>The lack of E2E encryption and sender authentication makes it completely useless these days.
The elephant in the room here is that there is nothing wrong with, say, PGP. Any meaningful approach using public key crytography and crytopgraphic signatures to achieve confidentiality and authentication over SMTP ends up with the conclusion that you could of just used the OpenPGP protocol.
I think the reason we like to think that there is some new method available that will finally make things work is the hope there is a purely technological solution available. After 30 years of failing to come up with such a solution it is clear that there is no such solution possible in isolation.
PGP is incompatible with both forward secrecy and metadata secrecy.
If you only want to keep your message body confidential (or authenticated), PGP is reasonable. But it provides a strictly lesser degree of secrecy than modern e2ee messaging applications.
In fact, depending on your threat model, modern SMTP-TLS (which is not e2ee, but does provide some metadata confidentiality and forward secrecy) may in fact be an improvement over PGP.
Forward secrecy isn't really an issue with email. There are few that would be willing to delete their emails after reading them. Keeping old messages around for all practical purposes negates the value of forward secrecy. Most people like to keep their old messages in an easily accessible form so forward secrecy is not very important for messaging in general.
>...metadata secrecy...
This is not a huge problem with a medium like email where you can be more or less anonymous. Contrast with things like instant messengers that insist on a phone number.
>But it provides a strictly lesser degree of secrecy than modern e2ee messaging applications.
Most of those applications take the form of instant messengers. Since such things by necessity have to leave the private key material exposed all the time they are generally less secure than something like encrypted email where that key material can be kept very locked down.
>...modern SMTP-TLS (which is not e2ee, but does provide some metadata confidentiality and forward secrecy) may in fact be an improvement over PGP.
True enough. SMTP-TLS does provide even more security to the encrypted email user. Most importantly, it prevents passive listeners from detecting that an email was encrypted and thus worthy of further interest.
I can't help but point out that this sort of discussion is an excellent example of the state of denial that exists with respect to end to end encrypted messaging these days. Rather than addressing the broader overall issues we are quibbling about obscure technical details.
E2E with forward secrecy was not possible in the past because email was an offline thing. You can't do PFS without a live connection between the endpoints.
However, these days this should be less of an issue in an ever connected world. Nobody uses UUCP or batched SMTP anymore :)
Another thing is that e2ee breaks a number of useful features of e-mail:
- The ability to painlessly access your mail from a number of different clients, ranging from fully-featured desktop clients to smartphone apps to webmail.
- Server-side filtering (both spam and in general)
- Server-side searching (mandatory for webmail and depending on how big your mail archive is, still rather useful for smartphones, too)
The elephant in the room here is that there is nothing wrong with, say, PGP. Any meaningful approach using public key crytography and crytopgraphic signatures to achieve confidentiality and authentication over SMTP ends up with the conclusion that you could of just used the OpenPGP protocol.
I think the reason we like to think that there is some new method available that will finally make things work is the hope there is a purely technological solution available. After 30 years of failing to come up with such a solution it is clear that there is no such solution possible in isolation.