4 ms·

This has good intentions but misses the main point of encryption : no third entity should ever have a copy of the unencrypted message at any given time. Once y

This has good intentions but misses the main point of encryption : no third entity should ever have a copy of the unencrypted message at any given time. Once your emails get into google servers, the NSA has made a copy of them. NSA copies your emails before you even read them. You are protecting yourself from someone who has access to your gmail account, not from someone who has a BACKUP of your gmail account.

etherael 13y ago
True, it doesn't protect from every threat model in existence, I've been considering setting up some kind of third party reflector model, but the problem there is that the termination point for the plaintext recipients still requires trust at some level. I recognise this isn't perfect, but the very fact that in various stories a fuss has been raised about data retention times indicates it might not be completely useless to close the window of vulnerability, another comment in this thread mentions monitoring the incoming messages via IMAP IDLE also which is another idea, but once again there is a non zero window of plaintext messages on the server. And if nothing else, the thousands of spam messages this will armor with strong encryption will give the fascists something to waste their time on.
themckman 13y ago
> Once your emails get into google servers, the NSA has made a copy of them. NSA copies your emails before you even read them. I haven't followed the NSA Prism story as closely as maybe I should have, but I'm curious: is this TRUE? Like, is it indisputable fact that the NSA has all your email, or, is it more like, we can't be sure what they do and don't have access to, therefore, it's better to assume the worst?
- packetslave 13y ago
  Of course it isn't true
  - mike-cardwell 13y ago
    Because Google is well known for deleting data rather than storing and mining it?
    - packetslave 13y ago
      Not sure how that's relevant to "Once your emails get into google servers, the NSA has made a copy of them. NSA copies your emails before you even read them"? Also, please explain how you would implement a webmail service without storing emails.
      - mike-cardwell 13y ago
        It's relevant to the idea that if an email enters Google, it's probably accessable to the NSA, even if you delete it. I was directly responding to: "is it indisputable fact that the NSA has all your email, or, is it more like, we can't be sure what they do and don't have access to" They don't need to have second hand copies of the mail when they can just tell Google to give them access. "implement a webmail service without storing emails." is not relevant to anything I said.
- dhimes 13y ago
  It's not just the servers. In fact, PRISM was one of 5 programs disclosed: http://en.wikipedia.org/wiki/File:Upstream_slide_of_the_PRISM_presentation.jpg http://en.wikipedia.org/wiki/File:Upstream_slide_of_the_PRIS... FAIRVIEW, BLARNEY, and two whose names were redacted exist in addition to PRISM. They are tapping the pipes and grabbing stuff off of the server. They can pretty much have whatever they want.
  - yen223 13y ago
    themckman's question is a valid one though. So far, almost everything we know about the NSA's surveillance capabilities seem to come from those leaked slides, and frankly, I don't think a couple of slides are going to be technically accurate. The truth is, we simply do not know the real extent of the NSA's reach.
- VladRussian2 13y ago
  >I haven't followed the NSA Prism story as closely as maybe I should have, but I'm curious: is this TRUE? it is the "least untruthful statement". > or, is it more like, we can't be sure what they do and don't have access to, therefore, it's better to assume the worst? it is just hard to imagine how they don't have access to something. They obviously capable of accessing everything they want. Thus if they don't access something, it would mean they don't want to. Ed absurdum. Interesting piece of history btw: http://en.wikipedia.org/wiki/Martin_Hellman#Computer_privacy_debate http://en.wikipedia.org/wiki/Martin_Hellman#Computer_privacy... "Hellman has been a long-time contributor to the computer privacy debate. He and Diffie were the most prominent critics of the short key size of the Data Encryption Standard in 1975. An audio recording survives of their review of DES at Stanford in 1976 with Dennis Branstad of NBS and representatives of the National Security Agency.[12] Their concern was well-founded: subsequent history has shown not only that NSA actively intervened with IBM and NBS to shorten the key size ..."
DrJosiah 13y ago
Your first sentence, precisely. And really, it doesn't matter whether the NSA has explicit connections into Gmail, your email is backed up periodically by Google already, so plaintext is available to interested parties for quite a while even if you were to empty your trash. But even before that, many SMTP servers transmit emails in the clear, so it wouldn't matter if the NSA had their hooks into Google if they've got their hooks into the backbones that Google peers with. Oh, and you lose all read state, all information about when an email was sent, any labels, stars, any reference headers for threading, ... Seemingly the only threat that this addresses is "someone may hack into my email account and I don't want them to be able to read my email". There are several other methods for solving that particular issue without destroying email metadata and the usefulness of email itself.
jpdoctor 13y ago
> no third entity should ever have a copy of the unencrypted message at any given time. The first company that offers serious client-side encryption (with steganography + noise thrown in for good measure) is going to make a bundle. Hint, hint.
- jiggy2011 13y ago
  The issue here is that you then have to do everything client side. Search,spam/malware filtering etc. So you need a copy of all of the mail on the client. Basically you go back to the days of POP3 or having your gmail account taking 10 minutes to log you in while it downloads everything to local storage.

