Hacker News new | ask | show | jobs
by alwayslikethis 974 days ago
I agree with the sentiment, but I question how useful this would really be. Most people nowadays unfortunately use web clients, so the keys are going to have to be stored somewhere else, since backing up a browser's local storage is no easy task. If you don't have sole access to keys, but rather the keys are controlled by the same entities that control your email, I don't think there will be any benefit.
3 comments

I have similar doubts as well. Especially considering that digital signatures and encryption do not protect against impersonation attacks, like phishing via facebok.com or other similar sounding domains, in either the case of websites or email. But without widespread use you don't even have the option.
There are plenty of email users on IMAP, and they use web mail to host mail storage. The IMAP clients can do S/MIME (or PGP I suppose).

The bigger problem is trustworthy user discovery service i.e. a directory to exchange public keys. This exists at an enterprise level (active directory) but not globally.

Usually anyone that buys into the viability of PGP email will also tell me with a straight face that the MIT keyserver is completely appropriate for civilians.
Search is another problem, because instead of simply being able to rely on server-side full text search, every client needs to download all mails, decrypt them all and then create and maintain its own local search index.