Here’s some rare good news from the NSA front: the Lavabit and Silent Circle teams have joined forces to form the Dark Mail Alliance. There are quite a few stories on the Internet about the alliance and what they are trying to achieve. They haven’t released the technical details yet but as far as I can tell the aim is to make email encryption transparent and also hide as much of the metadata as possible.
The protocol and associated software will be released as open source software so that anyone can use it. The more ambitious goal is to get the heavy hitters to sign up. They’d like providers like Google and Yahoo to use the system. Their ultimate goal is to have 50% of email traffic flowing through Dark Mail in 3 years. That seems ambitious to me but I sure hope they succeed.
Every time you read about email security in the press—even in the technical press—you are always warned about how difficult it is to set up PGP/GPG. That’s mostly nonsense, I think, but it is true that Aunt Millie isn’t going to bother because it’s too mysterious and too much trouble. Who’s going to spy on poor old Aunt Millie, after all? So the real hurdle to getting secure email is to make the encryption completely transparent. If Aunt Millie has to do anything extra it simply isn’t going to happen.