Yahoo! spaffs! out! plugin! to! bring! crypto! to! everyone's! email!

Yahoo! has shown off an OpenPGP-based end-to-end e-mail encryption it says will be offered as a plug-in by the end of the year. Its aim is to make PGP-based encryption more accessible to the everyday layperson. Described in this blog post by Purple Palace chief information security officer Alex Stamos, the mail encryption …

[John H Woods]

"you can't route a message if the address isn't in the clear"

but you can post it on a forum...

/XlWH0wBITAhITAhLTBPcjtSdEsoPfsg9hEGgTYtAQZeukIallFDVJghMTAhp9g3xy1/b8VvY/XT

fD6Qp3DpubNWLTlzYpW2nd2mSb87xsCTITE2MCGiLW/Iy02WYVmAK4jwhgc0afkt/zz7VB0SITEy

ISgx5r3CfYPXHS3p0A==

[Mark 85]

True. And those who might take more than a passing interest will know who you are and where you are located for <cough>"further investigation"<cough>. They will also know who looked at the webpage probably. It's just bit more difficult to find these things out.

[JassMan]

@John H Woods

Nice idea but I'm sure the UK gov will make it illegal to post messages such as yours once GCHQ notice a flurry of messages with double encryption. They may not know who the recipient is intended to be, but they will certainly be able to force el Reg to reveal your identity even if you had posted as AC.

I haven't bothered seeing if I can find your public key but I assume you only used your own key. To be able to send private messages, you need to also to use the public key of your recipient. This becomes a bit unwieldy as an email system, since everyone who knows you has to try to decrypt every message you post to see if any particular message is intended for them. Would anyone ever bother decrypting every AC post in case one was intended for them?

[Martin Gregorie]

Great!

So now we're going to be deluged with encrypted spam!