4 ms·
It's not exactly PGP's security model, but: - if you use SMTP-via-TLS and (IMAP/POP/MAPI)-via-TLS, attackers really can't intercept your mail - unauthenticated
by JoachimSchipper 8y ago
It's not exactly PGP's security model, but:
- if you use SMTP-via-TLS and (IMAP/POP/MAPI)-via-TLS, attackers really can't intercept your mail
- unauthenticated encryption still protects your mail spool at rest.
Of course, attackers gaining access to your mailbox is still game over, due to password resets etc. via e-mail; but "attackers can't intercept your mail" is a more realistic assumption in 2018 than it was when PGP was designed.
- wodny 8y agoNot necessarily. Mail can be intercepted when transferred between MTAs which seem to be often vulnerable to STARTTLS stripping due to a fallback mechanism. See "Neither Snow Nor Rain Nor MITM... An Empirical Analysis of Email Delivery Security"[1]. [1]: https://conferences.sigcomm.org/imc/2015/papers/p27.pdf https://conferences.sigcomm.org/imc/2015/papers/p27.pdf