[messaging] TOFU to ease PGP key discovery

[Tankred Hase]

Hi Bjarni,

> As a counterpoint, I wanted to briefly discuss Mailpile's take on this.
> We considered something very similar to what Whiteout are doing, and
> decided against it for a few reasons. The main ones being:
> 
> 1. Just because a user has a key in a key server, does not mean they
> currently can (or want to) read encrypted mail. In particular, many
> users depend on being able to read incoming mail on mobile devices.
> Sending them encrypted mail by default would just piss them off. Our gut
> feeling was that automatically encrypting mail would prove to be so
> annoying and inconvenient, that people would angrily switch mail clients
> after just one or two critically important messages were transparently
> rendered unreadable by the auto-encryptor. People respond very strongly
> to social cues, so if your mail client makes you look bad to your peers,
> you'll switch in a hurry. At best people will turn the auto-encryption
> off, thus rendering the whole exercise futile.

We currently see Whiteout Mail as a companion app to your normal Mail App similar to the Mailbox App from Dropbox. It serves a very specific use case of being a lean encryption mail app that sits next to mail.app or gmail on your phone or tablet. That's why if the user starts whiteout, we basically infer that they want to encrypt.

> 2. As has been mentioned, we feel protecting the user's social graph is
> just as important as protecting the contents of their messages.
> Constantly querying key servers (centralized or otherwise) leaks a lot
> of information, as does the traditional PGP model of signing keys and
> publishing the result for the world to see.

That's a completely valid decision. As I described don't log any queries on our key server, but that's still asking users to trust us to not record their metadata. We made a conscious tradeoff here to emphasized ease of use encryption. I'll make sure we are more clear about this in our privacy policy.

> Those are the constraints we're working with, and they are admittedly to
> a large degree based on our gut feelings and anecdotal evidence, not
> hard data. I find it very interesting that Whiteout have taken a
> different approach - if it works well, that probably means we've been
> overthinking things here at Mailpile. Also, hats off to Whiteout for
> shipping things. We're still struggling to release something usable, in
> part because we made choices like this one. :-)

Thanks :) You guys are doing great work too! There is enough room in the encrypted email space for different concepts and I don't think there is a "one size fits all" solution.

I look forward to meeting you guys in April in Frankfurt. We should definitely discuss some more over a beer.

Tankred
-- 
Whiteout Networks GmbH c/o Werk1
Grafinger Str. 6
D-81671 München
Geschäftsführer: Oliver Gajek
RG München HRB 204479