5 ms·

I was similarly unsurprised to find out that Stanford monitors all emails, including ones not sent via Stanford servers. I noticed my emails sent via SMTP to an

I was similarly unsurprised to find out that Stanford monitors all emails, including ones not sent via Stanford servers. I noticed my emails sent via SMTP to an outside server (edit: while connected to campus network) were getting softfail header flags because they were being relayed by Stanford. I'm sure all network traffic is monitored as well -- the network usage policy explicitly allows them to.

richardwhiuk 11y ago
>> I noticed my emails sent via SMTP to an outside server were getting softfail header flags because they were being relayed by Stanford. This doesn't make any sense - either you were sending them via Stanford or you weren't. If you weren't, how can they be relayed via Stanford?
- r0muald 11y ago
  He could have been sending them to a third party SMTP server from inside the Stanford network.
- hackbinary 11y ago
  Because Stanford has a silent proxy picking up SMTP traffic, and running it through their security system. http://serverfault.com/questions/382329/routing-smtp-and-pop3-past-iptables-through-proxy http://serverfault.com/questions/382329/routing-smtp-and-pop...
- pcl 11y ago
  Presumably zbjornson was sending messages from a network within Stanford, using vanilla SMTP. In that sort of topology, Stanford's network could easily intercept, monitor and modify SMTP traffic.
- zbjornson 11y ago
  What the posters below said. If you use SMTP to send to an external server, and you are on Stanford's network, they intercept it. "Relay" might have been the wrong word.
kogir 11y ago
This is more likely an abuse mitigation than intentional surveillance. I helped out in the dorms and student machines were constantly infected with malware, some of which sent tons of spam. I'd be very surprised if correctly configured SMTP using TLS is intercepted.
- zbjornson 11y ago
  Abuse mitigation may have been the (original) intent. However, it prevents sender verification because stanford.edu is not a designated sender for the external domains, and thus has no SPF records. If I use SMTP to send via gmail with SSL/TLS over port 587, the headers show it hopping through 5 stanford.edu servers, and finally `spf=softfail (google.com: domain of transitioning xxx@gmail.com does not designate (a stanford IP) as permitted sender)`.
  - kogir 11y ago
    For this to work, either your mail client is not enforcing TLS be used, is not validating the certificates presented to it, or trusts Stanford's MITM certificate. Perhaps you should try port 465 with forced SSL. Stripping TLS is unforgivable. Shame on them.
- revelation 11y ago
  The problem with SMTP is the broken-by-design STARTTLS mechanism that allows a hostile network like here to trivially strip the encryption. Been some time since I used a desktop email client, so I'm unsure if clients have now been upgraded to reject sending mails to/through servers that don't do STARTTLS. But I'm guessing no.
  - jcranmer 11y ago
    Thunderbird changed years ago to not allow soft-fallback for STARTTLS (i.e., if you request to use STARTTLS, and it's not available, it aborts the connection). I'm pretty sure that the account config also doesn't let you set up connections without STARTTLS or SSL without clicking through scary red this-is-not-safe dialogs, although I don't know if that's only for incoming or if it's for outgoing as well.
protomyth 11y ago
I block port 25 out because of spam / bot problems with student computers, but I would be curious any reason to do a relay. That doesn't make a heck of sense.
matthewarkin 11y ago
Stanford students have to get software installed on their laptops to access the Stanford network. Supposedly this is to force us to have anti-virus installed and the latest security updates, but I doubt any student has actually looked into what the software does / could do.
- zbjornson 11y ago
  I've actually dug pretty deeply into it. Briefly, it's IBM BigFix (previously Tivoli Endpoint) and allows university IT to remotely run any script with administrator privileges on your machine. I hate it and remove it after registration. It's one thing to use that on company/university-owned computers. I think it's unacceptable to run it on personally owned machines like Stanford does. Students who live on campus have no alternative ISP.
  - matthewarkin 11y ago
    A simple hack, if you register your computer as non Windows/ OSX device you're not forced to run it.
    - zbjornson 11y ago
      That used to work but they've at least made it harder. They started using your browser UA string to detect OS, and somehow (forget details) they've made it more difficult to spoof that.
      - joeyo 11y ago
        Install it in a VM?
  - mbreese 11y ago
    Stanford gets attacked - a lot. The biggest threat to the network is personally owned machines that need legitimate access to the network. The only way for them to protect the rest of the network is to have some kind of monitoring on those personal machines. The only other alternative would be to run personal machines on a separate network entirely, which they may or may not do already. I'm not sure. And BigFix doesn't cover only students, but also all faculty and staff as well. Honestly, if you think that's bad, try getting a server online (in the datacenter!). The network admins take their firewall rules very seriously (as well they should). For me, the biggest pain is the two (yes, two) backup services that must be installed for my department.

