Open Source and Free Software

bemildred

(90,061 posts) Tue Aug 27, 2013, 06:25 AM Aug 2013

Open Sourcers Pitch Secure Email in Dark Age of PRISM

With the specter of government surveillance hanging over this post-PRISM world, people are beginning to wonder if the idea of secure email is complete nonsense.

Ever since the former National Security Agency contractor Edward Snowden leaked documents revealing the extent of the spy agency’s monitoring activities, many are convinced that email can never be completely safe from prying eyes, and some have even given it up entirely. In recent weeks, two services that promised to offer completely secure email — Lavabit and Silent Circle — have shutdown, apparently because they couldn’t stop the government from breaking their security.

But the reality is that email is an integral part of both our personal and professional lives — something that most of us can’t give up without alienating friends and family and ditching our day jobs. We have no choice but to find new ways making it safe. “E-mail is going to be with us for a long time,” says Bjarni Rúnar Einarsson, a software developer and member of the Icelandic Pirate Party. “We need to do what we can to make it more secure.”

Einarsson is doing his part with Mailpile, an open source web-based e-mail client that you can run on your own computer or in the cloud. With this creation, he hopes to make it easier for every day users to encrypt their mail — without giving up the sort of search tools they get from a service like Google’s Gmail. The team has already raised over $100,000 dollars on the crowdfunding site Indie GoGo to fund its future development.

http://www.wired.com/wiredenterprise/2013/08/mailpile/

4 replies

= new reply since forum marked as read

Highlight:

Open Sourcers Pitch Secure Email in Dark Age of PRISM (Original Post) bemildred Aug 2013 OP

You can password encrypt your email now. Getting the receiver to comply won't happen easily. L0oniX Aug 2013 #1

Yes, the keys are always the problem. bemildred Aug 2013 #2

This is unlikely to solve the metadata problem cprise Aug 2013 #3

Yes. bemildred Aug 2013 #4

L0oniX

(31,493 posts)

1. You can password encrypt your email now. Getting the receiver to comply won't happen easily.

Reply to bemildred (Original post)

Tue Aug 27, 2013, 09:52 AM

Aug 2013

I would think a bank would go with this. There is the hassle of getting the password to the receiver securely ...in person or snail mail.

bemildred

(90,061 posts)

2. Yes, the keys are always the problem.

Reply to L0oniX (Reply #1)

Wed Aug 28, 2013, 10:17 AM

Aug 2013

How to securely exchange them, whom to trust, how to be sure the user of the key is the owner of the key.

A service like this, I'm not sure what they would actually do other than facilitate the process you would follow to set up point-to-point email encryption or a VPN.

This could lead to some new ideas though, I don't believe anybody has ever thought through what privacy and security mean on the web, most of the energy has gone into thwarting that sort of thing.

cprise

(8,445 posts)

3. This is unlikely to solve the metadata problem

Reply to bemildred (Original post)

Fri Aug 30, 2013, 04:49 AM

Aug 2013

This pricey new project sounds like a lot of bluster from people who don't know any better... all because Thunderbird doesn't come with TorBirdy and Enigmail built-in??

Entities like the NSA can still track, collect and make sense of the headers of PGP-encrypted email.

Most early adopters and other techies don't use or advocate PGP for email because they're afraid when they start signing all their outgoing email it will look like an ASCII bird pooped all over their messages. Creating Mailpile won't change the fact that other email clients display PGP portions in messages as a mess.

And why do we want to stick with the old email protocol anyway? Projects like I2P-Bote already have working alphas out and it doesn't rely on centralized email servers at all, providing comprehensive end-to-end privacy.

bemildred

(90,061 posts)

4. Yes.

Reply to cprise (Reply #3)

Fri Aug 30, 2013, 08:14 AM

Aug 2013

I expect one consequence of this fuss is that the technology will be moved along in the direction of making this all "transparent" to the user and "private" in the old sense that nobody knows, which is feasible, just inconvenient to our "owners".

I quite agree about email, and would say the same of the whole web. A good place to talk, but not for serious business.

Also, if you rely on someone else to provide your security, then you become permanently insecure.

A lot of the crappy software out there is crappy on purpose. Nobody leaves crappy software they are used to for crappy software that they have to learn over. Good software you don't even notice.

Reply to this discussion