Hacker News new | ask | show | jobs
by u801e 2892 days ago
> SMTP and IMAP would require transmitting the password to the server for decryption

Why? There's nothing in the SMTP or IMAP specification that I'm aware of that requires that the email be in a decrypted form when stored in a mailbox. When a client fetches the email via IMAP, it can then be decrypted on the client side.

On the SMTP side, I could do the following over telnet

    EHLO test
    AUTH PLAIN XXXX
    EHLO test
    MAIL FROM: <my@address>
    RCPT TO: <your@address>
    DATA
    <encrypted ascii armor text>
    CRLF.CRLF
On the IMAP side I can log in and run

    . SELECT Inbox
    . FETCH 1 (BODY[])
which should retrieve that ascii armor text. Then I can decrypt it locally.
2 comments

As I understand it, you can already use ProtonMail this way with their IMAP bridge. I think their concern is UX, since many people don't know how to set up PGP locally, while opening a ProtonMail account and using the web interface is easy.
That's basically just what GPG mail is, right?