<story><title>Automatically enable or disable end-to-end encryption</title><url>https://bugzilla.mozilla.org/show_bug.cgi?id=135636</url></story><parent_chain><item><author>jwr</author><text>&amp;gt; the world at large dismissed OpenPGP encryption on mail as pointless&lt;p&gt;This is quite amazing, if you think about it. I&amp;#x27;m not one to promote conspiracy theories, but if you look at how we horribly botched all implementations of E-mail encryption over the years (that includes lack of development, terrible UI, delays, bizarre and unimplementable in practice standards like S&amp;#x2F;MIME), it is quite an impressive story.&lt;p&gt;Meanwhile, the HTTP world mostly got things done, and instant messaging is in a pretty good shape (although I&amp;#x27;m still amazed that so many people are willing to sync their entire phone book to Facebook for advertising purposes without a second thought).</text></item><item><author>noirscape</author><text>At first, a maintainer considered it to be a regression to implement (reading the bugzilla page), which caused it to be delayed for ~7 years. Then the issue went more or less inactive for almost a decade because the world at large dismissed OpenPGP encryption on mail as pointless (in part due to the complexity in actually getting it working since no mail client gave it a first class implementation, leading to a circular case of it not being implemented because nobody did it.)&lt;p&gt;2 years ago it was deliberately revived by Mozilla, then it devolved into bikeshedding about the design and now it&amp;#x27;s finally shipped.</text></item><item><author>hmate9</author><text>Does anyone have a tldr of why it took this long?</text></item></parent_chain><comment><author>Technotroll</author><text>I don&amp;#x27;t think they were horribly botched. It&amp;#x27;s simply a very hard problem to tackle, much harder than, say, end-to-end encryption over HTTP (which is of course HTTPS), simply due to the fact that the communication over HTTPS is one-to-one. Meanwhile, e-mail is often one-to-many, or even many-to-many. Not to mention that you can&amp;#x27;t force encryption all the time over mail, since that would entail forcing the upgrade of all distributed e-mail servers and systems out there. I mean, how are you supposed to do that? The consequence of that is that even a safely encrypted e-mail may easily be leaked the second it is forwarded through an unencrypted server, which happens surprisingly often. And when that happens, it&amp;#x27;s not just the one e-mail that is leaked, but possibly the entire thread of e-mails being sent with it previously, which kind of renders the entire point e-mail encryption moot.</text></comment>
<story><title>Automatically enable or disable end-to-end encryption</title><url>https://bugzilla.mozilla.org/show_bug.cgi?id=135636</url></story><parent_chain><item><author>jwr</author><text>&amp;gt; the world at large dismissed OpenPGP encryption on mail as pointless&lt;p&gt;This is quite amazing, if you think about it. I&amp;#x27;m not one to promote conspiracy theories, but if you look at how we horribly botched all implementations of E-mail encryption over the years (that includes lack of development, terrible UI, delays, bizarre and unimplementable in practice standards like S&amp;#x2F;MIME), it is quite an impressive story.&lt;p&gt;Meanwhile, the HTTP world mostly got things done, and instant messaging is in a pretty good shape (although I&amp;#x27;m still amazed that so many people are willing to sync their entire phone book to Facebook for advertising purposes without a second thought).</text></item><item><author>noirscape</author><text>At first, a maintainer considered it to be a regression to implement (reading the bugzilla page), which caused it to be delayed for ~7 years. Then the issue went more or less inactive for almost a decade because the world at large dismissed OpenPGP encryption on mail as pointless (in part due to the complexity in actually getting it working since no mail client gave it a first class implementation, leading to a circular case of it not being implemented because nobody did it.)&lt;p&gt;2 years ago it was deliberately revived by Mozilla, then it devolved into bikeshedding about the design and now it&amp;#x27;s finally shipped.</text></item><item><author>hmate9</author><text>Does anyone have a tldr of why it took this long?</text></item></parent_chain><comment><author>hannob</author><text>No conspiracy needed.&lt;p&gt;HTTPS was already there and working more or less automatically, you just had to make it the default.&lt;p&gt;E-Mail end-to-end encryption is inherently more complicated to make work, as you need to put the user in charge of key management.&lt;p&gt;Browser vendors made a big campaign and invested effort into making HTTPS work. Noone did that for E-Mail.&lt;p&gt;Also it should be mentioned that the same level of security that HTTPS has &lt;i&gt;almost&lt;/i&gt; exists in E-Mail. You have transport encryption, it is largely enforced on C2S connections. S2S is a bit more complicated, but even that is mostly solved by now via MTA-STS, which at least the larger mail providers support.</text></comment>