Next generation e-mail with PQC built in, how?Because I'm always thinking about designing and building a newer, better e-mail system, I was looking at how Proton and Tuta do their encryption.
I thought they had both developed something new, but it turns out that what Proton calls "zero-access encryption", is exactly the same as what I implemented at work, 25 years ago, to prevent our boss from browsing through our e-mail boxes in his spare (?) time 😂
(Long read about e-mail, encryption and PGP)
View article
View summary
I thought they had both developed something new, but it turns out that what Proton calls "
zero-access encryption, is
exactly the same as what I implemented at work, 25 years ago, to prevent our boss from browsing through our e-mail boxes in his spare (?) time 😂
I had also put up a Squid proxy server that we used for surfing, to prevent him from checking what websites we visited. I bet @
Koen de Jonge - SynQ knows exactly who I mean 😏
I've been concerned with privacy pretty much all my life, you can ask my brother @
Erik van Zijst 😄
PGP: Pretty Good PrivacyCan't come as a surprise then that I know PGP pretty good 😇 And because teaching others is also something I like, I explained what PGP did, 30 years ago. And it's still valid today: if you have no idea of what PGP is or how to use it, read what I wrote on my first ever website (thank you so much, @
internetarchive 🙏):
https://web.archive.org/web/19970807080205/http://www.hzeeland.nl/~hzijst/pinf_en.htm(
You non-Dutchies won't know the names that I used in that text, and neither will the younger generation Dutchies, I expect. They're from an old TV show for little kids, and I got my nickname, Woefdram, from it. Given to me by a classmate/friend when I was 15 or so.)
So this latest design (which isn't very concrete yet) must also implement the latest and greatest in post-quantum encryption, PQC. And apparently
GnuPG is about to support PQC.
Of course everything I use is FOSS, so GnuPG is what I'll use. Once a user has a decent configuration and keyring, plugging it into Thunderbird is pretty easy. I wrote about that in "
How to use GnuPG in Thunderbird".
Users and their responsibility for their keysBut the big challenge will be key management. I know how to handle key material, I've done that for a long time, and I like to call myself "professionally paranoid" 😏
But not everybody knows, and my personal—often frustrating—experience is that the vast majority of people don't even
want to know.
They want to click a button, maybe enter a password and know that their message is safe (if even that); they don't want to learn about generating keys, how crucially important a really long password is and what is takes to keep all of that safe, secure, up-to-date and available when needed...
So, how do I offer my users a place where they can keep their keyring without me having access to it? Users who know their way around in e-mail and PGP can do it the correct way, but for Joe Average something much easier is necessary.
Guess I'll need something like
Hashicorp Vault to allow those who want/need it, to securely store their keys on the server.
#
BigTech #
privacy #
FOSS #
OpenSource #
email #
encryption #
PQC
