Lots of people, including my parents, use email as an asynchronous messaging platform. For those people, Signal is an eminently suitable replacement.

As the post points out: email cannot be extended into a secure position. Attempts to do so either fail to interoperate or fail outright.

Email is also an archive of communications with vendors, shops and government departments.

Signal doesn't let you migrate chat history to your desktop.

Trying to migrate between phones while retaining your Signal history is too hard for most people.

Signal is not at all a suitable replacement, and I believe that forward secrecy is an anti-feature for an email-like usecase.

You know you're in trouble when people start talking about forward secrecy being problematic. What you're saying about the "email-like use case" for cryptography is that it's unserious protection, because a lack of forward secrecy practically guarantees full decryption of the entire history of messages, for any ordinary participant in the system.

A major goal of an email-like system is full decryption of the entire history of messages.

Same as it's a feature of my filing cabinet that items don't incinerate themselves whenever I move house.

Sure. Because people overwhelmingly aren't relying on the security of their email; it's overwhelmingly stuff no adversary would care to read. Then they retrofit the UX requirements they have for those boring mails onto all emails, and suggest that encrypted email should just accept those as constraints, and then we'll declare victory.

>a lack of forward secrecy practically guarantees full decryption of the entire history of messages, for any ordinary participant in the system.

Can you elaborate?

Eventually a private key will leak, and without forward secrecy, that private key will probably decrypt all past messages to that person, and all future messages to that person, until they give all their correspondents a new key.

With email, because people quote when replying, you'll get the other side's messages too.

Like, the simple PGP-like system where sender encrypts message using recipient's public RSA key.

And of course it's not improved by switching from RSA to ECIES.

You need to ratchet the key, or double ratchet like Signal protocol.

Email as a concept can evolve. We can break backward compatiblity. Call it email v2 and include some killer features. If enough major players and users get involved then it'll happen.

My hope is it'll be something like Dark Mail, yet with a carve out for enterprise recipients to inject their controls and anti-malware before end-user delivery. (To combat spam and malware.)

In theory the giants that already hold the vast majority of all email communications - like Microsoft and Alphabet - are in a prime position to introduce a successor, hopefully this time with a receipt so the last argument in favour of fax dies off. At the same time, they have no proper motivation to do so.

That’s the point about interoperability. If we’re going to make “email v2” (not a terrible idea!), then the considerations that will go into securing it will ensure that it’s entirely incompatible with the thing we currently call email.

In other words: without sufficient clarity, email v2 just confuses people like my parents. Who would be better served by Signal anyways.

Vendors big enough to be known by your parents are sophisticated enough to paper over the differences and make it seamless. (Where possible)

“Where possible” is doing a lot of work!