7 ms·

Except that the mail server gets to see the body of the email, which is not even remotely private. Encryption gives you privacy; instead of politely asking peo

Except that the mail server gets to see the body of the email, which is not even remotely private. Encryption gives you privacy; instead of politely asking people to not read your mail, why not politely ask people to encrypt messages?

taeric 14y ago
While I would not argue against encryption giving you privacy, I think it is easy to argue that there is an expectation of privacy in sending emails. At least, as much of one as if you were sending actual correspondence. Consider, in a public restroom there is very little done to prevent people from seeing each other. However, one almost certainly has a reasonable expectation of privacy in such a situation. Hell, consider using the restroom in someone else's house. If you record videos of everyone that uses your restroom...
- betterunix 14y ago
  We put doors on restrooms. Claiming that unencrypted email should carry a legitimate expectation of privacy is like claiming that people should expect privacy when they go to the bathroom on the side of the highway. People may want their email to be private, but that does not mean that we should pretend that email really is private. Really, we need encryption to be widely used, for people to learn about it in school, and for people to generally expect messages to be encrypted. We have not really won this fight until people encrypt private messages and get angry when private things are sent in the clear.
  - morsch 14y ago
    How do urinals fit into that metaphor?
  - varjag 14y ago
    You can't normally read SMTP exchange between two arbitrary servers. Granted, there's a range of attacks possible to a motivated hacker, but they are exactly that: attacks. Your email is normally not exposed to third parties.
    - betterunix 14y ago
      "Your email is normally not exposed to third parties." Except for the mail servers...
      - varjag 14y ago
        Yes, in the way your snail mail is exposed to postal trucks, mail handling agents and office clerks.
        betterunix 14y ago
        Not when the snail mail is in an envelope. When you send plaintext email, you are exposing the entire body of the message to casual inspection by any of the mail servers that are involved in delivering it. Unlike the postal system, however, your email is copied and stored by the servers involved in sending it, and you have little control over how long it is stored. It would be as though you communicated by sending post cards, and the postal works took every post card and ran it through a copy machine, leaving them all in a neatly organized (by sender and receiver) pile somewhere.
        varjag 14y ago
        SMTP does not inspect the body, it's outside of scope of the protocol. Also, unsealing an envelope on a hot surface is trivial. Nitpicking aside, both mediums are not inherently secure.
  - theorique 14y ago
    We have not really won this fight until people encrypt private messages and get angry when private things are sent in the clear. If this is the criterion for success, this fight will take a very, very long time to win. It may be impossible. How will I explain this to my grandma? To my 10 year old cousin who is interested only in Nicki Minaj and makeup?
  - coldtea 14y ago
    >We put doors on restrooms. Claiming that unencrypted email should carry a legitimate expectation of privacy is like claiming that people should expect privacy when they go to the bathroom on the side of the highway. People may want their email to be private, but that does not mean that we should pretend that email really is private. Why not? It's just a law away for this to happen. We can fully well pretend that email really is private. It doesn't matter if it is technically private (ie if someone can access it or not). What matters is for accessing it to be illegal.
  - taeric 14y ago
    Irrelevant. When you are in a restroom, you have an expectation of privacy. Period. Doesn't matter whose restroom you are at or what is going on. Hell, the door could be broken or just bad and you still have an expectation of privacy. Consider, someone could have a camera mounted onto their foot or on a poll to get over the standard stall doors. Would you just claim that folks should be ok with this? Because, "hey, it was possible? Quite easily done, actually." I am pushing this point so heavily especially because a large company is pushing cameras that are mounted on people's faces. If someone were going into a restroom taking pictures, people would feel rightfully violated. Soon, this is likely to be happening more than you'd care to consider. The ease with which it can be done is irrelevant to the legality of it.
