11 ms·

Deutsche Telekom, Web.de and GMX launch "E-mail made in Germany" initiative

113 points by junto 13y ago

junto 13y ago
- Automatic encryption of data over all transmission paths - Secure data storage in Germany as a reputable location - Designation of secure e-mail addresses
- wusatiuk 13y ago
  reputable location - whatever reputable means... It´s funny that web.de is also on board. If you have a look at the business model of web.de, they are always trying to get they users automatically locked into an overpriced subscription model after the free trial period ends.
  - junto 13y ago
    Is that better than worse than the Google model?
    - wusatiuk 13y ago
      what do you mean by the google model?
      - junto 13y ago
        You 'pay' through your private emails being scanned, analysed and the advertised to. With Web.de you pay a subscription fee.
        wusatiuk 13y ago
        yes, you pay a subscription fee, but this does not automatically mean that you are getting scanned. I am hove no problem with subscription fees. I have a problem within companies who try to push they clients into subscription through some kind of free trials which then get automatically converted into yearly contract.
- deleted 13y ago
  [deleted]
protonormal 13y ago
Call it Stasi-Email
- deleted 13y ago
  [deleted]
- deleted 13y ago
  [deleted]
ColinWright 13y ago
I'm having trouble seeing how this will work. They say: > Data are encrypted directly by the provider, ... and they also say: > automatically encrypt data over all transmission paths If it's done by the provider, how does the data get from my machine to their machine to be encrypted?
- aw3c2 13y ago
  In their eyes your machine is their webmail interface which runs of course in the "cloud".
  - ColinWright 13y ago
    No matter how I try to parse that it doesn't seem to make sense, neither as a straight reply, nor as satire/joke/irony. Can you elaborate? Sorry if I'm being thick ...
    - replax 13y ago
      They assume that you write your email on their web interface, to which you connect over https. and when they send your mail to anotjer server, they do so over a ssl encryption. of course, if you use an email application, you can enable/disble ssl/tls if you wish to do so.
      - ColinWright 13y ago
        Ah, so I'd have to use webmail. I guess that makes sense, but it makes it impossible for my use cases. Thanks for the clarification.
Derbasti 13y ago
If this was implemented correctly, it would keep non-German governments from being able to snoop on German emails. If Germany does not snoop on Germans without a warrant, this would actually be a good thing for Germans. If European has data protection laws that prohibit snooping on foreign people without a warrant, this would actually be a good thing for everyone. A lot of ifs that need to be answered. But this could be a good thing.
- greenyoda 13y ago
  Until the recent revelations about the NSA, we also believed (perhaps naively) that the U.S. had data protection laws that prohibited spying on citizens without a warrant. It may be just a matter of time before we find out that Germany has murky laws and secret courts that disregard fundamental legal principles just like the U.S. does, or that the German intelligence agencies work closely with the NSA. So if I really wanted secure e-mail, the only thing I could really trust at this point would be to encrypt my message on my own machine using a transparent, open source program like PGP. Once you rely on a third party to encrypt your e-mail for you (or even to provide you with encryption software), you're vulnerable to their being strong-armed by a government to give up your data.
  - Derbasti 13y ago
    You are right in that this Telekom solution does not allow for truly secure communication. However, it does prevent men in the middle from snooping on your emails, which is a step in the right direction.
  - mpyne 13y ago
    > Until the recent revelations about the NSA, we also believed (perhaps naively) that the U.S. had data protection laws that prohibited spying on citizens without a warrant. If people believed that email that a person didn't host themselves was protected, it was only because they were lazy and didn't so much as Google the laws in question. The reason we keep telling you that the NSA behavior is probably legal isn't because we want it to be legal, it's because we want you to stop living in a fantasyland ;). Look at ECPA for instance, it's been around since 1986. CALEA has been around since 1994.
computer 13y ago
