Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

jwz -

Netscape 4.0 was not my fault. During that dark period, I worked with Lisa Repka on S/MIME, Netscape's implementation of the then-new standard for cryptographically secure email. At the time, I was very glad that we managed to ship this before the U.S. Government had gotten around to making it illegal for us to do so. (And yet, all these years later and still nobody ever encrypts their email...)

This makes me wonder, why don't mainstream email clients (Apple Mail, Thunderbird) encrypt our mails by default?

share|improve this question

closed as not constructive by Nifle, random Jul 11 '11 at 14:04

As it currently stands, this question is not a good fit for our Q&A format. We expect answers to be supported by facts, references, or expertise, but this question will likely solicit debate, arguments, polling, or extended discussion. If you feel that this question can be improved and possibly reopened, visit the help center for guidance.If this question can be reworded to fit the rules in the help center, please edit the question.

add comment

2 Answers

up vote 9 down vote accepted

Because it's not trivial for users.

E.g. I have a lot of different work places with different clients (gmail web interface, thunderbird on my notebook, kmail on home desktop, gmail on android device), and this is not uncommon even for non-technical persons. And I have a lot of questions and have to pay a lot of attention for my private/public keys (if I want to encrypt e-mail):

  • How do I sync my private keys between them?
  • How do I invalidate compromised key?
  • How do I ensure that everyone I'm sending email to have my public key?
  • How do I remove my keys from lost/stolen phone?

And so on. There is no simple solutions for this problems, and I can't imaging simple, reliable and compatible with standarts solution even theoretically.

share|improve this answer
    
That is not entirely true because even email encryption could be, if standardized, made a totally hasslefree experience. Creating a private/public key pair could become part of the normal process of creating a new email account. –  tinytiger Jul 8 '13 at 6:26
add comment

A few problems:

  • Two competing standards: OpenPGP versus S/MIME & X.509. You can't use both in the same message.

  • Encryption requires all recipients to have "certificates", and you to have the certificates of all recipients.

    For S/MIME, email certificates are somewhat difficult to obtain (especially for free), and often require renewal every year – if not every month. Self-signed certificates are possible, but you get the same problems as with HTTPS: they're impossible to verify against any known authority. There is also no common location for obtaining another person's certificate.

    OpenPGP certificate creation is always done by the end user, and there are public directories called "keyservers" along with ability to put the certificates in DNS. But automatically retrieved keys must somehow be verified that they actually belong to the recipients, otherwise encryption is pointless (as anyone can create and upload a key with any label). This verification requires understanding of key signing and web-of-trust, which many users just don't bother with.

    (Certificates in DNS, whether they are OpenPGP or X.509, can be verified with DNSSEC, but that combination is very uncommon. How many people you know who manage their own domain name rather than using a @gmail.com? How many of those even know that they can put a PGP key in DNS?)

  • Encryption is not very useful without signing (to ensure that the sender address is not spoofed), and then you have the above problems in the opposite direction, too: all recipients must have your certificate in order to verify the signature.

  • Most people just don't see the need to encrypt their mail.

    • "There's no reason hackers would attack my mailbox."
    • "I have nothing to hide."
    • "What do you mean? I already have a password on my PC."
share|improve this answer
    
Yup I keep forgetting my PGP passphrase I go to the directory or whatever that website is that show your public key and I see my old ones going back years. –  dghughes Jul 10 '11 at 15:19
    
I think it happens only because the PGP key is very rarely used. –  grawity Jul 10 '11 at 17:59
1  
"How many of those even know that they can put a PGP key in DNS?" - wow, I didn't know. Thanks! –  rvs Jul 14 '11 at 10:25
    
@rvs: gushi.org/make-dns-cert/HOWTO.html –  grawity Jul 14 '11 at 11:13
add comment

Not the answer you're looking for? Browse other questions tagged or ask your own question.