This post is not really about questions I have. I just feel like I need to write this somewhere to express my concern.
First of all, online stores have become a huge part of our society and I admit I heavily rely on that. That alone could be privacy issue but I’d ignore that for the sake of not missing the point of this post.
The problem is rather in the way these online stores send out their receipts. You might already know that emails are by default not client side encrypted. That means your email server admin (Google if you use Gmail, Apple if you use iCloud mail. And Proton if you use Protonmail. Yes Proton claims it stays encrypted as soon as the emails arrive to their server but who can really vouch this? It’s behind the curtain anyway. ) has access to your receipts including of the past.
Now email has been around for a really long time. And the client side encryption part has been worked in a lot of forms such as S/MIME. But none of the online services really implement it even though they contain critically personally identifiable info such as items I bought along with my name & address.
And the thing is even though these online sellers acknowledge this privacy risk, they don’t have options to not email us receipts. For example, Amazon has a dedicated page on their site where I can see the list of everything I bought. That’s literally enough for me. They can stop sending me the receipts in the worst possible way! At least they could provide us with better way (even WhatsApp will do) yet they don’t. This is a severe privacy issue.
I can’t help feeling, with all the sophisticated technology we have at hand, that we deserve better.
We do deserve end-to-end encrypted communication but then nobody except nerds could be bothered about managing private keys, so in the end providers would manage our keys and still be able to read our messages.
If the problem is that goggle/etc can read your email, not using them for your email is the solution.
Then, yes, there’s also an issue where ecommerce sites submerge us in useless email (is “your package has been shipped” an event so important that I must be immediately notified? Because I only care about when the package will be delivered) and could use a “notificaiton settings” page.
Of the sites I use, the worst offender is aliexpress, which sends (IIRC) “order confirmed”, “package shipped”, “packages reached customs”, “package cleared customs” and “package has been delivered” for every friggin’ item you ordered.
I’m a nerd and have no desire to maintain and swap keys. It needs to be seamless, like Signal.
I know right. “All important stuff -> emails” has to change.