> " For security reasons, from the beginning of 2014 the initiative partners will only transport SSL-encrypted e-mails to ensure that data traffic over all of their transmission paths is secure." That's the most significant part of this announcement-- it means there's finally a push to phase out plaintext email transport, which allows passive surveillance to intercept mail.
- mikemoka 13y ago
  Yes, because there is no reason to believe that the german government has any interest in the active surveillance of digital communications. /* sarcasm */
  - computer 13y ago
    I am not saying that this specific service is good for the privacy of their users. I am saying that this move, phasing out non-SSL email, will _force_ the rest of the world to add SSL to outgoing email connections, thereby protecting all email worldwide from passive interception. Right now, I think about 75% of email traffic is encrypted between sender and recipient, so this would protect that remaining 25%. (Percentages _greatly_ dependent on who and where you measure.)
    - mjn 13y ago
      I agree with that view. I think this is largely a bit of opportunist advertising, but also that this specific measure is actually useful. Like with more companies moving towards HTTPS-by-default, it's useful in cutting down the number of places where things can be easily intercepted. Even cutting down the number of places where non-government parties can intercept something is useful, because: 1) that's in itself good for privacy; and 2) non-government parties are a major source of government information, because some of them voluntarily turn over or sell the information to governments, and others end up being forced to hand it over.
  - muyuu 13y ago
    It's better to be subject to just your government instead of both your government and the self-proclaimed world police. The US terror machine needs to be avoided at all costs as it's the greatest threat to peace and freedom worldwide.
benzimmer 13y ago
What they claim to do is basically what everybody is already doing. SSL between email servers can be considered standard, as well as SSL or at least StartTLS between client and server. De-Mail is another thing which was introduced some years ago now. In short: Messages are encrypted on the client side, then decrypted on the server, then again encrypted and sent to the recipient where it is decrypted again...Imagine your post-office opening you mail before forwarding it to the recipient. Along with some other things no sane person would ever suggest to do with email, De-Mail is a complete farce... TL;DR: I'm from Germany, and my opinion is that this is the most brutal kind of PR bullshit you can get...
- blablabla123 13y ago
  Still better than having all your data traffic piped to the NSA. Don't forget that this pipe is behind the SSL-Wall of Google. Being from Germany too, I'm seriously considering to move my mail account from GMail to Web.de. Already started moving my private Docs away from Google. I like Google services and even before Snowden I was aware of the fact that international communication is watched by Secret agency. But really, why do they keep track of everything?
linohh 13y ago
Snake oil. Election day is coming, the conservative idiots in charge want some good press. The german interpretation of e-Mail (de-Mail) is utter bullshit. Encrypted e-Mail that is decrypted multiple times on its way, of course that will prevent the Government from reading my mail. NOT. It seems that there are enough idiots in the world who are willing to reelect that treacherous pile of smelly shit impersonating a federal government at the moment.
- junto 13y ago
  I don't see what a bunch of corporate entities have to do within election campaign. This is a response the the German publics concern that a foreign government is doing content analysis on emails within Germany. This makes it harder for the spooks down in Ramstein to analyse the traffic flowing between German consumers and German corporations, which is a damn good thing. This spying might also be (mis)used for corporate espionage as well. It isn't going to stop a German police warrant or BND investigation requiring these companies to hand over your emails, and the EU data retention polices are still in place, but it does stop the foreign spooks sticking their noses in where it isn't wanted. DE-MAIL, is as you say, bullshit, but that isn't why this is really about. I know that from my GMX account I can email someone on a Web.de account, and even if the Internet decides to route my email over the Atlantic first or through Frankfurt where I hazard a guess the NSA will be doing they optical splitting, it doesn't matter. If they want to read my emails they have to brute force that or have a copy of the keys. This is a small, but great step forward in my opinion.
  - OGC 13y ago