    - betterunix 14y ago
      "Hell, the door could be broken or just bad and you still have an expectation of privacy." So let's take that argument to its extreme: you are standing in an open field going to the bathroom. Do you still think you have an reasonable expectation of privacy? The problem with your argument is that it is based on the idea that if people want privacy, they are entitled to it even if they do nothing to protect that privacy. There is nothing wrong with expecting people to be a bit proactive when it comes to their privacy -- closing doors, drawing their curtains, encrypting their email. People should not just shrug about someone filming them on the toilet, they should do something to prevent it (and if a person started to drill holes in the door, sure, prosecute them -- for destroying someone's property). "If someone were going into a restroom taking pictures, people would feel rightfully violated" No, if someone were going into a restroom taking pictures of other people going to the bathroom in a closed stall they would rightly feel violated. Any weaker standard is basically saying that nobody can take pictures in public, because they might accidentally catch a person peeing on a wall and thus violate their privacy. "The ease with which it can be done is irrelevant to the legality of it." No, it is very relevant to the legality, because when we make easy and popular things illegal we worsen an already out-of-control criminal justice system. We do not want to start arresting people just because they are using their cameras, even if their cameras are mounted on their heads, even if they wear their head-mounted cameras into bathrooms. If cameras are everywhere and used by everyone, the answer is to build bathroom stalls that go from the floor to the ceiling, not to open the door to waves of prosecution (which will almost certainly be used selectively against "undesirable" people). The appropriate place to draw the legal line with privacy is with people taking proactive and reasonable measures to be private. Putting letters in envelopes, closing curtains, closing doors, and yes, encrypting emails. You have no expectation of privacy in public parks, nor if your door is left open, nor if your curtains are left open, so why should you expect privacy when you send unencrypted email?
coldtea 14y ago
>Except that the mail server gets to see the body of the email, which is not even remotely private. Privacy should not (and in more enlightened countries and legal systems it does not) mean "others are not technically able to see it". It should mean: "this piece of information should not be attempted to be seen by others without the owners implicit or explicit permission". (And then legal formulas could be used to define "permission" (ie the recipient of an email has an implicit permission to read it)). If we use the BS notion of privacy of the US courts, then copyright should not exist either (because, by the same logic, one can break the copyright protection easily). Even theft would be OK (hey, I can steal your stuff if you left your belongings in a public place). So, no, whether my mails are in Google's servers or wherever else, it should be illegal to read them for any purpose I don't agree with. Much the same as if the postman delivers my email to the neighbor's box by mistake, he should not be allowed to open and read it.
- __david__ 14y ago
  > It should mean: "this piece of information should not be attempted to be seen by others without the owners implicit or explicit permission". So WireShark is now illegal in your ideal world? Email is computer technology and demands a technical answer: if you want something to not be eavesdropped on, encrypt it. This is why we use ssh and not telnet any more.
  - coldtea 14y ago
    >So WireShark is now illegal in your ideal world? If if it's not your network and/or network traffic, or you don't have the network owners permission, then yes. Why should it be legal? Because you like playing with it?
    - __david__ 14y ago
      That's a strange, old school way of thinking. Why are you trying to legislate technology when you could just make the tech work the way you want? "Impossible" trumps "illegal" every time.

