Re: [Endymail] Off we go...

[Viktor Dukhovni <[e-mail]>]

On Tue, Aug 26, 2014 at 03:34:37PM -0700, Pete Resnick wrote:

> So off we go... What projects are folks working on, and what should the IETF
> be doing in this space?

If we get the email backbone broadly protected with TLS, the greatest
remaining risk is data at rest (messages delivered to the user's
mailbox).

For me, the first step towards protecting messages at rest, is to
encrypt them on delivery to the message store, where key management
is simplest, because that store only needs the public keys of the
recipient.

So I'd like to see support for delivery-time encryption in LMTP
servers (dovecot, ...).  This gets the recipient's mail protected
in storage regardless of the payload encryption capabilities of
the sender.  Yes, this is not an end-to-end mechanism, and it may
be too late if at some point en-route the message was transmitted
in the clear.

Such support can gradually be moved closer to the edge, with payload
encryption at the inbound gateway (roughly as far as many enterprises
can allow it, since otherwise they lose visibility into the message
content for anti-virus, data-leakage, regulatory archiving, ...).

Beyond inbound gateway encryption, there is also an opportunity
for gateway-to-gateway message encryption, but frankly I don't
see much reason to do that rather than TLS.

Finally, there is an opportunity to have end-to-end payload
encryption, but seemingly at the cost of many of the features
for which users trade-in their privacy with the major consumer
email providers.  Server-side anti-spam and search for example.

With today's technologies we know that "Johnny can't encrypt", if
we improve the technology, what will it take for "Johnny" to be
willing to encrypt?

What's the sweet-spot for protection of messages at rest that does
not unacceptably impact usability?  Unlike IM conversations, that
users expect to be largely ephemeral, people tend to "hoard" email
as a long-term record of communication.

So with each technology or design discussed on this list, perhaps
it might be helpful to understand where it fits into the protection
spectrum and what are the usability trade-offs and the target
audience.

My take, is that with mobile devices and the like, which do not
attempt to maintain a complete locally searchable archive of email
(as one might with IMAP on a dedicated personal computer) there is
strong incentive for email content management at the server, and
end-to-end just can't compete.  The usability constraints may be
far too tight.

I don't use any of the major providers for email, and don't
synchronize smart-phones and the like to my self-hosted IMAP mailbox.
So I can work with the quite decent search and anti-spam capabilities
in the desktop/laptop IMAP client.  I am very much the exception
to the rule.  

So I am somewhat skeptical that the competing demands in this space
can be met simultaneously, and my guess is that usability will win
hands down for most users.  It would be nice for my hunch to be
proved wrong.

-- 
	Viktor.