,000 dollars on the crowdfunding site Indie GoGo to fund its future development.

http://www.wired.com/wiredenterprise/2013/08/mailpile/

[L0oniX]

1. You can password encrypt your email now. Getting the receiver to comply won't happen easily.

I would think a bank would go with this. There is the hassle of getting the password to the receiver securely ...in person or snail mail.

[bemildred]

2. Yes, the keys are always the problem.

How to securely exchange them, whom to trust, how to be sure the user of the key is the owner of the key.

A service like this, I'm not sure what they would actually do other than facilitate the process you would follow to set up point-to-point email encryption or a VPN.

This could lead to some new ideas though, I don't believe anybody has ever thought through what privacy and security mean on the web, most of the energy has gone into thwarting that sort of thing.

[cprise]

3. This is unlikely to solve the metadata problem

This pricey new project sounds like a lot of bluster from people who don't know any better... all because Thunderbird doesn't come with TorBirdy and Enigmail built-in??

Entities like the NSA can still track, collect and make sense of the headers of PGP-encrypted email.

Most early adopters and other techies don't use or advocate PGP for email because they're afraid when they start signing all their outgoing email it will look like an ASCII bird pooped all over their messages. Creating Mailpile won't change the fact that other email clients display PGP portions in messages as a mess.

And why do we want to stick with the old email protocol anyway? Projects like I2P-Bote already have working alphas out and it doesn't rely on centralized email servers at all, providing comprehensive end-to-end privacy.

[bemildred]

4. Yes.

I expect one consequence of this fuss is that the technology will be moved along in the direction of making this all "transparent" to the user and "private" in the old sense that nobody knows, which is feasible, just inconvenient to our "owners".

I quite agree about email, and would say the same of the whole web. A good place to talk, but not for serious business.

Also, if you rely on someone else to provide your security, then you become permanently insecure.

A lot of the crappy software out there is crappy on purpose. Nobody leaves crappy software they are used to for crappy software that they have to learn over. Good software you don't even notice.