    > I don't see what a bunch of corporate entities have to do within election campaign > I don't see what a bunch of corporate entities have to do within election campaign > I don't see what a bunch of corporate entities have to do within election campaign Read. that. again. Good god.
  - darklajid 13y ago
    Maybe I'm missing something, but .. what do you think is _new_ about this 'made in Germany' mails here? Using TLS for smtp (which seems to be what you're referring to for the 'route over the Atlantic' thing)? Using TLS for submission/the client? Every respectable site and certainly every web mail client that isn't utterly broken offers https / TLS already. I see nothing but a stupid media campaign and fishing for scared and clueless end users that read about this in their favorite tabloid. A.k.a. the BILD/Computer BILD target crowd.
northwest 13y ago
It's a trap! https://de.wikipedia.org/wiki/Dagger_Complex https://de.wikipedia.org/wiki/Dagger_Complex
- greenyoda 13y ago
  Translated from German (via Google Translate), the first paragraph reads: The so-called Dagger Complex ... is a base of military intelligence services of the United States in Darmstadt at the district border to the town of Griesheim. It is located at the south of the former way Eberstädter August Euler airfield. It is believed that the secret services operate in the United States spy here.
andyl 13y ago
It seems to me that NSA is working directly against the interests of American technology companies. Ironic. I think this is going to be remembered as the high-water mark of American Social Media. I grew up in Michigan and well remember the demise of the auto-industry. They had a good thing going, and thought it could never end. People grew complacent. There is no guarantee that American technology business will continue to dominate. Eric Schmidt's "you have no privacy" attitude was both arrogant and short-sighted. We've needlessly shot ourselves in the foot.
- jivatmanx 13y ago
  There's a big gap between the philosophies of "Everything is public by default" and "Secretly giving all of your private communications to the NSA". The former is utopian, though naive. The latter is just old school tyranny.
  - mpyne 13y ago
    And what if the actual truth really is somewhere in that big gap you mentioned? Even PRISM doesn't give all @gmail.com to NSA after all.
    - junto 13y ago
      I think the end goal is exactly that. Sigint is about getting everything.
      - mpyne 13y ago
        Certainly it would be easier, but even NSA doesn't have enough hard drives to store all of GMail, Outlook.com, Skype, etc. Some selectivity is required for them to do analysis, for the same reason we would run "grep foo <star>.cpp" instead of "find / -name '<star>.cpp' -exec grep foo {} \;"
        derefr 13y ago
        > Certainly it would be easier, but even NSA doesn't have enough hard drives to store all of GMail, Outlook.com, Skype, etc. Actually, that's an interesting point. I don't bother keeping copies of television series I've downloaded and watched laying about on my disk, because I know I can just go and retrieve them from the internet again if-and-when I want to watch them. In effect, I'm using the internet as a large, slow (but reliable!) disk. The parallel being, I don't see why the NSA would bother to build its own datacenters for storing data. Google's, Apple's, Microsoft's, whoever's datacenters, are the NSA's datacenters. They don't have to retain information themselves; they just have to send a FISA notice to these companies telling them to retain the information, indefinitely, until the NSA has need of it.
sentenza 13y ago
Don't use any of these email providers. First up, they are not trustworthy, especially Deutsche Telekom. DT is the privatised former state-owned telco monopolist, with a gigantic share of userbase and partial ownership by the German federal state. Most likely, every intelligence agency, domestic or foreign, that is operating in Germany with sanction of the government will have access to anything on their servers. Also there is Quellen-TKÜ, which means that every single one of the three gives access to their servers to German law enforcement. If I remember correctly, the Quellen-TKÜ law says that any online service provider that has more than X users (10k?) has to provide access to law enforcement in such a way that the provider operators themselves don't know about the individuall access operations.
- junto 13y ago
