Project Proposal: Let's Encrypt Email

Online encrypted email can also be had, even anonymously, at protonmail.ch.

What about using https://www.mailvelope.com/ ? I have tried it and it works very well with the Gmail web interface. If it can provide some kind of integration with https://keybase.io or other GPG directories it could become very practical for everyday use.

That is what we use today (well, different plugin for different mail client, but same feature set). The problem is in complicated key exchange and that PGP support is not present everywhere.

1 Like

The biggest problem with email encryption isn't a lack of tools. There are literally hundreds out there.

Nor is the biggest problem verifying names (although it's certainly a considerable problem). There are a number of possible solutions, but none have taken hold.

I think the biggest problem is that there is no single, prepared, and easy-to-use-for-even-non-technical-types solution out there that is ALSO being marketed and advertised heavily.

Email encryption has been around since PGP was invented 25 years ago, yet no particular solution or approach has taken hold. It should have been solved years ago, but it hasn't been.

So I applaud the idea of Let's Encrypt Email, but I really think that the #1 focus should be on creating a solution for non-technical folks to use with no muss or fuss ASAP, even if it's not perfect in Version 1.0, and then marketing it ASAP.

Yes. There are hundreds of tools. But none of them are good tools.

These tools are not easy to use, they are not easy to understand. User interface is often very complex and without deep knowledge of the encryption domain, these GUIs often does not make sense at all. They will make the job done, but it is not very pleasant experience.

Right, jkufner!

Plus, weā€™re at a point in the development of open source software as a genre where it isnā€™t enough to just come up with something good and the world just starts adopting it. There are too many alternatives out there for that to happen like it used to.

Just like you canā€™t just put up a website any more and expect the world to beat a path to your door, so also is it unrealistic to invent a really great email encryption process and have the world just adopt it en masse.

Iā€™ve been concentrating on this email encryption issue for a few months now, and Iā€™m convinced that simplicity and marketing are the keys to universal adoption.

I aggree with simplicity and marketing being the key, but donā€™t forget security :wink: Good example of very good opensource project is Conversations Jabber client. Author has a vision, he knows what he wants and he was rejecting many feature requests conflicting with the vision. As a result we have great Jabber client and everyone is happy. Also, I have not noticed any significant marketing. Good products propagate between people on their own ā€“ make it visible in begining and reputation will take care of the rest.

Today I helped an end user get an S/MIME certificate into a thunderbird. Certificate creation with a firefox. You need a master password for the browser. What do you think does an end user have? Right. No master password no certificate. But the mail address ist already expired. So next: StartSSLā€¦

Comodo mails were kicked of from the mail serverl server (that was another show stopper - but hey, startssl works). Now you need to export the certificate from the browser to the mailer. Therefore you need a backup password. Importā€¦ typing in the password. And you need: a master password. Did the end user have a master password - you guessā€¦ After the import the certificate must be connected to a mail address (multi addresses). The end user needs thousands of passwords (ā€œwhy another password here???ā€) two applications (there is IMHO no functionality addon for thunderbird). After he got it he needs to give the whole installation process to users he wants to communicate with. There may be enterprise companies who implement the stuff for their employes but accept only higher level certificates or the user must enable signing and encryption for their mails. Just look at your collected people certificates store: It is empty isnā€™t it?

So we need addons for all popular mailers and exceptance of administrators and end users. For the latter the exeptance must be implemented by hiding most stuff. Create a new user? Boom the certificate is directly created with the user.