appleprivacyletter VS mailvelope_client

Hi, the Global Encryption Coalition doesn't take stands as a Coalition but members often do... and 90 or so groups and experts wrote a letter earlier this year in opposition to that: https://appleprivacyletter.com/ (note that ISOC, where I work, did not join that letter)

Part of me wonders if the calculus includes either (a) the open letter signed by (effectively) ~10k verified developers [1], (b) the complaint letters from groups like the EFF [2, 3], or (c) expert and qualified input from their (presumably huge) marketing department...

[1] https://appleprivacyletter.com/

An Open Letter Against Apple's Privacy-Invasive Content Scanning Technology

(e.g. https://appleprivacyletter.com/)

In that light, FISA is relevant. My statement was to show that not all dealings of the US government are public, because not all courts and legal proceedings are available to the public. So "serious risk of leaks to journalists" won't likely happen in that case.

Thanks for this link. He mentions Apple Privacy Letter which is another petition for the same issue.

You can sign the petition against Apple here.

I suggest you read the open letter circulating to better understand the problems with Apple’s implementation.

Webmail: Many people don't even use an e-mail client today -- they use webmail to access their messages, or they use a local app that itself depends heavily on a webmail server on the backend to do the heavy lifting. When the server is doing the e-mail handling and rendering work, the server has to have access to the cleartext. Even in situations where the messages are decrypted in javascript (or a Java applet) on the client side, if the client-side code is sent by the server, the server could be compromised and told to send different code (see Hushmail's failures in 2007) How do we fix this? We need more e-mail client developers to take e2ee e-mail seriously, and we need them to focus on security and usability. Browser-extension-based e-mail clients are another possibility (e.g. Mailvelope and its interaction with webmail) systems like Roundcube), but they still rely on a lot of metadata to be exposed on the server-side.