[perpass] Mail encryption as an example

[Yaron Sheffer <[e-mail]>]

Hi,

Stephen mentioned that S/MIME is not good enough because headers 
(to/from) are still exposed. But there's still tons of benefit when the 
content is encrypted, even if the metadata is exposed (provided users 
know that it is exposed, of course). E.g. I would like all my internal 
company email to be encrypted, even if tracing recipients is trivial for 
the attacker.

In other words, is the scope of the mailing list/solutions limited to 
security of individuals, as opposed to organizations?

 From a deployment perspective, I think we know how to provide privacy 
("identity protection") only by using heavyweight solutions, such as 
onion routing. But there's a whole lot of important things we could do 
(make S/MIME usable, standardize OTR, revive IPsec OE) if we remove this 
constraint. Are such items in scope of this discussion?

Thanks,
     Yaron