taeric 14y ago

While I would not argue against encryption giving you privacy, I think it is easy to argue that there is an expectation of privacy in sending emails. At least, as much of one as if you were sending actual correspondence. Consider, in a public restroom there is very little done to prevent people from seeing each other. However, one almost certainly has a reasonable expectation of privacy in such a situation. Hell, consider using the restroom in someone else's house. If you record videos of everyone that uses your restroom...

betterunix 14y ago
We put doors on restrooms. Claiming that unencrypted email should carry a legitimate expectation of privacy is like claiming that people should expect privacy when they go to the bathroom on the side of the highway. People may want their email to be private, but that does not mean that we should pretend that email really is private. Really, we need encryption to be widely used, for people to learn about it in school, and for people to generally expect messages to be encrypted. We have not really won this fight until people encrypt private messages and get angry when private things are sent in the clear.
- morsch 14y ago
  How do urinals fit into that metaphor?
- varjag 14y ago
  You can't normally read SMTP exchange between two arbitrary servers. Granted, there's a range of attacks possible to a motivated hacker, but they are exactly that: attacks. Your email is normally not exposed to third parties.
  - betterunix 14y ago
    "Your email is normally not exposed to third parties." Except for the mail servers...
    - varjag 14y ago
      Yes, in the way your snail mail is exposed to postal trucks, mail handling agents and office clerks.
      - betterunix 14y ago
        Not when the snail mail is in an envelope. When you send plaintext email, you are exposing the entire body of the message to casual inspection by any of the mail servers that are involved in delivering it. Unlike the postal system, however, your email is copied and stored by the servers involved in sending it, and you have little control over how long it is stored. It would be as though you communicated by sending post cards, and the postal works took every post card and ran it through a copy machine, leaving them all in a neatly organized (by sender and receiver) pile somewhere.
        varjag 14y ago
        SMTP does not inspect the body, it's outside of scope of the protocol. Also, unsealing an envelope on a hot surface is trivial. Nitpicking aside, both mediums are not inherently secure.
- theorique 14y ago
  We have not really won this fight until people encrypt private messages and get angry when private things are sent in the clear. If this is the criterion for success, this fight will take a very, very long time to win. It may be impossible. How will I explain this to my grandma? To my 10 year old cousin who is interested only in Nicki Minaj and makeup?
- coldtea 14y ago
  >We put doors on restrooms. Claiming that unencrypted email should carry a legitimate expectation of privacy is like claiming that people should expect privacy when they go to the bathroom on the side of the highway. People may want their email to be private, but that does not mean that we should pretend that email really is private. Why not? It's just a law away for this to happen. We can fully well pretend that email really is private. It doesn't matter if it is technically private (ie if someone can access it or not). What matters is for accessing it to be illegal.
- taeric 14y ago
  Irrelevant. When you are in a restroom, you have an expectation of privacy. Period. Doesn't matter whose restroom you are at or what is going on. Hell, the door could be broken or just bad and you still have an expectation of privacy. Consider, someone could have a camera mounted onto their foot or on a poll to get over the standard stall doors. Would you just claim that folks should be ok with this? Because, "hey, it was possible? Quite easily done, actually." I am pushing this point so heavily especially because a large company is pushing cameras that are mounted on people's faces. If someone were going into a restroom taking pictures, people would feel rightfully violated. Soon, this is likely to be happening more than you'd care to consider. The ease with which it can be done is irrelevant to the legality of it.
  - betterunix 14y ago
    "Hell, the door could be broken or just bad and you still have an expectation of privacy." So let's take that argument to its extreme: you are standing in an open field going to the bathroom. Do you still think you have an reasonable expectation of privacy? The problem with your argument is that it is based on the idea that if people want privacy, they are entitled to it even if they do nothing to protect that privacy. There is nothing wrong with expecting people to be a bit proactive when it comes to their privacy -- closing doors, drawing their curtains, encrypting their email. People should not just shrug about someone filming them on the toilet, they should do something to prevent it (and if a person started to drill holes in the door, sure, prosecute them -- for destroying someone's property). "If someone were going into a restroom taking pictures, people would feel rightfully violated" No, if someone were going into a restroom taking pictures of other people going to the bathroom in a closed stall they would rightly feel violated. Any weaker standard is basically saying that nobody can take pictures in public, because they might accidentally catch a person peeing on a wall and thus violate their privacy. "The ease with which it can be done is irrelevant to the legality of it." No, it is very relevant to the legality, because when we make easy and popular things illegal we worsen an already out-of-control criminal justice system. We do not want to start arresting people just because they are using their cameras, even if their cameras are mounted on their heads, even if they wear their head-mounted cameras into bathrooms. If cameras are everywhere and used by everyone, the answer is to build bathroom stalls that go from the floor to the ceiling, not to open the door to waves of prosecution (which will almost certainly be used selectively against "undesirable" people). The appropriate place to draw the legal line with privacy is with people taking proactive and reasonable measures to be private. Putting letters in envelopes, closing curtains, closing doors, and yes, encrypting emails. You have no expectation of privacy in public parks, nor if your door is left open, nor if your curtains are left open, so why should you expect privacy when you send unencrypted email?

coldtea 14y ago

>Except that the mail server gets to see the body of the email, which is not even remotely private. Privacy should not (and in more enlightened countries and legal systems it does not) mean "others are not technically able to see it". It should mean: "this piece of information should not be attempted to be seen by others without the owners implicit or explicit permission". (And then legal formulas could be used to define "permission" (ie the recipient of an email has an implicit permission to read it)). If we use the BS notion of privacy of the US courts, then copyright should not exist either (because, by the same logic, one can break the copyright protection easily). Even theft would be OK (hey, I can steal your stuff if you left your belongings in a public place). So, no, whether my mails are in Google's servers or wherever else, it should be illegal to read them for any purpose I don't agree with. Much the same as if the postman delivers my email to the neighbor's box by mistake, he should not be allowed to open and read it.

__david__ 14y ago
> It should mean: "this piece of information should not be attempted to be seen by others without the owners implicit or explicit permission". So WireShark is now illegal in your ideal world? Email is computer technology and demands a technical answer: if you want something to not be eavesdropped on, encrypt it. This is why we use ssh and not telnet any more.
- coldtea 14y ago
  >So WireShark is now illegal in your ideal world? If if it's not your network and/or network traffic, or you don't have the network owners permission, then yes. Why should it be legal? Because you like playing with it?
  - __david__ 14y ago
    That's a strange, old school way of thinking. Why are you trying to legislate technology when you could just make the tech work the way you want? "Impossible" trumps "illegal" every time.