  That isn't the point is it? The step forward here is that the comumunications between these providers is now encrypted by default and foreign entities such as the NSA will now have a harder job to do traffic and content analysis on German emails being sent to and from German nationals. I don't have a problem with a German judge in a German court, granting a search warrant with reasonable grounds where all checks and balances are in place. I do have a problem with secret courts with secret laws and gag orders hiding this kind of thing from the public. If foreign intelligence agencies are allegedly granted unhindered access to their servers then I see that as a scandal. Have you got any evidence to back up that claim?
  - sentenza 13y ago
    In principle I agree with you and I think you are right considering what the police is allowed to do and what not. As far as I know, a judge still needs to sign a warrant for the police to do anything. However... https://netzpolitik.org/2013/500-millionen-verbindungsdaten-im-monat-bnd-betreibt-vorratsdatenspeicherung-durch-die-hintertur/ https://netzpolitik.org/2013/500-millionen-verbindungsdaten-... I would be really surprised if the BND wasn't using that same access infrastructure (admittedly as supposition on my part). Combined with the story on how the BND protects our data by removing email addresses that end on .de, this again becomes worst case-ish. Now this is only metadata, but at least in the case of email, processing the metadata means having parsed the message. Since the infrastructure is supposed to be set up in such a way that they get it from the server of the provider, encrypting the communication with said provider is kind of useless, at least in regard to the NSA. I'd also like to add that your comment makes an important point. Most people, including me, are quite OK with law enforcement operating under the rule of law within clear boundaries in this realm. But how do we get the intelligence community from hitchhiking on the law enforcement infrastructure?
kriro 13y ago
Telekom has actually been selling their own cloud services with "German privacy laws/not hosted in the US" before the NSA stuff. It was a very noteable point of emphasis for them when selling to small/midsized corporations so I'm not surprised they are all over this. They are a pretty crappy company in general (imo) but they got this right very early. And by got this right I mean that they are using it for marketing/sales. I mean yay SSL but German mail providers tend to be...meh
rdl 13y ago
Are they seriously talking about enforcing TLS on all SMTP? That would break deliverability to a lot of servers, but would be pretty awesome. I assume it wouldn't actually check certs in any meaningful way, though, so only protecting from passive eavesdropping, but it's a big positive step. I'm increasingly tempted to throw that switch myself, or at least start filtering all my non-TLS'd mail into a special mailbox of "figure out if I actually care if these people become unreachable in 6mo when I actually enforce TLS." Arguably it would be worse to accept the message and then bounce it, since you'd have received the text in the clear, but maybe log and send an informative-to-end-user rejection notice based on envelope, and to me?
- yrro 13y ago
  You would configure your email server to reject the two following cases: Case 1: SMTP client that knows nothing about TLS S: 220 server.example ESMTP Greetings! C: HELO host.example S: 550 TLS only, thanks! Case 2: ESMTP client that knows nothing about TLS S: 220 server.example ESMTP Greetings! C: EHLO host.example S: 250-STARTTLS C: MAIL FROM: user@host.example S: 550 TLS only, thanks! Sadly, a client that refuses to attempt TLS negotiation will always leak the sender address of the message it wants to send you. This happens in many protocols when TLS is bolted on as an afterthought. We're actually worse off using the standardized TLS extension to SMTP here than we are with the non-standardized SSL: a connection to port 465, followed by immediate SSL negotiation won't leak anything to a passive eavesdropper. This only gets you so far however. An active attacker can MITM the connection with ease, since there is no convention for how to verify an SMTP peer's certificate. I don't see this changing until DNSSEC is deployed in every domain you correspond with, and the peer's certificate is somehow authenticated with information from their DNS zone. Aside: for a protocol that is designed even worse than SMTP with regards to leaking information over insecure channels, look at IMAP: S: * OK [CAPABILITY IMAP4rev1 LITERAL+ SASL-IR LOGIN-REFERRALS ID ENABLE IDLE STARTTLS LOGINDISABLED] Dovecot ready. C: 0 login user@example hunter12 S: BAD [ALERT] Plaintext authentication not allowed without SSL/TLS, but your client did it anyway. If anyone was listening, the password was exposed. S: 0 NO [PRIVACYREQUIRED] Plaintext authentication disallowed on non-secure (SSL/TLS) connections. The stupid protocol design results in the client transmitting the user's credentials in plain text as soon as it connects to the server.
