Security of Push Messaging
summary
Compares SMS email and instant messengers, claiming email remains stateless so it lacks forward secrecy while messengers using double ratchet (WhatsApp/Signal) provide forward and future secrecy via pre-keys and continuous key updates; cites a dataset showing 0.06% encrypted emails in one university archive. Flags Telegram as undocumented and iMessage as basic public‑key use. Proposes minimal interoperability standards (naming, initial authentication) and an API or gatekeeper-supplied crypto library, and demonstrates an Authenticated Encryption with Additional Data decryption‑context prototype implemented in Enigmail/OpenPGP (Outlook incompatible).
AI-written summary · about
chapters (20)
- 0:00Push messaging security
- 1:04Push messaging overview
- 2:32Email security challenges
- 5:43Email vs instant messaging
- 6:45Email vs messaging encryption
- 9:11Key establishment methods
- 11:00Email encryption limits
- 13:27Double ratchet security
- 18:51Double ratchet algorithm
- 23:06File transmission in apps
- 24:11Group messaging security
- 27:10Message Level Security (MLS)
- 28:12Email and messaging interoperability
- 28:33Digital Markets Act interop
- 31:46Secure interoperability challenges
- 33:12Messaging interoperability standards
- 36:06Future of secure messaging
- 36:50Fixing email security flaws
- 40:46Mitigating EFAIL attacks
- 41:33Summary
related talks
47mSecure messaging - how to protect yourself & your company
40mEnd-to-end encryption: Behind the scenes
32m(In)Secure Messaging Apps: A Lateral Movement Into Your Privacy
44mBeyond End to End Encryption
24mp≡p ≡ pretty Easy privacy: making privacy the default for everyone
01h 07mBuilding Rock-Solid Encrypted Applications
57mBuild your own Secure Messenger
01h 30mDigital Privacy – low and high hanging fruits, and how to pick them.