• The Quuuuuill
    link
    fedilink
    English
    18 months ago

    I also prefer gpg but it is not super beginner friendly. I generally recommend people away from proton and tuta unless they really want encrypted email and gpg isn’t something they can figure out

    • John Richard
      link
      English
      08 months ago

      GPG isn’t beginner friendly if you’re only using the CLI. However, even then there are tons of documentations and even Gemini/ChatGPT would prob be good at helping users create/manage their keys. However, I can provide a list of user-friendly GUI apps to create/manage/encrypt/etc. using GPG if you’d like that make it as easy. I mean, you can pay a company that says they’ll protect your privacy but history has shown paying for privacy is unreliable.

        • John Richard
          link
          English
          08 months ago

          You can use PGP with just about any email service. I personally just use SimpleLogin, where you can add your public key to have all your messages encrypted. But Thunderbird, KMail, Evolution, FairMail, etc all support email encryption too with IMAP.

            • John Richard
              link
              English
              18 months ago

              It’s quite possible that privacy is too hard for you and trash talking open source makes you feel better about the money you’re paying to someone else to say they’ll do a better job for you.

                • John Richard
                  link
                  English
                  08 months ago

                  Okay, well it’s just the vulnerabilities you mentioned were geared towards email client issues that among other things would automatically load HTML data upon decryption. Furthermore, primary vulnerable targets were 10 year old email clients at the time that hadn’t received any security updates. The SE data packet issue had been documented even in the spec since at least 2007 about its security issues and recommended rapid mitigation techniques. All in all, the EFAIL documented issues with mail client failures, not with OpenPGP itself.

                  Second, OpenPGP web-of-trust, or whatever you want to call it (public keyservers) is entirely optional. In fact, Proton relies heavily on this in from what I can tell actually enforces it in a more insecure way, but opting users into their internal keyserver automatically.