Poor Johnny still won't encrypt

Why email encryption lags behind HTTPS

• Commenters note most web traffic is HTTPS while email—often more sensitive—remains mostly unencrypted end-to-end.
• HTTPS became ubiquitous partly due to browser and search engine pressure; email has no comparable central push.
• Transport-level TLS between mail servers is now widespread, but end-to-end encryption is seen as breaking spam filtering, server-side rules, search, and especially webmail.
• Key discovery and cross-client support (S/MIME, PGP) remain fragmented and poorly standardized.

Usability, key management, and data longevity

• Personal key management across devices is widely viewed as the core unsolved problem: devices die, get stolen, or fall in lakes; users lose chat/email histories and keys.
• Some want a “super dumb, robust” multi-device key store; others suggest passkeys, hardware tokens (YubiKey-like rings/bracelets), or local password managers.
• There is tension between people who prioritize reliability and history vs. those who prioritize maximum security even at the cost of data loss.
• Losing access to S/MIME-encrypted email archives is cited as a real-world failure mode; some wish clients would store messages decrypted locally once received.

Threat models and tradeoffs

• One camp adopts a strong adversary model (states, pervasive surveillance) and accepts losing history as a feature.
• Another camp assumes weaker threats (random hackers, scams) and is willing to soften security to preserve archives and usability.
• It’s argued that if only “people with something to hide” use strong tools like Signal or PGP, they become easier surveillance targets; mainstream adoption matters.

Is encryption needed for email?

• Several see email as a “digital postcard,” mostly spam and notifications, fine without heavy crypto; for private messaging they prefer other tools.
• Others stress that people expect email to be private (password-protected accounts, sensitive content, receipts, logins), so default encryption would be safer than relying on users to choose.

Tools, providers, and ecosystems

• Mentioned tools: DeltaChat (moving away from classic email), mutt + GPG, Thunderbird, Mailvelope, Signal, WhatsApp, self-hosted bridges, password managers.
• Proton Mail draws criticism for limited interoperability and legal exposure, but others point out its public-key lookup endpoints do exist.
• An example from a small company and from government smart-card deployments shows S/MIME-by-default can work in controlled environments, albeit with search, webmail, and interop drawbacks.