Stop Using Encrypted Email (2020)
The author says not to use email encryption but what is the case for sending email in plain text? Is encrypted email detrimental to my privacy in some way that unencrypted email is not? Or if the argument is that encrypted email is useless and no better than unencrypted email (since it is always unencrypted at rest) then what is the point of avoiding it in favor of the alternative? Aren't they equivalent, making the distinction meaningless?This is my problem with the article. It feels like it suffers from a bit of zero-sum fallacy. The statement here is, "it can be broken therefore it's fundamentally broken." I think it's more useful to think in terms of probabilities. If I disable password authentication for SSH and require public key authentication on my web server, an attacker can still get in by stealing my private key. That isn't a reason to take the opposite approach however - botnets commonly employ password-guessing attacks against entire IP ranges so you're not actually safer by avoiding this practice just because it isn't a perfect solution. There is no silver bullet for security, only endless layers of strategies and adaptations to edge cases.I did enjoy some of the points about the limitations of email encryption (the email chain example is a great reminder of how security is often more about human behavior than software). But I think the article could have been more compelling had it presented a less dogmatic thesis - perhaps "Email Encryption Won't Save You" or something like that.