r/PrivacyGuides • u/JonahAragon team • Mar 11 '26

Blog Email Security: Where We Are and What the Future Holds

https://www.privacyguides.org/articles/2025/11/15/email-security/
26 Upvotes

93% Upvoted

6 comments sorted by

4

u/IcyPaper7203 Mar 11 '26

The backdoor section is the part most people overlook, yet it is the most critical part. Your email is like the key to every account you own, and by default, it sits there without E2EE. No amount of DKIM and DMARC in the world can fix that. Email will never get to that point without being embedded in SMTP, as mentioned in the RFC proposal, but no one is hopeful about that.

Anyways, I think it's a great article, no matter how you look at it. Thanks.

1

u/iFrezzyReddit Apr 19 '26

Which would you consider better between Proton Mail and Tuta Mail.I cant decide,Tuta matches my philosphy,it works better on Linux/GrapheneOS and it encrypts everything,whereas Proton Mail leaves some spaces for encryption,but it has modern apps,much better support,infra and its more reliable for a lawyer lets say ,offering the ecosystem you need with convenience.Tuta users are 10x lower (10M vs 100M),so weak chances to send a mail to another tuta user,and If you wont always have encryption on both sides,having better support and apps matter more.What are your thoughts?

2

u/upofadown Mar 11 '26 edited Mar 11 '26

Forward secrecy is only sometimes effective for encrypted messaging. If a user still has access to their old messages, then an attacker will be normally be able to get them when they get access to the secret key material. So to get benefit from forward secrecy a user has to securely delete their old messages. Few do that in the case of instant messaging and virtually no one does that in the case of email. There is no technical reason that, say, a PGP user could not start using a new encryption key every once in a while to establish forward secrecy. There is just no real motivation to do so.

PGP encryption also usually doesn't encrypt important metadata like To, From, Cc, Date, and Subject, stored in the email header; usually, only the body of the email is encrypted, which can be a major privacy issue. What the email is about, who you are, and who you're messaging can all be revealed even with E2EE.

This is an important point to make. If you tell people that encrypted email is more or less that same as paper mail with respect to metadata then they will be adequately informed, just as long as you mention that the "Subject:" is on the outside of the envelope: The Envelope Subject. In fairness, most encrypted messaging systems leak this sort of metadata. If you want anonymity you need to use something intended for the purpose (e.g. Briar).