Indeed. It's not theater - this really is more secure than before. It's just got painful usability. However that is not Facebook's fault: the security community has failed to produce any end-to-end encrypted email product that is easy to use.
The good news is:
a) This continues the momentum that the big Valley companies are creating around strong crypto
b) This will motivate people to build better replacements for PGP, because now they know that they might actually receive encrypted emails if they can get sweis and others at Facebook on board.
S/MIME would have been slightly better, IMO, but I understand why they didn't do it that way - Yahoo and Google are working on OpenPGP browser extensions, and "copy/paste your key" is easier than "upload your certificate".
We badly need a modern, fresh take on email end-to-end crypto.
The good news is:
a) This continues the momentum that the big Valley companies are creating around strong crypto
b) This will motivate people to build better replacements for PGP, because now they know that they might actually receive encrypted emails if they can get sweis and others at Facebook on board.
S/MIME would have been slightly better, IMO, but I understand why they didn't do it that way - Yahoo and Google are working on OpenPGP browser extensions, and "copy/paste your key" is easier than "upload your certificate".
We badly need a modern, fresh take on email end-to-end crypto.