mattjaynes 13y ago
Foreign leaders woke up one day to find that the US now has deep spy penetration into their local populace. Oops. Huge national security fail. They haven’t said much publicly, but behind closed doors they're scrambling to figure out how to get their pants back up. This is only the very beginning of a huge shift that most of the US is blind to or in denial about. All around the world, in government offices and in business board rooms, leaders are trying to figure out how to get off the US cloud. The US cloud has been compromised and that trust just isn't coming back. The barrier now is not political will, but a lack of local tech talent that can build viable alternatives to the US cloud services. Many countries are kicking themselves now for not growing/poaching tech talent more aggressively. Interesting times when having good web developers is a big national security asset. You'll see the more tech rich countries move first. It's no surprise Germany's a first mover here. Of course, with any big disruption there will be winners and losers. Who the losers will be is obvious - US cloud companies. Sure, they'll still have the US market (which is huge), but international markets will start drying up. Skeptical? Google is hearing a huge sucking sound of money evaporating from Germany right now. Google's so big, they may not notice a few million yet, but I assure you, they will notice eventually. Karmic justice for short-sightedness in not out-lobbying the big defense contractors in Congress. What's comical is how cheap it would be to out-lobby the defense contractors: http://www.opensecrets.org/industries/indus.php?Ind=D http://www.opensecrets.org/industries/indus.php?Ind=D The top contributing defense contractor (Northrop Grumman) only gave about $3 million last year. I'm sure they paid more than that for actual lobbyists, etc, but it's still not even petty cash at Google. Of course, I don't mean to pick only on Google. There are many multi-multi-billion dollar cloud companies in the US that have been easily out-lobbied by the defense industry. It would have been pennies compared to what they'll ultimately lose in the drying-up international markets. So, who will be the winners? While security companies will see a boon, it's the open source companies that I think will see the biggest win. With open, auditable code, countries can set up their own services. Of course, they'll need support and training and that's where the open source companies really shine. It's important to remember that the goal for these countries will rarely be fool-proof privacy for each individual citizen. Instead, the goal is to prevent a foreign power from having deep intimate access to every detail of your populace. Granted, many of these countries will use this transition to just spy on their own citizens. However, other countries will have a good functioning democracy and a citizenry that values privacy and will avoid those abuses. For those countries that have robust protections and engender international trust, they'll have a big business advantage when it comes to foreign consumers.
tomphoolery 13y ago
"secure" means secure from the US, not from Germany... Doesn't actually mean "secure".
walshemj 13y ago
Next France telecom will announce minitel v2.0 for french "courriel" and the uk will revert to OSI based email using dialcom software - "just don't tell anyone about the Level 7 accounts"
Radle 13y ago
That is why you would use such an E-Mail service: "I don't have a problem with a German judge in a German court, granting a search warrant with reasonable grounds where all checks and balances are in place. I do have a problem with secret courts with secret laws and gag orders hiding this kind of thing from the public." Take it with a little salt anyways, there is always the possibility for American services to get Access on your Data for example if they had an Employee in any of the German companys.
- Vivtek 13y ago
  ... or if they just ask the BND.
guelo 13y ago
I think the best we can hope for the future of the web is that there will be reliable service providers in many different legal jurisdictions so that users can make a political calculation as to which government they can trust with their information. And that transport encryption remains trustable.
Vivtek 13y ago
Well, if Telekom is on the case, the US has nothing to fear.
platzhirsch 13y ago
