6 ms·

Fastmail seems to be based in Australia unfortunately, so it is not secure

by plsbenice34 5y ago

Gigachad 5y ago
Email is not secure full stop. Don't do any kind of sensitive conversation over it regardless of where it is hosted.
- heinternets 5y ago
  Email using most large providers is transmitted using TLS
  - Gigachad 5y ago
    TLS is unaffected by any government laws. What I assume OP is referencing is a law that makes end to end encryption problematic in Australia but Fastmail has never offered end to end encryption. Neither do most email providers so it doesn't matter.
    - astrange 5y ago
      If you get a PGP browser extension they all do. It’s pretty inconvenient to use though, sending encrypted attachments and giving the password offline is probably the only thing most people are up to.
      - Gigachad 5y ago
        The location of the fastmail office has zero impacts on this. If the complaint was that the PGP extension was developed in Australia then that would be a valid complaint. But email hosts themselves are not private against government requests.
        astrange 5y ago
        I’m not the one complaining and I’m not sure what their complaint means either.
withinboredom 5y ago
There is nothing secure about email. It's less secure than Telnet. You can email anyone on the internet as anyone and it will be delivered with NO validation. Clients may/may not validate any DKIM signature and the may/may not validate that it actually came from the domain. It's literally the easiest thing on earth to spoof. Email is sent over cleartext, it is not encrypted. Anyone can read email if they can inspect packets.
- gruez 5y ago
  >Email is sent over cleartext, it is not encrypted. Anyone can read email if they can inspect packets. That's obviously false if you bothered to do a bit of searching: https://en.wikipedia.org/wiki/Simple_Mail_Transfer_Protocol#Security_extensions https://en.wikipedia.org/wiki/Simple_Mail_Transfer_Protocol#... >You can email anyone on the internet as anyone and it will be delivered with NO validation. Clients may/may not validate any DKIM signature and the may/may not validate that it actually came from the domain. It's literally the easiest thing on earth to spoof. That might be true for some systems, but for most services out there, having missing/invalid anti-spoofing measures will result in your mail ending up in spam or not delivered at all.
  - josephg 5y ago
    > but for most services out there, having missing/invalid anti-spoofing measures will result in your mail ending up in spam or not delivered at all. You would think so.. but its remarkable how easy it still is to forge email. My mum was recently the target of such a campaign. She's in the executive team at an international NGO. An attacker found her email address and a bunch of her contacts via the NGO's webpage. Then they forged emails from her email address, with a gmail address set up in the reply-to field. The emails all said it was an emergency, and asked for her colleages to transfer money. As far as we can tell, most of the emails were delivered and lots of people were fooled - at least for awhile. Her email address has DKIM and SPF set up, but (like most email providers) it has a lax DMARC policy. It turns out thats all it takes to be vulnerable to this sort of attack.
    - 5y ago

Fastmail seems to be based in Australia unfortunately, so it is not secure

Gigachad 5y ago

Email is not secure full stop. Don't do any kind of sensitive conversation over it regardless of where it is hosted.

heinternets 5y ago
Email using most large providers is transmitted using TLS
- Gigachad 5y ago
  TLS is unaffected by any government laws. What I assume OP is referencing is a law that makes end to end encryption problematic in Australia but Fastmail has never offered end to end encryption. Neither do most email providers so it doesn't matter.
  - astrange 5y ago
    If you get a PGP browser extension they all do. It’s pretty inconvenient to use though, sending encrypted attachments and giving the password offline is probably the only thing most people are up to.
    - Gigachad 5y ago
      The location of the fastmail office has zero impacts on this. If the complaint was that the PGP extension was developed in Australia then that would be a valid complaint. But email hosts themselves are not private against government requests.
      - astrange 5y ago
        I’m not the one complaining and I’m not sure what their complaint means either.

withinboredom 5y ago

There is nothing secure about email. It's less secure than Telnet. You can email anyone on the internet as anyone and it will be delivered with NO validation. Clients may/may not validate any DKIM signature and the may/may not validate that it actually came from the domain. It's literally the easiest thing on earth to spoof. Email is sent over cleartext, it is not encrypted. Anyone can read email if they can inspect packets.

gruez 5y ago
>Email is sent over cleartext, it is not encrypted. Anyone can read email if they can inspect packets. That's obviously false if you bothered to do a bit of searching: https://en.wikipedia.org/wiki/Simple_Mail_Transfer_Protocol#Security_extensions https://en.wikipedia.org/wiki/Simple_Mail_Transfer_Protocol#... >You can email anyone on the internet as anyone and it will be delivered with NO validation. Clients may/may not validate any DKIM signature and the may/may not validate that it actually came from the domain. It's literally the easiest thing on earth to spoof. That might be true for some systems, but for most services out there, having missing/invalid anti-spoofing measures will result in your mail ending up in spam or not delivered at all.
- josephg 5y ago
  > but for most services out there, having missing/invalid anti-spoofing measures will result in your mail ending up in spam or not delivered at all. You would think so.. but its remarkable how easy it still is to forge email. My mum was recently the target of such a campaign. She's in the executive team at an international NGO. An attacker found her email address and a bunch of her contacts via the NGO's webpage. Then they forged emails from her email address, with a gmail address set up in the reply-to field. The emails all said it was an emergency, and asked for her colleages to transfer money. As far as we can tell, most of the emails were delivered and lots of people were fooled - at least for awhile. Her email address has DKIM and SPF set up, but (like most email providers) it has a lax DMARC policy. It turns out thats all it takes to be vulnerable to this sort of attack.
  - 5y ago