4 ms·
In fact (as the article admits), the encryption is fine and fully effective against a passive attacker, the problem is that it's not much use against an active
by snori74 11y ago
In fact (as the article admits), the encryption is fine and fully effective against a passive attacker, the problem is that it's not much use against an active man-in-the-middle. But, that's not something anyone but a NSA or ISP can easily do between mailservers.
- atmosx 11y agoThe problem is that most of my emails will end up on Gmail, Yahoo! or Hotmail. Since nearly no one uses PGP, the emails sit on a google, apple, yahoo, microsoft server in plain text for any ads or 'gov' company to see and analyze in bulk. Until we 'solve' THIS problem, there's no point in discussing what happens in between IMHO.
- Tepix 11y agoEven if you run your own mailserver, you're not in control unless it's a dedicated server. On a VPS you may be spied upon by your ISP without standing a chance of noticing it. Luckily there are now ISPs that let you rent a dedicated server for 6€ a month (or just host it at home on something like the Raspberry Pi 2 and use a minimal VPS just to tunnel the traffic to it from its non-dialup IP address so email actually works).
- bitJericho 11y agoI was able to solve this problem by setting up a relay on a remote and international vps, and then requiring an encrypted connection between that server to my home network. If the link was active, the mail would go through. If the link was inactive, it would queue up. That way I didn't need as reliable of a home network and could rely on the datacenter to maintain uptime. For a couple more dollars you could get a second VPS for even better uptime.
- cm2187 11y agoIt doesn't solve it but it does reduce it. If smtp is encrypted only the US can read your correspondance. If smtp is unencrypted any country and telco operator through which your data transit can read your correspondance.
- thrownaway2424 11y agoDo you think that mail just sits around on "the gmail server" in plain text?
- wolf550e 11y agoRogue Google employee can read your mail (a fireable offense, but possible). US Government can compel Google to share your mail.
- atmosx 11y agoIn plain text for any interested party, be it Google, China, the NSA, etc[1]. [1] http://www.theguardian.com/world/2013/jun/06/us-tech-giants-nsa-data http://www.theguardian.com/world/2013/jun/06/us-tech-giants-...
- xvilka 11y agoProjects like a MailPile [1] could help here. [1] https://www.mailpile.is/ https://www.mailpile.is/
- atmosx 11y agoYes, I have high hopes for mailpile! :-)
- billpg 11y agoIf you can see a DNS request going out and can send a fake response that arrives before the real one, you have enough resources to pull off a MITM.
- snori74 11y agoYes, but unless you're the ISP that's not going to be possible surely? Mailservers typically don't run over wireless.
- billpg 11y agoI was responding to the idea that being a man-in-the-middle is significantly more difficult than being a passive eavesdropper. If you're already a passive eavesdropper, all you need is the ability the send a DNS response and you're a man-in-the-middle.
- fulafel 11y agoThere are many other attackers besides NSA and your ISP who are on-path. Anyone on the same network as the sender or receiver will do. There are many servers who are on the same network with compromised boxes (think cohosting, your home network with IoBT devices, typical corporate intranet, etc).
- Tepix 11y agoIt's a real problem. If you visit countries like Egypt, you will experience STARTSSL-stripping every day.
- deleted 11y ago[deleted]