3 ms·
Chances are you’re already compromised eitherways , most mailservers interact with you over STARTTLS, which means any middleman/isp can strip your tls encryptio
by teitoklien 5y ago
Chances are you’re already compromised eitherways , most mailservers interact with you over STARTTLS, which means any middleman/isp can strip your tls encryption on your emails, midway while you’re reading them over imap. (ISPs worldwide have been caught doing this before)
Most providers do not mandate a strong SSL only imap system.
Along with other similar caveats, do not depend on your mail system to keep your emails private.
If you want privacy, encrypt your emails yourself.
Also most people who selfhost their email usually do not encrypt data at rest. As its not the default norm. As such anyone having access to your disk can compromise you at anytime too (especially likely if you’re using a vps).
So, unless youre encrypting your emails yourself E2E. Assume you have no privacy.
If you’re doing E2E, aws cannot decrypt your mails anyways.
- AshamedCaptain 5y agoThere is a large difference between "them" having to m2m smtp sessions to intercept emails versus directly sending the emails through them. Besides, metadata is probably already more significant than the message contents and encrypyion solves nilch there.
- teitoklien 5y agothey m2m the imap sessions using the method i described not smtp.