etherael 13y ago

True, it doesn't protect from every threat model in existence, I've been considering setting up some kind of third party reflector model, but the problem there is that the termination point for the plaintext recipients still requires trust at some level. I recognise this isn't perfect, but the very fact that in various stories a fuss has been raised about data retention times indicates it might not be completely useless to close the window of vulnerability, another comment in this thread mentions monitoring the incoming messages via IMAP IDLE also which is another idea, but once again there is a non zero window of plaintext messages on the server. And if nothing else, the thousands of spam messages this will armor with strong encryption will give the fascists something to waste their time on.

themckman 13y ago

> Once your emails get into google servers, the NSA has made a copy of them. NSA copies your emails before you even read them. I haven't followed the NSA Prism story as closely as maybe I should have, but I'm curious: is this TRUE? Like, is it indisputable fact that the NSA has all your email, or, is it more like, we can't be sure what they do and don't have access to, therefore, it's better to assume the worst?

packetslave 13y ago
Of course it isn't true
- mike-cardwell 13y ago
  Because Google is well known for deleting data rather than storing and mining it?
  - packetslave 13y ago
    Not sure how that's relevant to "Once your emails get into google servers, the NSA has made a copy of them. NSA copies your emails before you even read them"? Also, please explain how you would implement a webmail service without storing emails.
    - mike-cardwell 13y ago
      It's relevant to the idea that if an email enters Google, it's probably accessable to the NSA, even if you delete it. I was directly responding to: "is it indisputable fact that the NSA has all your email, or, is it more like, we can't be sure what they do and don't have access to" They don't need to have second hand copies of the mail when they can just tell Google to give them access. "implement a webmail service without storing emails." is not relevant to anything I said.
dhimes 13y ago
It's not just the servers. In fact, PRISM was one of 5 programs disclosed: http://en.wikipedia.org/wiki/File:Upstream_slide_of_the_PRISM_presentation.jpg http://en.wikipedia.org/wiki/File:Upstream_slide_of_the_PRIS... FAIRVIEW, BLARNEY, and two whose names were redacted exist in addition to PRISM. They are tapping the pipes and grabbing stuff off of the server. They can pretty much have whatever they want.
- yen223 13y ago
  themckman's question is a valid one though. So far, almost everything we know about the NSA's surveillance capabilities seem to come from those leaked slides, and frankly, I don't think a couple of slides are going to be technically accurate. The truth is, we simply do not know the real extent of the NSA's reach.
VladRussian2 13y ago
>I haven't followed the NSA Prism story as closely as maybe I should have, but I'm curious: is this TRUE? it is the "least untruthful statement". > or, is it more like, we can't be sure what they do and don't have access to, therefore, it's better to assume the worst? it is just hard to imagine how they don't have access to something. They obviously capable of accessing everything they want. Thus if they don't access something, it would mean they don't want to. Ed absurdum. Interesting piece of history btw: http://en.wikipedia.org/wiki/Martin_Hellman#Computer_privacy_debate http://en.wikipedia.org/wiki/Martin_Hellman#Computer_privacy... "Hellman has been a long-time contributor to the computer privacy debate. He and Diffie were the most prominent critics of the short key size of the Data Encryption Standard in 1975. An audio recording survives of their review of DES at Stanford in 1976 with Dennis Branstad of NBS and representatives of the National Security Agency.[12] Their concern was well-founded: subsequent history has shown not only that NSA actively intervened with IBM and NBS to shorten the key size ..."

DrJosiah 13y ago

Your first sentence, precisely. And really, it doesn't matter whether the NSA has explicit connections into Gmail, your email is backed up periodically by Google already, so plaintext is available to interested parties for quite a while even if you were to empty your trash. But even before that, many SMTP servers transmit emails in the clear, so it wouldn't matter if the NSA had their hooks into Google if they've got their hooks into the backbones that Google peers with. Oh, and you lose all read state, all information about when an email was sent, any labels, stars, any reference headers for threading, ... Seemingly the only threat that this addresses is "someone may hack into my email account and I don't want them to be able to read my email". There are several other methods for solving that particular issue without destroying email metadata and the usefulness of email itself.

jpdoctor 13y ago

> no third entity should ever have a copy of the unencrypted message at any given time. The first company that offers serious client-side encryption (with steganography + noise thrown in for good measure) is going to make a bundle. Hint, hint.

jiggy2011 13y ago
The issue here is that you then have to do everything client side. Search,spam/malware filtering etc. So you need a copy of all of the mail on the client. Basically you go back to the days of POP3 or having your gmail account taking 10 minutes to log you in while it downloads everything to local storage.