richardwhiuk 11y ago

>> I noticed my emails sent via SMTP to an outside server were getting softfail header flags because they were being relayed by Stanford. This doesn't make any sense - either you were sending them via Stanford or you weren't. If you weren't, how can they be relayed via Stanford?

r0muald 11y ago
He could have been sending them to a third party SMTP server from inside the Stanford network.
hackbinary 11y ago
Because Stanford has a silent proxy picking up SMTP traffic, and running it through their security system. http://serverfault.com/questions/382329/routing-smtp-and-pop3-past-iptables-through-proxy http://serverfault.com/questions/382329/routing-smtp-and-pop...
pcl 11y ago
Presumably zbjornson was sending messages from a network within Stanford, using vanilla SMTP. In that sort of topology, Stanford's network could easily intercept, monitor and modify SMTP traffic.
zbjornson 11y ago
What the posters below said. If you use SMTP to send to an external server, and you are on Stanford's network, they intercept it. "Relay" might have been the wrong word.

kogir 11y ago

This is more likely an abuse mitigation than intentional surveillance. I helped out in the dorms and student machines were constantly infected with malware, some of which sent tons of spam. I'd be very surprised if correctly configured SMTP using TLS is intercepted.

zbjornson 11y ago
Abuse mitigation may have been the (original) intent. However, it prevents sender verification because stanford.edu is not a designated sender for the external domains, and thus has no SPF records. If I use SMTP to send via gmail with SSL/TLS over port 587, the headers show it hopping through 5 stanford.edu servers, and finally `spf=softfail (google.com: domain of transitioning xxx@gmail.com does not designate (a stanford IP) as permitted sender)`.
- kogir 11y ago
  For this to work, either your mail client is not enforcing TLS be used, is not validating the certificates presented to it, or trusts Stanford's MITM certificate. Perhaps you should try port 465 with forced SSL. Stripping TLS is unforgivable. Shame on them.
revelation 11y ago
The problem with SMTP is the broken-by-design STARTTLS mechanism that allows a hostile network like here to trivially strip the encryption. Been some time since I used a desktop email client, so I'm unsure if clients have now been upgraded to reject sending mails to/through servers that don't do STARTTLS. But I'm guessing no.
- jcranmer 11y ago
  Thunderbird changed years ago to not allow soft-fallback for STARTTLS (i.e., if you request to use STARTTLS, and it's not available, it aborts the connection). I'm pretty sure that the account config also doesn't let you set up connections without STARTTLS or SSL without clicking through scary red this-is-not-safe dialogs, although I don't know if that's only for incoming or if it's for outgoing as well.

protomyth 11y ago

I block port 25 out because of spam / bot problems with student computers, but I would be curious any reason to do a relay. That doesn't make a heck of sense.

matthewarkin 11y ago

Stanford students have to get software installed on their laptops to access the Stanford network. Supposedly this is to force us to have anti-virus installed and the latest security updates, but I doubt any student has actually looked into what the software does / could do.

zbjornson 11y ago
I've actually dug pretty deeply into it. Briefly, it's IBM BigFix (previously Tivoli Endpoint) and allows university IT to remotely run any script with administrator privileges on your machine. I hate it and remove it after registration. It's one thing to use that on company/university-owned computers. I think it's unacceptable to run it on personally owned machines like Stanford does. Students who live on campus have no alternative ISP.
- matthewarkin 11y ago
  A simple hack, if you register your computer as non Windows/ OSX device you're not forced to run it.
  - zbjornson 11y ago
    That used to work but they've at least made it harder. They started using your browser UA string to detect OS, and somehow (forget details) they've made it more difficult to spoof that.
    - joeyo 11y ago
      Install it in a VM?
- mbreese 11y ago
  Stanford gets attacked - a lot. The biggest threat to the network is personally owned machines that need legitimate access to the network. The only way for them to protect the rest of the network is to have some kind of monitoring on those personal machines. The only other alternative would be to run personal machines on a separate network entirely, which they may or may not do already. I'm not sure. And BigFix doesn't cover only students, but also all faculty and staff as well. Honestly, if you think that's bad, try getting a server online (in the datacenter!). The network admins take their firewall rules very seriously (as well they should). For me, the biggest pain is the two (yes, two) backup services that must be installed for my department.