Well, maybe they just don’t want to have to scan it into their system. But still, I would show up with a copy and let them handle it. People seem very confused when I do this, but they accept it when the document is in their hands. I’m glad nowadays more places have secure portals where I can upload documents myself.
Anyway, I agree. Email is the main way I keep in contact with a lot of people. I also like that the norm is longer messages that don’t require an instant response. Emails replace letters and messengers replace phone calls. You can’t ignore the social dynamics here and focus only on the tech solution.
Which fundamentally is what’s worthwhile, because no provider ticks all the boxes. It’s worth noting with Mailbox they’re somewhat constrained by what Open-Xchange supports. E2EE with email pretty much gives you three options:
A bridge (what Proton does), but then they make certain decisions for you like requiring both the public/private key. Requires provider specific apps.
Custom encryption which is inoperable and provider specific - Tuta. Requires provider specific app.
Best attempt, encrypt incoming emails and outgoing emails with PGP when it hits the inbox/sent folder.
One of the things that 3. does do is shift the encryption side channels away from something the provider controls, eg they cannot put a backdoor in Thunderbird for example.
The advice for the email page always has been to use real-time-messengers where security/privacy are paramount because chances are when you send that email to someone they won’t be on a privacy provider and will simply have a plain text copy in their inbox.
As for “password protected emails” ie emails where a link is given to a recipient but they don’t actually have a copy of the email, these I bet would be rarely used in practice as it’s quite likely the recipient simply won’t open the link.
They may be used in some situation where a file like a report or document is being shared, but outside of that I can’t imagine anyone using it.
In regard to Mailbox, in some ways it could be argued it has a higher security than it’s competitors depending on how you look at it. For example if an email passes through their service and is encrypted with the public PGP key, there’s no way that can be reversed, no code can be introduced into the app, no code can reverse that if they never had the private key (encrypted or otherwise) to begin with. Proton and Tuta work based on legislative controls as opposed to technical ones.
Are you sure? There is all kind of audience out there, everyone is in a different step in this journey. Most of your examples didn’t cover things that get people blackmail or killed. People don’t really know how risk email is, and sensitive content vary quite a lot. We are all forced from time to time to get exposed via email, it was a direction not a strict rule.
Exactly, so not sure what was the point. Emails are risk, avoid as much as you can exchanging things that you may regret.
To be fair, Proton also has this path as one of the options. With SimpleLogin the user can encrypt mail with their own public key, without trusting Proton to manage the private one. Same for Cloudflare, Addy, and Forwardemail, there are plenty of options. Probably some other features should be considered if the user prefers the 3rd way.
Added: it also makes it possible to combine the 1st or 2nd approach with the 3rd one, though that feels like a weird thing to do, personally.
Probably we can just make the services that try a different approach more visible. I won’t succeed much there, since I’m not comfortable naming the bank I use, but I appreciate that they offer WhatsApp instead of SMS for sending 2FA codes. A lot of European banks also email a link to sensitive docs rather than the docs themselves.
SPF/DKIM/DMARC: We have significantly improved our mail infrastructure since then and have not received recent reports of similar issues. However, we cannot guarantee that every message failing these checks will automatically be rejected or moved to spam.
Password reset and 2FA: This behavior is related to the integration of Keycloak with our two-factor authentication system. Once your password has been reset, you will need to set up 2FA again to restore the additional layer of protection.
YubiKey and passkeys: FIDO2/WebAuthn security keys and passkeys are not yet supported with Login 2.0, but support is planned for the future. We currently have no confirmed release date.
Missed payments: We send three reminders before your subscription expires, giving you time to renew your account and avoid service interruptions. We recommend renewing promptly, as account restrictions may apply after expiration.