Comment on So Austistici/Inventati just got designated as a "global terrorist organisation" by the Trump administration, what do I do now?

• quick_snail@feddit.nl ⁨2⁩ ⁨weeks⁩ ago

  The way it works is that it’s encrypted server side with your password.

  If the server isn’t infected, they can’t read your email. If the webmail server is infection, they could store your password on author (instead of just hashing it immediately) and decrypt your email.

  The mitigation to this risk of server integrity compromise is PGP

  source

  • diaphragmwp@discuss.tchncs.de ⁨2⁩ ⁨weeks⁩ ago

    Okay. New mail arrives. Plaintext, SMTP. You have not logged in today. To store it, it needs to know your password…

    About as good as a gate in the middle of a field. Better just use POP3.

    source

    • Ghoelian@piefed.social ⁨2⁩ ⁨weeks⁩ ago

      No, that’s not how it works. If you set up mailbox encryption (mailbox guard), you set up (or let mailbox.org generate) a pgp keypair. Any time you want to read an email, you have to unlock the key first. This way you can use regular imap, the body of emails will just arrive encrypted (and optionally the subjects as well I believe), you only need a pgp decryption tool to read the mails (which Thunderbird/K9 supports out of the box (with OpenKeychain on Android)).

      source

      • diaphragmwp@discuss.tchncs.de ⁨2⁩ ⁨weeks⁩ ago

        Right. A user from another server sends you mail. The mail is unencrypted on their side because they don’t know your key yet, or they don’t know how to use OpenPGP, or it’s automated.

        Servers talk SMTP between each other, not just a client sending mail.

        < 220 mail.mailbox.org EpicServerSoftware7000
        > HELO mail.riseup.net
        < 250 mail.riseup.net Service ready for new user
        > MAIL FROM:<coolskeleton98@riseup.net>
        < 250 Requested mail action okay, completed
        > RCPT TO:<chud@mailbox.org>
        < 250 Requested mail action okay, completed
        > DATA
        < 354 Start mail input; end with <CRLF>.<CRLF>
        > From: "CoolSkeleton98" <coolskeleton98@riseup.net>
        > To: chud@mailbox.org
        > Subject: Test Message
        >
        > Hey, this is a test message!
        > .
        >
        < 250 Requested mail action okay, completed
        > QUIT
        < 221 mail.riseup.net Service closing transmission channel
        

        The round trip time in this protocol is fucking insane, but that’s what the people in the year 1980 thought of. They never thought this would be used outside of universities.

        Anyways, inevitably, mail.mailbox.org gets the message, unencrypted. It can encrypt it later, needs the key though.

        source

        • -> View More Comments
• Ghoelian@piefed.social ⁨2⁩ ⁨weeks⁩ ago

  It is openpgp, but I’m not aware of another mail provider that allows you to encrypt every mail when it arrives. Mailbox.org does have to manage this key though of course, but it can be a separate one from what you use to sign / encrypt sent emails.

  source