11 ms·

> If you understand how SMTP works, it's hard to argue that it's a private means of communication. You send a clear-text message to a publically-accessible serv

• mimiflynn 14y ago
  Google's email isn't encrypted, it is sent as text over a network. Authentication doesn't change the fact that your email can be intercepted through the network in which it has been sent or received.
  • mikegioia 14y ago
    It's encrypted if you're sending it to another GMail user or anyone using Google Apps email for their domain.
    • mimiflynn 14y ago
      Slick! Makes me feel a bit better then.
  • habith 14y ago
    > Google's email isn't encrypted, it is sent as text over a network I just grepped my personal email server log to double check, here's an obfuscated entry from this morning: > localhost postfix/smtpd[14440]: TLS connection established from mail-xxxxxxxx.google.com[xxx.xx.xxx.xxx]: TLS v1 with cipher RC4-SHA (128/128 bits) Doesn't look like clear text to me.
    • SudoNick 14y ago
      Based on my server logs, Google will offer STARTTLS and also use STARTTLS when offered. So there can be MTA<->MTA encryption. Unfortunately, many MTAs don't do one or both, and that includes those run by some of the largest ISPs. Edit: A test tool... https://www.checktls.com/ https://www.checktls.com/
    • deleted 14y ago
      [deleted]
    • nwh 14y ago
      Can you do an attack like ssl-strip, but on IMAP servers? Presumably you can.
      • AnthonyMouse 14y ago
        Presumably you can pick a lock or attach a lineman's handset to the POTS phone lines outside of someone's house too, but aren't we talking about the expectation of privacy?
        • mpyne 14y ago
          You should never expect privacy over an unencrypted connection. However where I do disagree with rayiner is that you should be able to expect that third parties which you willingly entrust your communication to, should not be compelled to turn over that message without a warrant. If they turn it over willingly that's caveat emptor, but email to me feels more like a hand-to-hand transfer of a postcard than dropping a postcard on a public desk (as used in a different example), and therefore you should be able expect that it's not treated as essentially public domain.
          • AnthonyMouse 14y ago
            >You should never expect privacy over an unencrypted connection. What does "should" have to do with it? A landline telephone isn't encrypted, people still expect their conversations to be private. And I don't see why email should be different -- if it came out that human Google employees have been reading your emails it would be a huge scandal. > If they turn it over willingly that's caveat emptor I don't know about that. Do you think it would also be reasonable without a court order for them to provide your private emails to a party other than the government, like a reporter or your company's customers or suppliers?
• icebraining 14y ago
  You're talking about the server <> client connections, right? Between servers, SMTP is still often unencrypted and even when they use SSL, I doubt they authenticate each other. Of course, if you send an email to an account with the same provider, it's probably secure.
• betterunix 14y ago
  Except that the mail server gets to see the body of the email, which is not even remotely private. Encryption gives you privacy; instead of politely asking people to not read your mail, why not politely ask people to encrypt messages?
  • taeric 14y ago
    While I would not argue against encryption giving you privacy, I think it is easy to argue that there is an expectation of privacy in sending emails. At least, as much of one as if you were sending actual correspondence. Consider, in a public restroom there is very little done to prevent people from seeing each other. However, one almost certainly has a reasonable expectation of privacy in such a situation. Hell, consider using the restroom in someone else's house. If you record videos of everyone that uses your restroom...
    • betterunix 14y ago
      We put doors on restrooms. Claiming that unencrypted email should carry a legitimate expectation of privacy is like claiming that people should expect privacy when they go to the bathroom on the side of the highway. People may want their email to be private, but that does not mean that we should pretend that email really is private. Really, we need encryption to be widely used, for people to learn about it in school, and for people to generally expect messages to be encrypted. We have not really won this fight until people encrypt private messages and get angry when private things are sent in the clear.
      • morsch 14y ago
        How do urinals fit into that metaphor?
      • varjag 14y ago
        You can't normally read SMTP exchange between two arbitrary servers. Granted, there's a range of attacks possible to a motivated hacker, but they are exactly that: attacks. Your email is normally not exposed to third parties.
• sliverstorm 14y ago
  Authentication is to prevent someone from pretending to be you. This is not the same as trying to keep your messages private.
  • kamjam 14y ago
    The lock on my door is to prevent someone from pretending to be me to enter my property. This is not the same as trying to keep my stuff private or safe. Note how your statement does not hold in the real world.
    • rayiner 14y ago
      Except Google's servers and whatnot are not your property. The lock keeps other Google customers from accessing "your stuff" not Google itself.
      • hpguy 14y ago
        The data I put in Google is MY property, I want that data protected and don't care less about servers just as I do not claim ownership to the school locker.
        • shmerl 14y ago
          The only way to ensure your data protection never changed - encryption. Google or not Google notwithstanding.
        • rayiner 14y ago
          If you want it protected, don't leave it in clear text in the custody of someone else who may or may not choose to hand it over to the authorities without your permission. In other news: you can't invoke the 4th amendment if you stash boxes of weed at a friend's house and he hands them over to the government when asked.
          • unclebucknasty 14y ago
• SudoNick 14y ago
  Have you asked your attorney why he adds that warning, and asked whether attorney-client privilege is waived if email messages and documents are exchanged over an SMTP system which allows the messages to be read by providers and intermediaries? I asked once. The answer was: no, it is not waived and no warning need be attached. Applicable law revolves around intent and that is largely determined by who you choose for recipients. There is some allowance for typos and mistakes when addressing or sending. The warning is just to remind people of appropriate conduct, encourage them to report incorrectly addressed messages, and make the intent extra clear.
  • rayiner 14y ago
    The law of client/attorney privilege and the Constitutional prohibitions against unreasonable search have distinct bases and are governed by different law. Attorney/client communication focuses on the whole communication, while 4th amendment focuses on the specific piece of evidence. So if you for example gave your client some advice relayed through your secretaries, you could invoke the privilege if they were questioned. However, if you gave your secretary a note to pass to your client, and she kept a copy, you cannot invoke the 4th amendment.
    • 3825 14y ago
      What if I FedEx a letter and a FedEx employee opens it and keeps a copy of it? (Replace FedEx with USPS if it makes a difference)
      • rayiner 14y ago
        There is no reasonable expectation of privacy when it comes to private carriers like FedEx or UPS. The expectation of privacy only extends to First Class USPS mail, under the consideration that extra protections are needed given that the USPS is an organ of the federal government and that USPS workers are bound by the 4th amendment just as any other agent of the government (and unlike private mail carriers!)
        • 14y ago