That’s the reason we have to still use fax machines right?
I know there are ways to do encryption like PGP on your message directly or I think email sent over TLS? But that isn’t the default right and that’s why I can’t send a picture of my license to the insurance company directly over email?
I’ve seen something about emails being signed and stuff like that. I guess I’m out of the loop. I had a coworker once PGP sign their emails and it would have a signature at the bottom that I (and probably everyone else) ignored.
Why couldn’t email just be encrypted ala https? Make a TLS connection, send message, end, move on. Or really just make TLS connection, POST a message, move on.
I know it’s more complicated than that but not by much really… why haven’t we just made a new secure standard based on https?
Your email likely is already delivered over a TLS or SMARTLS protected channel. That’s not the (only) problem PGP addresses. PGP provides message authentication in addition to encryption.
To take your colleague as an example, his email was cryptographically signed by him. A function that requires his private key, and possibly a passphrase to unlock the key. The signature includes a hash of the message, and requires that private key to generate. On your end, your client hashes the message again and compares the signature. If it isn’t identical, someone has tampered with the content. Presuming you met up ahead of time in person or through another trusted channel, and shared public keys, seeing the valid signature also gives you confidence that this email was actually written by the person you expect, and not anyone else with access to their device or account. (If the senders key is still safe anyway.)
It is. When you send an email a startls session is created between the servers as its a point to point protocol. That session is then used to send the message. You can downgrade to plain text which is where the problem lies.