🔐 Every unencrypted email is readable by 10+ entities and stored forever.
-
@nicfab @Blort we know there is an IETF doc about wkd. Delta is probably one of the most standards based messengers out there https://github.com/chatmail/core/blob/main/standards.md
But that doesn't mean any IETF standard is unconditionally a good idea for resilient decentralized messaging. -
@thedarktangent @yawnbox This article is not about email security but about WKD. I have already written about email security and will likely revisit the topic in the near future.
@nicfab @yawnbox I have lived through essentially the same issues with PGP keys in DNS, hashes of SMime keys in DNS, MTA-STS, DANE for SMTP, automatic SMIME using SMILE, etc.
I hope WKD does better! But I fear that without a solution to local email search it will be a victim of its own success, or you will have to put so much information in the subject line to remind you what is in the encrypted body that some privacy is lost.
-
-
@nicfab @yawnbox I have lived through essentially the same issues with PGP keys in DNS, hashes of SMime keys in DNS, MTA-STS, DANE for SMTP, automatic SMIME using SMILE, etc.
I hope WKD does better! But I fear that without a solution to local email search it will be a victim of its own success, or you will have to put so much information in the subject line to remind you what is in the encrypted body that some privacy is lost.
@thedarktangent @yawnbox I share your concern — past attempts (PGP in DNS, DANE, SMILE, etc.) struggled with adoption. WKD isn’t a complete solution, but it’s worth setting up: it removes a key barrier and makes encrypted mail more usable, even if challenges like local search and subject-line leaks remain.
-
-
🔐 Every unencrypted email is readable by 10+ entities and stored forever.
Web Key Directory (WKD) changes this: automatic encryption using your domain name. No manual keys. No central servers. Just cryptographic certainty.
WKD makes encrypted email as simple as HTTPS made web browsing secure.
https://www.nicfab.eu/en/posts/wkd2/
#WebKeyDirectory #WKD #EmailEncryption #Privacy #InfoSec #Cryptography #OpenPGP
@nicfab
Reading the article, I can't see how this works out in a hybrid situation - where not all your email recipients are using WKD. Am I missing something?
You mention the strength of email being its own prison - we need something that would encrypt where possible, and fall back to plaintext where not (with warning). HTTPS was not implemented across the board overnight. -
@nicfab
Reading the article, I can't see how this works out in a hybrid situation - where not all your email recipients are using WKD. Am I missing something?
You mention the strength of email being its own prison - we need something that would encrypt where possible, and fall back to plaintext where not (with warning). HTTPS was not implemented across the board overnight.@grant_h 1/2 You're right — WKD alone doesn't handle the hybrid scenario. It's just key discovery, not the complete solution.
For opportunistic encryption, you need WKD plus smart clients: Thunderbird, DeltaChat, and others already do this — they check for keys via WKD/Autocrypt, encrypt when possible, and fall back to plaintext with warnings. -
@nicfab
Reading the article, I can't see how this works out in a hybrid situation - where not all your email recipients are using WKD. Am I missing something?
You mention the strength of email being its own prison - we need something that would encrypt where possible, and fall back to plaintext where not (with warning). HTTPS was not implemented across the board overnight.@grant_h 2/2 - Think of it like HTTPS adoption:
- WKD = certificate infrastructure (like Let's Encrypt)
- Autocrypt/client logic = protocol negotiation
- Warnings = mixed content alertsSo yes, the ecosystem supports "encrypt when possible" — WKD makes finding keys automatic. The clients handle the graceful degradation you're looking for.
-
@grant_h 2/2 - Think of it like HTTPS adoption:
- WKD = certificate infrastructure (like Let's Encrypt)
- Autocrypt/client logic = protocol negotiation
- Warnings = mixed content alertsSo yes, the ecosystem supports "encrypt when possible" — WKD makes finding keys automatic. The clients handle the graceful degradation you're looking for.
@nicfab My use case is a school. Teachers and students. Particularly the counselling staff. It has to be easy and seamless, and resetable by our admins.
Unfortunately, the big companies have no incentive to make our email private, and every incentive to make it easy to join. The precise opposite of so many FOSS projects. We will persevere! -
@nicfab My use case is a school. Teachers and students. Particularly the counselling staff. It has to be easy and seamless, and resetable by our admins.
Unfortunately, the big companies have no incentive to make our email private, and every incentive to make it easy to join. The precise opposite of so many FOSS projects. We will persevere!@grant_h Go ahead!
-
🔐 Every unencrypted email is readable by 10+ entities and stored forever.
Web Key Directory (WKD) changes this: automatic encryption using your domain name. No manual keys. No central servers. Just cryptographic certainty.
WKD makes encrypted email as simple as HTTPS made web browsing secure.
https://www.nicfab.eu/en/posts/wkd2/
#WebKeyDirectory #WKD #EmailEncryption #Privacy #InfoSec #Cryptography #OpenPGP
@nicfab @Fr333k Just an observation: that's a long blog post, with a lot of words and with a lot of computer commands and that somewhat contradicts the sentence "WKD makes encrypted email as simple as HTTPS made web browsing secure."
Nothing is simple with OpenPGP and email and that's broadly documented in academia and annecdotes. WKD does not change that.
If you absolutely positively must use email for sending sensitive info, use S/MIME.
-
@nicfab @Fr333k Just an observation: that's a long blog post, with a lot of words and with a lot of computer commands and that somewhat contradicts the sentence "WKD makes encrypted email as simple as HTTPS made web browsing secure."
Nothing is simple with OpenPGP and email and that's broadly documented in academia and annecdotes. WKD does not change that.
If you absolutely positively must use email for sending sensitive info, use S/MIME.
@seecurity @Fr333k You’re right that nothing in email crypto is ever “simple” — WKD doesn’t change the complexity of OpenPGP itself. However, it does solve a particular problem that has long blocked adoption: key discovery.
That doesn’t contradict the analogy with HTTPS — it’s about lowering friction, not erasing complexity.
And yes, S/MIME can be smoother in some contexts, but WKD gives domains a way to make OpenPGP more usable in practice.
Gli ultimi otto messaggi ricevuti dalla Federazione
-
@freezr
Non la conoscevo, però è una merda che percepivo.
-
@Crissy aww! I’m sorry for your loss.
-
-
@tommorris oh, my fun days working on business integration challenges as an IT consultant back in the day. There was a particularly fun retail system that involved squirting XML directly into a TCP socket (with no confirmation, and it could terminate the connection when it felt like it). Sorry, I know your rant is SAP specific! But yes, many such annoying things out there in the wild. This is where software businesses build services businesses (see also: Salesforce IBM Oracle et al)
-
@evan Tasty?
-
Long-tailed skipper #butterfly on lantana in the front #garden.
#SilentSunday #Stunday #photography #butterflies #butterflyphotography #nature #insectphotography
-
@jones infatti, ho mastodon su xxx.xxx.xxx.7, servizio_1 su xxx.xxx.xxx.8, servizio_2 su xxx.xxx.xxx.9 della mia LAN e così via. Per quanto possibile cerco di avere quanti più servizi in self-hosting.
-
Mind blown by @stsp
It is possible to chat with a bot via SSH
For a demo:
ssh signup@gothub.orgNifty!
