Unencrypted sensitive data in an email is a really bad idea. I hope they never do that.
Although what I would really like, and think is long overdue, is an extension to email that normalises encryption and sender verification. It's ridiculous that email can be spoofed like that. (The same is even more true for phone numbers.)
Indeed. We really either need email to get decent, user-friendly encryption and verification, or replace email with a new, ubiquitous, decentralized, system that has first class support for encryption.
I have a laundry list of other issues I'd like fixed in email, but I'd be happy just to get end to end encryption and sender verification.
Is it really? Who can read it today? Your email provider and theirs? Gmail won't deliver messages without TLS any more, so everyone supports it or they're effectively kicked out of email.
Well, the email providers. And that could easily include Google without you even realising.
It's true that email isn't quite as insecure as it used to be (it was once compared to shouting your message at someone and expecting them to shout it in the right direction until it reached the intended recipient), but there are still many things missing compared to other forms of direct messaging, and there's good reason why many people and organisations don't want it used to send sensitive information.
Comments
Unencrypted sensitive data in an email is a really bad idea. I hope they never do that.
Although what I would really like, and think is long overdue, is an extension to email that normalises encryption and sender verification. It's ridiculous that email can be spoofed like that. (The same is even more true for phone numbers.)
Indeed. We really either need email to get decent, user-friendly encryption and verification, or replace email with a new, ubiquitous, decentralized, system that has first class support for encryption.
I have a laundry list of other issues I'd like fixed in email, but I'd be happy just to get end to end encryption and sender verification.
Is it really? Who can read it today? Your email provider and theirs? Gmail won't deliver messages without TLS any more, so everyone supports it or they're effectively kicked out of email.
TLS just encrypts the IMAP / SMTP sessions, no guarantee it’s stored encrypted, let alone end to end
You didn't answer this question:
Well, the email providers. And that could easily include Google without you even realising.
It's true that email isn't quite as insecure as it used to be (it was once compared to shouting your message at someone and expecting them to shout it in the right direction until it reached the intended recipient), but there are still many things missing compared to other forms of direct messaging, and there's good reason why many people and organisations don't want it used to send sensitive information.
How is that different from your browser and the bank website being able to read the same PDF transmitted through the website?