This is so embarrassing. So they finally implemented STARTSSL? A standard which is how old? 14 years. That is what they are advertising? Looking at the past events it should be clear, that encryption during transmission is not a final solution. Secure transmission is important, hence HTTPS, but due to the past events, using this marketing gag is just grotesque to fool people who cannot differ between these technologies.
lukele 13y ago
One very interesting tidbit - regardless that this is simply some PR stunt at exactly the right time - according to a renowned german news magazine Die Zeit, two of the founders of Narus, which helped develop the PRISM technology, are now working for the Deutsche Telekom. Go figure! Source: http://www.zeit.de/2013/33/nsa-spionage-industrie-profiteure http://www.zeit.de/2013/33/nsa-spionage-industrie-profiteure
realrocker 13y ago
Privacy-Shrivacy Bollocks. Many here do not get the point. US having intimate information of a foreign populace is akin to having an extra weapon in their arsenal. In today's world data is the new gunpowder. If you have insight(I mean really really know) into what a foreign country would buy/sell you can have an upper hand in trade negotiations. This is not some prudish step to prevent Uncle Sam to look into your private details. This is all out cold war. Diplomats across the world are talking about one thing today: Nullifying the U.S advantage. I guess China foresaw it.
a3n 13y ago
As many commenters here say, it isn't inherently more secure than a US-based service. It may be more socially secure, if the warrant system in Germany is more specific than our general system of warrants to spy on everyone foreign or domestic. However, there's a good reason for German citizens to prefer German services: it takes money away from American service. Money is the only voice that will ever fix this. So I ask every non-US citizen: please, take your money elsewhere. Please.
deleted 13y ago
[deleted]
bhrgunatha 13y ago
Der Spiegel reported that Germany collaborated with the US very, very closely and even use XKeyScore. [1] "The Americans provided the BfV with one of their most productive spying tools, a system called "XKeyscore." It's the same surveillance program that the NSA uses to capture a large share of the up to 500 million data sets from Germany, to which it has access each month, according to internal documents seen and reported on by SPIEGEL on the first of this month." How is this anything but propaganda? [1] http://www.spiegel.de/international/world/german-intelligence-worked-closely-with-nsa-on-data-surveillance-a-912355.html http://www.spiegel.de/international/world/german-intelligenc...
kayoone 13y ago
It seems like a noble move but as a german i know these companies pretty well and i am very sure they only do this to stop german users wandering off to non-german email providers like gmail. Its still a good thing of course, but dont think they do this because they feel its the right thing todo. Heck, if they could they would even charge extra for it.
tillk 13y ago
> Data are encrypted directly by the provider, which means customers need no specific technical know-how and incur no extra costs. All data are stored in secure data centers located in Germany. Not sure how this is the solution. People need to learn how to do encryption themselves. For the average John Doe (or Hans Wurst :-)) there need to be tools to accomplish that without a degree in Math or CS. I don't think provider-side encryption is a solution at all. Collecting vast amounts of meta data would still be possible.
axelfreeman 13y ago
They use us-based "cloud" anti virus scanner in this system. They decrypt it for scanning them. It's ridiculous stupid. No end-to-end encryption. Thats all marketing bullshit. Think about it. In the "De-Mail" system are all sender verified. Thats means that i can kick spammer easily out. Why would they decrypt it for scanning? Bingo! Surveillance. But this is just that what i think. I have written an comment on there blog and i'm exited what they say.
virtualritz 13y ago
All you need to know about this. Aka: response of the German Chaos Computer Club (in German): http://www.ccc.de/en/updates/2013/sommermaerchen http://www.ccc.de/en/updates/2013/sommermaerchen
michalu 13y ago
I have both gmail and GMX and to be honest if "the email made in Germany" will be the same as GMX I will gladly offer my data to NSA and stay with gmail. In other words this whole debate about security will pass and 95% of people will forget or become ignorant so unless they create a service people actually want to use this is just a waste of money. From my experience gmx totally don't get it and if you become their user they will eventually piss you off to the point when you will run towards NSA just to use something like gmail.

