5 ms·

I assume they are trying to keep the documents in question confidential. Email is not confidential. EDIT: Folks email is not secure. Even if someone doesn't ha

by ebbv 10y ago

I assume they are trying to keep the documents in question confidential. Email is not confidential. EDIT: Folks email is not secure. Even if someone doesn't have access to login to your mail account. Emails in transit are insecure. Using outside systems to send confidential data is common practice and has been for years.

michaelhoffman 10y ago
In practice, it's no more confidential to use a system where you have a separate, high-security system, that sends out new passwords via email on demand.
lucb1e 10y ago
I disagree. A sysadmin is not allowed to take a peek in emails unless there is a reason. Or if I create a folder named "private" on my work computer or work email, they aren't allowed to look in there without a good reason. But I suppose Dutch privacy laws aren't universal, so I don't know how that would be in your (or the author's) country. And if you want to take matters into your own hands, you use PGP. But outside of the computer security business I guess that's mostly unused.
- erichurkman 10y ago
  Not allowed, or not able to?
- SomeHacker44 10y ago
  If what is not allowed is not enforced by effective technological measures, or at least logged and reviewed by other trusted parties, then it may as well be allowed. At my company we trust our people and have a web of review. However, we try never to have anyone be the final trusted party - even the boss.
- gnopgnip 10y ago
  Email in transit is not secure.
- csydas 10y ago
  This is not strictly true with US businesses and academia. My last place of employment was a university, and per our legal, all data going through the University email or computers is University property; while there is a pledge from IT that all email is private and will not be accessed except for specific circumstances, these circumstances could be pretty much anything and had no relationship to any existing case law outside of what legal felt was necessary to use as reason for why we could access it. But the pledge was just a formality - should there be any interest to check the mail, there was nothing technically stopping anyone with the required access except for someone else with equal access having a problem with it. Likewise, various management offices had no issue with submitting email fetch requests for the simplest of things, with date ranges exceeding two or three years sometimes for what turned out to be incredibly minor reasons. There really is no expectation of privacy with academia in the US when it comes to University owned property or services. (The only reason I found out about any of this from legal was because I asked for clarification on our "duty to report", and one of the lawyers was almost excited as he told me about how we own everything legally.)
deleted 10y ago
[deleted]
halomru 10y ago
Almost all online login systems offer password reset by email. The moment another human has free access to my emails he effectively owns nearly all my accounts.
db48x 10y ago
You're technically correct (which is the best kind, of course), but for peer-review of scientific papers it's not really relevant. There's nothing _private_ about the paper, since the author intends to publish it, or about the reviews, since they're going to the author anyway. Only the identity of the reviewers is confidential, and for that email is perfectly sufficient. Well, a standard email client would be far too error-prone; you'd want something like a blind mailing list just so the editor doesn't click the wrong button and accidentally unmask the reviewer.
jcranmer 10y ago
If you're using large email providers, every step of the email transaction--SMTP to the outgoing server, SMTP between MX's, IMAP/POP to the mailbox server--is conducted using SSL (assuming the end user hasn't elected to avoid SSL when configuring email clients, which is actually hard these days). Yes, SMTP between MX's are routinely sent using SSL: Google reports that about 80-90% of such traffic is using SSL.
snakeanus 10y ago
OpenPGP is probably more secure than whatever system they are using.

by ebbv 10y ago

michaelhoffman 10y ago

In practice, it's no more confidential to use a system where you have a separate, high-security system, that sends out new passwords via email on demand.

lucb1e 10y ago

I disagree. A sysadmin is not allowed to take a peek in emails unless there is a reason. Or if I create a folder named "private" on my work computer or work email, they aren't allowed to look in there without a good reason. But I suppose Dutch privacy laws aren't universal, so I don't know how that would be in your (or the author's) country. And if you want to take matters into your own hands, you use PGP. But outside of the computer security business I guess that's mostly unused.

erichurkman 10y ago
Not allowed, or not able to?
SomeHacker44 10y ago
If what is not allowed is not enforced by effective technological measures, or at least logged and reviewed by other trusted parties, then it may as well be allowed. At my company we trust our people and have a web of review. However, we try never to have anyone be the final trusted party - even the boss.
gnopgnip 10y ago
Email in transit is not secure.
csydas 10y ago
This is not strictly true with US businesses and academia. My last place of employment was a university, and per our legal, all data going through the University email or computers is University property; while there is a pledge from IT that all email is private and will not be accessed except for specific circumstances, these circumstances could be pretty much anything and had no relationship to any existing case law outside of what legal felt was necessary to use as reason for why we could access it. But the pledge was just a formality - should there be any interest to check the mail, there was nothing technically stopping anyone with the required access except for someone else with equal access having a problem with it. Likewise, various management offices had no issue with submitting email fetch requests for the simplest of things, with date ranges exceeding two or three years sometimes for what turned out to be incredibly minor reasons. There really is no expectation of privacy with academia in the US when it comes to University owned property or services. (The only reason I found out about any of this from legal was because I asked for clarification on our "duty to report", and one of the lawyers was almost excited as he told me about how we own everything legally.)

deleted 10y ago

[deleted]

halomru 10y ago

Almost all online login systems offer password reset by email. The moment another human has free access to my emails he effectively owns nearly all my accounts.

db48x 10y ago

You're technically correct (which is the best kind, of course), but for peer-review of scientific papers it's not really relevant. There's nothing _private_ about the paper, since the author intends to publish it, or about the reviews, since they're going to the author anyway. Only the identity of the reviewers is confidential, and for that email is perfectly sufficient. Well, a standard email client would be far too error-prone; you'd want something like a blind mailing list just so the editor doesn't click the wrong button and accidentally unmask the reviewer.

jcranmer 10y ago

If you're using large email providers, every step of the email transaction--SMTP to the outgoing server, SMTP between MX's, IMAP/POP to the mailbox server--is conducted using SSL (assuming the end user hasn't elected to avoid SSL when configuring email clients, which is actually hard these days). Yes, SMTP between MX's are routinely sent using SSL: Google reports that about 80-90% of such traffic is using SSL.

snakeanus 10y ago

OpenPGP is probably more secure than whatever system they are using.