3 ms·

> The use of unencrypted or encrypted link to the receiving email provider's MX server doesn't change all that much in terms of who can read the email: it's sti

> The use of unencrypted or encrypted link to the receiving email provider's MX server doesn't change all that much in terms of who can read the email: it's still sitting in plaintext on the recipient's server (as well as the sender's server), and the group of actors who can sniff traffic on the backbone like that is probably just as easily able to get it from the servers. That's not at all obvious to me. And this sort of backbone sniffing is exactly what we've seen state actors do. What possible downside could rewarding link integrity have on the story for user privacy? A false sense of security? Quite the opposite: that's what we already got in spades.

magila 11y ago
A state actor who can sniff traffic can just as easily serve a secret order to the email server operator to compel them to hand over the data. In fact this is already SOP for governments when dealing with communications which are encrypted in-flight but not end-to-end.
- jamespo 11y ago
  depends where those servers are based and who owns them
- Kadin 11y ago
  Except that's demonstrably not what the NSA was doing; they were sniffing the backbones at the switches, presumably because they didn't want to create any sort of paper trail or get warrants, even secret FISA ones, against particular people. From Google's perspective, it means they have to be involved, however non-consensually, in the process, rather than having it done to them transparently. So I can see why it's a win for them. Whether it really matters to Joe Random User is arguable. What Joe User really ought to demand is end-to-end encryption rather than transit encryption, but he's unlikely to do that because key management across multiple devices (and who wants to read their email only on a single device?) is a pain and the companies that would be able to make it less of a pain aren't exactly incentivized to do so.

magila 11y ago

A state actor who can sniff traffic can just as easily serve a secret order to the email server operator to compel them to hand over the data. In fact this is already SOP for governments when dealing with communications which are encrypted in-flight but not end-to-end.

jamespo 11y ago
depends where those servers are based and who owns them
Kadin 11y ago
Except that's demonstrably not what the NSA was doing; they were sniffing the backbones at the switches, presumably because they didn't want to create any sort of paper trail or get warrants, even secret FISA ones, against particular people. From Google's perspective, it means they have to be involved, however non-consensually, in the process, rather than having it done to them transparently. So I can see why it's a win for them. Whether it really matters to Joe Random User is arguable. What Joe User really ought to demand is end-to-end encryption rather than transit encryption, but he's unlikely to do that because key management across multiple devices (and who wants to read their email only on a single device?) is a pain and the companies that would be able to make it less of a pain aren't exactly incentivized to do so.