| ▲ | woodruffw 6 hours ago | |||||||||||||||||||||||||
> if both of those servers are in control of the sender and recipient and the connection between them is encrypted then the metadata remains private. Why are we entertaining this hypothetical? It isn’t true in practice; the average user doesn’t control their mail server. The average user is using Gmail or Outlook, where their metadata is a single subpoena away. And again, it just isn’t true: you need not just control over the server but also strict transport security for this property. This is not widely true of mail servers on the Internet. > rejecting deltachat is rejecting something that improves the current state for something better that is not obtainable by some. I don’t agree. I think the average user has multiple high-quality E2EE messaging technologies available to them, and that Delta Chat effectively muddies the water by providing a worse security posture with the trappings of a familiar-but-unsecurable ecosystem (email). (I also don’t know why people think Signal shares your phone number with people other than recipients. To my knowledge, that has never been the default and presumably never will be, even with their private contact discovery protocol.) | ||||||||||||||||||||||||||
| ▲ | em-bee 4 hours ago | parent [-] | |||||||||||||||||||||||||
the average user doesn’t control their mail server fair point. there are options however. you are not locked into trusting a specific entity. but the critical point is that even signal is able to figure out who is talking to whom: https://sanesecurityguy.com/articles/signal-knows-who-youre-... sure, for SMTP the contact details are directly in the messages, which is worse, but i don't know of any service that works completely without metadata. but signal is at least trying. also strict transport security for this property. This is not widely true of mail servers on the Internet since gmail requires TLS i highly doubt that there are many servers out there that don't support it. the average user has multiple high-quality E2EE messaging technologies available to them available and willing to switch are different. as i said, my friends are not willing to sign up to yet another messaging service. it's a social media fatigue. why people think Signal shares your phone number with people other than recipients that's not the point, at least for me. i am hesitant share my number with signal or any other service, and worse, i do not want to share my number with the people i talk to. i refused to use signal until the later was fixed. i refused whatsapp too, but to many people that i need to reach demand it, so i had no choice. these are all trade-offs. not everyone agrees on the same, and while i understand and principally agree with your arguments, for me they don't work because i can't convince my friends. i also have other friends who do run their own mail servers. i have contacts who require whatsapp and others who can only use wechat. most often i don't have a choice. i am using whatever i can get people to agree to, and for that deltachat is a good option. signal could have been a better option but unfortunately their requirement to share phone numbers until recently made them a worse option than deltachat or even telegram for anything but 1:1 communication with trusted friends (those who i trusted to have my number). that has changed now, and i started to use it. but it will take time to build up my contacts there. btw, in some countries it is not even possible to sign up to signal. the number gets rejected. | ||||||||||||||||||||||||||
| ||||||||||||||||||||||||||