> So, for example, it recently turned out to be possible for eavesdroppers to decrypt messages without a key, simply by tampering with encrypted messages. Most technologists who work with PGP don’t understand it at a low enough level to see what’s wrong with it.
without citation. Such a writing choice makes me pause.
[0] https://www.usenix.org/system/files/conference/usenixsecurit...
I understood their claim to be about a bug in PGP. I did not interpret it as a reference to Efail, which was (IIRC) a misuse of PGP by certain email viewer. From the Efail paper:
> However, both
> S/MIME and PGP predate these developments and use
> no authentication at all (S/MIME) or do not strictly com-
> mit to the requirements of an AE, which makes them eas-
> ier to misuse (PGP).
However, email encryption today is about not trusting your ESP (Email Service Provider) to not scan your email. It's about encrypting from your ESP to your client in a way that the ESP cannot see what is in the email.
Is ESP protection a mainstream concern? Yes. Is lack of encryption the biggest privacy issue with email? No. Does encrypting emails address a real concern? Yes for some.