🔐 Every unencrypted email is readable by 10+ entities and stored forever.
-
@grant_h 2/2 - Think of it like HTTPS adoption:
- WKD = certificate infrastructure (like Let's Encrypt)
- Autocrypt/client logic = protocol negotiation
- Warnings = mixed content alertsSo yes, the ecosystem supports "encrypt when possible" — WKD makes finding keys automatic. The clients handle the graceful degradation you're looking for.
@nicfab My use case is a school. Teachers and students. Particularly the counselling staff. It has to be easy and seamless, and resetable by our admins.
Unfortunately, the big companies have no incentive to make our email private, and every incentive to make it easy to join. The precise opposite of so many FOSS projects. We will persevere! -
@nicfab My use case is a school. Teachers and students. Particularly the counselling staff. It has to be easy and seamless, and resetable by our admins.
Unfortunately, the big companies have no incentive to make our email private, and every incentive to make it easy to join. The precise opposite of so many FOSS projects. We will persevere!@grant_h Go ahead!
-
🔐 Every unencrypted email is readable by 10+ entities and stored forever.
Web Key Directory (WKD) changes this: automatic encryption using your domain name. No manual keys. No central servers. Just cryptographic certainty.
WKD makes encrypted email as simple as HTTPS made web browsing secure.
https://www.nicfab.eu/en/posts/wkd2/
#WebKeyDirectory #WKD #EmailEncryption #Privacy #InfoSec #Cryptography #OpenPGP
@nicfab @Fr333k Just an observation: that's a long blog post, with a lot of words and with a lot of computer commands and that somewhat contradicts the sentence "WKD makes encrypted email as simple as HTTPS made web browsing secure."
Nothing is simple with OpenPGP and email and that's broadly documented in academia and annecdotes. WKD does not change that.
If you absolutely positively must use email for sending sensitive info, use S/MIME.
-
@nicfab @Fr333k Just an observation: that's a long blog post, with a lot of words and with a lot of computer commands and that somewhat contradicts the sentence "WKD makes encrypted email as simple as HTTPS made web browsing secure."
Nothing is simple with OpenPGP and email and that's broadly documented in academia and annecdotes. WKD does not change that.
If you absolutely positively must use email for sending sensitive info, use S/MIME.
@seecurity @Fr333k You’re right that nothing in email crypto is ever “simple” — WKD doesn’t change the complexity of OpenPGP itself. However, it does solve a particular problem that has long blocked adoption: key discovery.
That doesn’t contradict the analogy with HTTPS — it’s about lowering friction, not erasing complexity.
And yes, S/MIME can be smoother in some contexts, but WKD gives domains a way to make OpenPGP more usable in practice. -
@seecurity @Fr333k You’re right that nothing in email crypto is ever “simple” — WKD doesn’t change the complexity of OpenPGP itself. However, it does solve a particular problem that has long blocked adoption: key discovery.
That doesn’t contradict the analogy with HTTPS — it’s about lowering friction, not erasing complexity.
And yes, S/MIME can be smoother in some contexts, but WKD gives domains a way to make OpenPGP more usable in practice.@nicfab @Fr333k Email crypto is extremely complex and because of this, has plenty of attack surface. We published close to 10 papers in the last seven years attacking email and email encryption with OpenPGP and S/MIME.
I am at the point where I find recommending email encryption to be actively harmful. Metadata leaks all over the place, crypto from the '90s, plaintext fallbacks everywhere, user hate it, in particular the gnupg devs are very toxic, mail client developers lack time and (too often) expertise to implement it properly.
Just use Signal. If you got budget, build an app on top of Signal. Heck, just use WhatsApp. Just don't even try to send sensitive information with email encryption.
-
@nicfab @Fr333k Email crypto is extremely complex and because of this, has plenty of attack surface. We published close to 10 papers in the last seven years attacking email and email encryption with OpenPGP and S/MIME.
I am at the point where I find recommending email encryption to be actively harmful. Metadata leaks all over the place, crypto from the '90s, plaintext fallbacks everywhere, user hate it, in particular the gnupg devs are very toxic, mail client developers lack time and (too often) expertise to implement it properly.
Just use Signal. If you got budget, build an app on top of Signal. Heck, just use WhatsApp. Just don't even try to send sensitive information with email encryption.
It’s true: email crypto has flaws and decades of technical debt. But saying “just use Signal or WhatsApp” trades one problem for another — centralized silos controlled by single entities, which is even worse for long-term resilience, governance, and privacy.
WKD won’t magically fix email, but it removes real barriers and raises the baseline. Abandoning open, federated protocols entirely in favor of walled gardens is not a sustainable path.
-
🔐 Every unencrypted email is readable by 10+ entities and stored forever.
Web Key Directory (WKD) changes this: automatic encryption using your domain name. No manual keys. No central servers. Just cryptographic certainty.
WKD makes encrypted email as simple as HTTPS made web browsing secure.
https://www.nicfab.eu/en/posts/wkd2/
#WebKeyDirectory #WKD #EmailEncryption #Privacy #InfoSec #Cryptography #OpenPGP
@nicfab I already have a webserver for my website using my own domain name, do I need a second one or is it possible to combine this somehow?
Really interesting, first I hear of it. Thanks for sharing it!
-
@nicfab I already have a webserver for my website using my own domain name, do I need a second one or is it possible to combine this somehow?
Really interesting, first I hear of it. Thanks for sharing it!
@chiefbongo WKD is for a single domain name only. They cannot be combined, but you can have multiple WKD configurations for numerous domain names on the server.
-
@thedarktangent @yawnbox I share your concern — past attempts (PGP in DNS, DANE, SMILE, etc.) struggled with adoption. WKD isn’t a complete solution, but it’s worth setting up: it removes a key barrier and makes encrypted mail more usable, even if challenges like local search and subject-line leaks remain.
-
@thedarktangent @yawnbox I don't know.
Gli ultimi otto messaggi ricevuti dalla Federazione
-
At the #ItalianTechWeek, John Elkann will be joined by the Lord of #Amazon in person, Jeff Bezos, and Lords of #Arms companies such as #Leonardo. We will bring #Resistance:
technology for the 99%, NOT for the 1%, for #Peace.
-
Trump e Netanyahu: la pace come rapina | Left
https://left.it/2025/09/30/trump-e-netanyahu-la-pace-come-rapina/
> Altro che pace: siamo di fronte all’ennesima colonizzazione mascherata
-
Comunque la mattinata sta passando in modo molto confuso.
-
Rimango sempre molto basita da certi comportamenti umani. Nonostante l'età su alcune cose rimango ingenua. Non capisco se è un bene o un male.
-
Buongiorno,
John Elkann &Co porteranno a Torino #ItalianTechWeek: la tecnologia che sta rivoluzionando il mondo secondo piani e interessi dei signori della #Guerra,#Sorveglianza,#Capitalismo.
Noi porteremo la #Resistenza, grazie #SerenaDoe per #ItalianTechResistance
-
Osservatorio Nazionale di Bologna morti sul lavoro: Report morti sul lavoro dall'inzio dell'anno al 30 settembre
https://cadutisullavoro.blogspot.com/2025/09/report-morti-sul-lavoro-dallinzio.html?m=1
-
#NIST have issued updated #password guidelines for businesses. Interestingly they now say that requiring special characters is no longer a recommendation, but longer passwords / passphrases (using spaces) is a better idea.
I say "interesting" because that's something I've been doing for many years, long before I discovered password managers to remember things for me.
-
@bbacc @ModestinoSycamore @filobus @materialgirl succede sempre più spesso, devono essere le scie chimiche e il 5g 🤣
