3 ms·

Some may only want encryption between their key custodian and the recipient or their custodian. Email without encryption cannot guarantee it won't be snooped on

Some may only want encryption between their key custodian and the recipient or their custodian. Email without encryption cannot guarantee it won't be snooped on by any of the other parties involved in transporting it. In practice big providers may be able to ensure that, but email is federated so it's impractical to do that with every provider unless there's a standard.

marcus_holmes 3y ago
The point that Fastmail made in the article, though, is that if Fastmail is handling the encryption, then they know your key. So Fastmail cannot protect you against Fastmail's servers being compromised[0]. And the article linked from their article (hilarious itself) pointed out that this basically comes down to State Actors (Mossad as the example) or Everyone Else. If it's Mossad then there's nothing anyone else can do to protect you (because they can do secret-squirrel things through special security courts and stuff like installing black boxes on undersea cable routers). If Everyone Else, then the normal run-of-the-mill transport encryption is probably good enough, just don't click on any herbal boner-pill adverts. tldr; If you want to be protected, you have to do PGP at the local machine level yourself. [0] Given that Fastmail are Aussies, and that our idiotic government have given the spooks full, secret, access to anything they want, then this is a very real prospect for anyone that five-eyes might be interested in.
- ComodoHacker 3y ago
  >this basically comes down to State Actors ... or Everyone Else This is oversimplification if not misleading. There are also Bad Guys (who aren't state actors), who usually can't reach for your data. But occasionally they can, when rare Planet Parades like Heartbleed or Meltdown make the news. And they are happy to use this one-in-a-lifetime chance to sell access to your data to everyone else.
  - marcus_holmes 3y ago
    I guess I don't understand how something like Heartbleed can hit you if you don't click on boner-pill ads, Fastmail's servers don't get hit, and you're not installing random apps from random internet folks?
denton-scratch 3y ago
> won't be snooped on by any of the other parties involved in transporting it. There was a time, long, long ago, when mail from your email provider to your recipient's provider would often go through other providers in transit. Nowadays (and for the last 20 years) all of the intermediary mail-servers in the Received: headers belong to either the sender's provider or the recipient's provider. They're usually spam-filters, application gateways, secondary servers. I guess the major exception is people who use gmail or Mailchimp as an outbound relay. But that's deliberate, and entirely under the sender's control.
- joveian 3y ago
  However, the wide use of MTA-STS is quite recent so downgrade attacks have been possible. In fact, Fastmail seems to currently be messing up MTA-STS, I'm not sure if they are intending to enable it or not. https://www.mailhardener.com/kb/mta-sts https://www.mailhardener.com/kb/mta-sts

marcus_holmes 3y ago

The point that Fastmail made in the article, though, is that if Fastmail is handling the encryption, then they know your key. So Fastmail cannot protect you against Fastmail's servers being compromised[0]. And the article linked from their article (hilarious itself) pointed out that this basically comes down to State Actors (Mossad as the example) or Everyone Else. If it's Mossad then there's nothing anyone else can do to protect you (because they can do secret-squirrel things through special security courts and stuff like installing black boxes on undersea cable routers). If Everyone Else, then the normal run-of-the-mill transport encryption is probably good enough, just don't click on any herbal boner-pill adverts. tldr; If you want to be protected, you have to do PGP at the local machine level yourself. [0] Given that Fastmail are Aussies, and that our idiotic government have given the spooks full, secret, access to anything they want, then this is a very real prospect for anyone that five-eyes might be interested in.

ComodoHacker 3y ago
>this basically comes down to State Actors ... or Everyone Else This is oversimplification if not misleading. There are also Bad Guys (who aren't state actors), who usually can't reach for your data. But occasionally they can, when rare Planet Parades like Heartbleed or Meltdown make the news. And they are happy to use this one-in-a-lifetime chance to sell access to your data to everyone else.
- marcus_holmes 3y ago
  I guess I don't understand how something like Heartbleed can hit you if you don't click on boner-pill ads, Fastmail's servers don't get hit, and you're not installing random apps from random internet folks?

denton-scratch 3y ago

> won't be snooped on by any of the other parties involved in transporting it. There was a time, long, long ago, when mail from your email provider to your recipient's provider would often go through other providers in transit. Nowadays (and for the last 20 years) all of the intermediary mail-servers in the Received: headers belong to either the sender's provider or the recipient's provider. They're usually spam-filters, application gateways, secondary servers. I guess the major exception is people who use gmail or Mailchimp as an outbound relay. But that's deliberate, and entirely under the sender's control.

joveian 3y ago
However, the wide use of MTA-STS is quite recent so downgrade attacks have been possible. In fact, Fastmail seems to currently be messing up MTA-STS, I'm not sure if they are intending to enable it or not. https://www.mailhardener.com/kb/mta-sts https://www.mailhardener.com/kb/mta-sts