3 ms·

Everytime I hear this type of story -- are these people sending/receiving E-mail in plain text transport? (That sounds like a very poor judgment to begin with,

Everytime I hear this type of story -- are these people sending/receiving E-mail in plain text transport? (That sounds like a very poor judgment to begin with, especially for a journalist, if that's the case.)

brandon272 11y ago
I would assume so. The most perplexing part of the story is that he didn't inquire with the hacker as to what methods were used.
- elwesties 11y ago
  He was on a public network so any email he sent as going out in plain text over the air. Nothing secret or advanced about that.
  - yolesaber 11y ago
    What about HTTPS? http://security.stackexchange.com/questions/1525/is-visiting-https-websites-on-a-public-hotspot-secure http://security.stackexchange.com/questions/1525/is-visiting...
    - redbeard0x0a 11y ago
      If you are using a standard email client, it doesn't use HTTPS . If the email server you are connecting to supports encryption, it will be a different port and a different protocol. The protocols used for email are SMTP for sending email (port 25, nothing is encrypted by default) and IMAP or POP for retrieving email (port 143 and 110 respectively, both are not encrypted). The protocols have been updated to support encryption and are typically on a different port (however SMTP supports something called STARTTLS that can upgrade a connection to use encryption). Secure IMAP is on port 993 and Secure POP is on port 995. Protecting your email from prying eyes is a little more involved if you are using an email client. However it is better to check your email using webmail over an HTTPS connection if you are on a shared public network.
      - yolesaber 11y ago
        Ah that makes sense. Thank you for the detailed reply.
      - unsignedint 11y ago
        Aren't these features fairly commonplace these days? (I use two mail servers, one of them is Gmail) and they both support TLS, actually, they even refuse me to connect in plain text.
redbeard0x0a 11y ago
I think the fact that plain-text was used actually helps this story. The guy was writing about how the Apple-FBI case would affect normal, everyday people. The people who don't even know there can be anything insecure about email. For all we know, GoGo had blocked certain ports that forced the email client to downgrade an SMTP connection for compatibility reasons. Hackers are going to use any foothold they can find to get at your data, including any mandated backdoor or compatibility required by the government.

brandon272 11y ago

I would assume so. The most perplexing part of the story is that he didn't inquire with the hacker as to what methods were used.

elwesties 11y ago
He was on a public network so any email he sent as going out in plain text over the air. Nothing secret or advanced about that.
- yolesaber 11y ago
  What about HTTPS? http://security.stackexchange.com/questions/1525/is-visiting-https-websites-on-a-public-hotspot-secure http://security.stackexchange.com/questions/1525/is-visiting...
  - redbeard0x0a 11y ago
    If you are using a standard email client, it doesn't use HTTPS . If the email server you are connecting to supports encryption, it will be a different port and a different protocol. The protocols used for email are SMTP for sending email (port 25, nothing is encrypted by default) and IMAP or POP for retrieving email (port 143 and 110 respectively, both are not encrypted). The protocols have been updated to support encryption and are typically on a different port (however SMTP supports something called STARTTLS that can upgrade a connection to use encryption). Secure IMAP is on port 993 and Secure POP is on port 995. Protecting your email from prying eyes is a little more involved if you are using an email client. However it is better to check your email using webmail over an HTTPS connection if you are on a shared public network.
    - yolesaber 11y ago
      Ah that makes sense. Thank you for the detailed reply.
    - unsignedint 11y ago
      Aren't these features fairly commonplace these days? (I use two mail servers, one of them is Gmail) and they both support TLS, actually, they even refuse me to connect in plain text.

redbeard0x0a 11y ago

I think the fact that plain-text was used actually helps this story. The guy was writing about how the Apple-FBI case would affect normal, everyday people. The people who don't even know there can be anything insecure about email. For all we know, GoGo had blocked certain ports that forced the email client to downgrade an SMTP connection for compatibility reasons. Hackers are going to use any foothold they can find to get at your data, including any mandated backdoor or compatibility required by the government.