5 ms·

I do not use facebook, but... ...If they pass this law I am also quiting from gmail. We need a freedom box that we control and is distributed, not centralized

I do not use facebook, but... ...If they pass this law I am also quiting from gmail. We need a freedom box that we control and is distributed, not centralized so automation of surveillance is harder. I know that there are bad guys out there, but not only in terrorist organization, secret service use to have garbage people too (the people that love power too much).

ajross 14y ago
I don't think Google delivers over TLS (it doesn't to my server anyway), so in general your mail is subject to wiretapping anyway. And even if it did there's no way protocol I know (maybe DKIM has a section for destination verification?) for them to know that they're really delivering it to the right host. Basically unencrypted email is a lost cause already. If you care about this stuff you need to dump webmail right now and go with a client encryption solution (and convince all your friends to use it).
- sp332 14y ago
  Gmail is https by default.
  - ajross 14y ago
    That's between your browser and their server. I'm referring to the content of the SMTP connection over which the mail travels, which remains almost always unencrypted in the modern world. Which essentially means that the FBI doesn't need Google's assistance to wiretap your email per se, they just use and machine they probably have sitting on the backbone pipe anyway.
    - sp332 14y ago
      POP, IMAP, and SMTP access to Gmail servers all require TLS. https://support.google.com/mail/bin/answer.py?hl=en&answer=78799 https://support.google.com/mail/bin/answer.py?hl=en&answ... and https://support.google.com/mail/bin/answer.py?hl=en&answer=13287 https://support.google.com/mail/bin/answer.py?hl=en&answ... Edit: oh you mean from e.g. comcast.com server to mail.google.com server. Never mind.
      - khuey 14y ago
        And again, that's between the client and the server. The path between Gmail's mail server and the sender/recipient of the mail's server is not always encrypted.
  - deleted 14y ago
    [deleted]
- joe_bleau 14y ago
  I'm seeing TLS connections with google, both inbound and outbound: Anonymous: TLSv1 with cipher RC4-SHA (128/128 bits) 209.85.214.42 mail-bk0-f42.google.com 209.85.160.42 mail-pb0-f42.google.com 209.85.213.170 mail-yx0-f170.google.com 209.85.214.198 mail-ob0-f198.google.com
  - ajross 14y ago
    That's good to know. Maybe I have my postfix misconfigured, I'll check. Still, the MitM hole is present. Without destination host verification, the FBI could simply sit outbound on the network insert themselves into the transaction.
    - joe_bleau 14y ago
      Agreed. Something else is weird; I see both trusted and untrusted outgoing SMTP TLS connections in the logfiles, including untrusted connections to machines that I know have valid startssl certs. Maybe I have my postfix misconfigured as well!
jka 14y ago
Gmail is kinda a tricky one - bear in mind that even if you personally quit, then even if you communicate with gmail users, Google is still getting your communications data there and able to build a profile (albeit not a complete one).

ajross 14y ago

I don't think Google delivers over TLS (it doesn't to my server anyway), so in general your mail is subject to wiretapping anyway. And even if it did there's no way protocol I know (maybe DKIM has a section for destination verification?) for them to know that they're really delivering it to the right host. Basically unencrypted email is a lost cause already. If you care about this stuff you need to dump webmail right now and go with a client encryption solution (and convince all your friends to use it).

sp332 14y ago
Gmail is https by default.
- ajross 14y ago
  That's between your browser and their server. I'm referring to the content of the SMTP connection over which the mail travels, which remains almost always unencrypted in the modern world. Which essentially means that the FBI doesn't need Google's assistance to wiretap your email per se, they just use and machine they probably have sitting on the backbone pipe anyway.
  - sp332 14y ago
    POP, IMAP, and SMTP access to Gmail servers all require TLS. https://support.google.com/mail/bin/answer.py?hl=en&answer=78799 https://support.google.com/mail/bin/answer.py?hl=en&answ... and https://support.google.com/mail/bin/answer.py?hl=en&answer=13287 https://support.google.com/mail/bin/answer.py?hl=en&answ... Edit: oh you mean from e.g. comcast.com server to mail.google.com server. Never mind.
    - khuey 14y ago
      And again, that's between the client and the server. The path between Gmail's mail server and the sender/recipient of the mail's server is not always encrypted.
- deleted 14y ago
  [deleted]
joe_bleau 14y ago
I'm seeing TLS connections with google, both inbound and outbound: Anonymous: TLSv1 with cipher RC4-SHA (128/128 bits) 209.85.214.42 mail-bk0-f42.google.com 209.85.160.42 mail-pb0-f42.google.com 209.85.213.170 mail-yx0-f170.google.com 209.85.214.198 mail-ob0-f198.google.com
- ajross 14y ago
  That's good to know. Maybe I have my postfix misconfigured, I'll check. Still, the MitM hole is present. Without destination host verification, the FBI could simply sit outbound on the network insert themselves into the transaction.
  - joe_bleau 14y ago
    Agreed. Something else is weird; I see both trusted and untrusted outgoing SMTP TLS connections in the logfiles, including untrusted connections to machines that I know have valid startssl certs. Maybe I have my postfix misconfigured as well!

jka 14y ago

Gmail is kinda a tricky one - bear in mind that even if you personally quit, then even if you communicate with gmail users, Google is still getting your communications data there and able to build a profile (albeit not a complete one).