3 ms·
> They do not store keys They say they do not store keys. > They can only handover encrypted data. Nonsense. They could using additional installed software[1
by geocar 10y ago
> They do not store keys
They say they do not store keys.
> They can only handover encrypted data.
Nonsense. They could using additional installed software[1] or even their upstream ISPs could netflow/tcpdump the SMTP traffic. If the data is unencrypted coming in the door, you should assume it is always unencrypted.
I would not advise anyone to use these kinds of solutions -- they cannot offer any actual security guarantees and it is akin to walking around with a bullseye on your chest.
[1]: http://www.reuters.com/article/us-yahoo-nsa-exclusive-idUSKCN1241YT http://www.reuters.com/article/us-yahoo-nsa-exclusive-idUSKC...
- justinclift 10y ago> They could using additional installed software[1] or even their upstream ISPs could netflow/tcpdump the SMTP traffic. From memory, netflow is only the connection info (eg source/dest/byte count), and doesn't include any of the transferred data itself. Unless you were meaning straight tcpdump which could grab payload data. Email is commonly sent over TLS too, which I think (though it's been a while) can be configured as mandatory on servers. eg not accepting unencrypted email That doesn't mean this is what's happening here, I'm just pointing out it can be done. :)
- geocar 10y ago> Email is commonly sent over TLS too, which I think (though it's been a while) can be configured as mandatory on servers. eg not accepting unencrypted email However the thing that decrypts the TLS jacket isn't the user's key. Might as well not be there for some threat models.