4 ms·

I'll echo the advice I heard from Phillip Zimmermann back in the early 1990s: If everyone consistently used encryption for all their email (that's 'everyone',

by eplanit 17y ago

I'll echo the advice I heard from Phillip Zimmermann back in the early 1990s: If everyone consistently used encryption for all their email (that's 'everyone', and 'all'), then the effectiveness of government access to email would be lowered to a near-moot level. The sheer complexity and resource requirements to decrypt _all_ email traffic would exceed the government's capabilities. I know the NSA has incredible capabilities....but not that incredible. Yes, I know this creates a new moving target. However, that beats being a sitting duck, though.

loup-vaillant 17y ago
Another solution would be everyone using their own mail server (which itself uses TLS). Mail still isn't encrypted, but all the tunnels they travel through would be. But I guess this is just as hard as encrypting one's email, given the number of people which don't even mind having their mail systematically analysed by a big, profitable company.
- danudey 17y ago
  Even that wouldn't help if your server is hosted in the US. If they really want access to your e-mail, they can just have your hosting provider give them access (or get the data for them), and under the Patriot act, they can't even tell you about it. Another other solution would be to use e-mail providers (or hosting solutions) outside of the country. Vancouver, Montreal, and Toronto, for example, have excellent connection to the US fibre networks (my company has its own pipe from Level 3 from Seattle to Vancouver). Host a server there, and no amount of government intervention is going to get your data, and hosting companies here (well, the good ones) won't give your data up without a subpoena or a warrant (and are able to tell you).
  - loup-vaillant 17y ago
    By "own mail server", I meant a server which is behind your own walls: at home. Of course having a server behind the walls of a remote company isn't much better that using Gmail.
CWuestefeld 17y ago
Only partly. It still leaves header information open, so the government is still able to see who you talk to. Through traffic analysis they can see what groups you're likely to sympathize with, even if they can't see the membership roles. And they're able to tell when those groups are planning something, even if they don't know what.
- dantheman 17y ago
  Exactly, this is what the NSA wiretapping case was about. They weren't listening in on all the calls, they were gathering information on who was calling who and for how long. This is the most traditional wiretap because it requires a lot less effort and provides a lot of information.
- jacquesm 17y ago
  In fact, 'traffic analysis' is exactly what you would use to focus the actual decryption power available to you towards the more likely sources of paydirt. And storing all email until you might want to decrypt it would be another possibility, though that might be prohibitively expensive. This is actually one of the few cases where spam has a net positive effect, increasing the size of the haystack considerably.
alexgartrell 17y ago
I think the obvious problem is that encrypted email is hard. key signing parties and stuff do not appeal to someone who wants to jot off a quick note. What we really need is encrypted webmail (to the point that the plain text never lands on the google server) and that's hard.

by eplanit 17y ago

loup-vaillant 17y ago

Another solution would be everyone using their own mail server (which itself uses TLS). Mail still isn't encrypted, but all the tunnels they travel through would be. But I guess this is just as hard as encrypting one's email, given the number of people which don't even mind having their mail systematically analysed by a big, profitable company.

danudey 17y ago
Even that wouldn't help if your server is hosted in the US. If they really want access to your e-mail, they can just have your hosting provider give them access (or get the data for them), and under the Patriot act, they can't even tell you about it. Another other solution would be to use e-mail providers (or hosting solutions) outside of the country. Vancouver, Montreal, and Toronto, for example, have excellent connection to the US fibre networks (my company has its own pipe from Level 3 from Seattle to Vancouver). Host a server there, and no amount of government intervention is going to get your data, and hosting companies here (well, the good ones) won't give your data up without a subpoena or a warrant (and are able to tell you).
- loup-vaillant 17y ago
  By "own mail server", I meant a server which is behind your own walls: at home. Of course having a server behind the walls of a remote company isn't much better that using Gmail.

CWuestefeld 17y ago

Only partly. It still leaves header information open, so the government is still able to see who you talk to. Through traffic analysis they can see what groups you're likely to sympathize with, even if they can't see the membership roles. And they're able to tell when those groups are planning something, even if they don't know what.

dantheman 17y ago
Exactly, this is what the NSA wiretapping case was about. They weren't listening in on all the calls, they were gathering information on who was calling who and for how long. This is the most traditional wiretap because it requires a lot less effort and provides a lot of information.
jacquesm 17y ago
In fact, 'traffic analysis' is exactly what you would use to focus the actual decryption power available to you towards the more likely sources of paydirt. And storing all email until you might want to decrypt it would be another possibility, though that might be prohibitively expensive. This is actually one of the few cases where spam has a net positive effect, increasing the size of the haystack considerably.

alexgartrell 17y ago

I think the obvious problem is that encrypted email is hard. key signing parties and stuff do not appeal to someone who wants to jot off a quick note. What we really need is encrypted webmail (to the point that the plain text never lands on the google server) and that's hard.