113 points by junto 13y ago

junto 13y ago

- Automatic encryption of data over all transmission paths - Secure data storage in Germany as a reputable location - Designation of secure e-mail addresses

wusatiuk 13y ago
reputable location - whatever reputable means... It´s funny that web.de is also on board. If you have a look at the business model of web.de, they are always trying to get they users automatically locked into an overpriced subscription model after the free trial period ends.
- junto 13y ago
  Is that better than worse than the Google model?
  - wusatiuk 13y ago
    what do you mean by the google model?
    - junto 13y ago
      You 'pay' through your private emails being scanned, analysed and the advertised to. With Web.de you pay a subscription fee.
      - wusatiuk 13y ago
        yes, you pay a subscription fee, but this does not automatically mean that you are getting scanned. I am hove no problem with subscription fees. I have a problem within companies who try to push they clients into subscription through some kind of free trials which then get automatically converted into yearly contract.
deleted 13y ago
[deleted]

protonormal 13y ago

Call it Stasi-Email

deleted 13y ago
[deleted]
deleted 13y ago
[deleted]

ColinWright 13y ago

I'm having trouble seeing how this will work. They say: > Data are encrypted directly by the provider, ... and they also say: > automatically encrypt data over all transmission paths If it's done by the provider, how does the data get from my machine to their machine to be encrypted?

aw3c2 13y ago
In their eyes your machine is their webmail interface which runs of course in the "cloud".
- ColinWright 13y ago
  No matter how I try to parse that it doesn't seem to make sense, neither as a straight reply, nor as satire/joke/irony. Can you elaborate? Sorry if I'm being thick ...
  - replax 13y ago
    They assume that you write your email on their web interface, to which you connect over https. and when they send your mail to anotjer server, they do so over a ssl encryption. of course, if you use an email application, you can enable/disble ssl/tls if you wish to do so.
    - ColinWright 13y ago
      Ah, so I'd have to use webmail. I guess that makes sense, but it makes it impossible for my use cases. Thanks for the clarification.

Derbasti 13y ago

If this was implemented correctly, it would keep non-German governments from being able to snoop on German emails. If Germany does not snoop on Germans without a warrant, this would actually be a good thing for Germans. If European has data protection laws that prohibit snooping on foreign people without a warrant, this would actually be a good thing for everyone. A lot of ifs that need to be answered. But this could be a good thing.

greenyoda 13y ago
Until the recent revelations about the NSA, we also believed (perhaps naively) that the U.S. had data protection laws that prohibited spying on citizens without a warrant. It may be just a matter of time before we find out that Germany has murky laws and secret courts that disregard fundamental legal principles just like the U.S. does, or that the German intelligence agencies work closely with the NSA. So if I really wanted secure e-mail, the only thing I could really trust at this point would be to encrypt my message on my own machine using a transparent, open source program like PGP. Once you rely on a third party to encrypt your e-mail for you (or even to provide you with encryption software), you're vulnerable to their being strong-armed by a government to give up your data.
- Derbasti 13y ago
  You are right in that this Telekom solution does not allow for truly secure communication. However, it does prevent men in the middle from snooping on your emails, which is a step in the right direction.
- mpyne 13y ago
  > Until the recent revelations about the NSA, we also believed (perhaps naively) that the U.S. had data protection laws that prohibited spying on citizens without a warrant. If people believed that email that a person didn't host themselves was protected, it was only because they were lazy and didn't so much as Google the laws in question. The reason we keep telling you that the NSA behavior is probably legal isn't because we want it to be legal, it's because we want you to stop living in a fantasyland ;). Look at ECPA for instance, it's been around since 1986. CALEA has been around since 1994.

computer 13y ago

> " For security reasons, from the beginning of 2014 the initiative partners will only transport SSL-encrypted e-mails to ensure that data traffic over all of their transmission paths is secure." That's the most significant part of this announcement-- it means there's finally a push to phase out plaintext email transport, which allows passive surveillance to intercept mail.

mikemoka 13y ago
Yes, because there is no reason to believe that the german government has any interest in the active surveillance of digital communications. /* sarcasm */
- computer 13y ago
  I am not saying that this specific service is good for the privacy of their users. I am saying that this move, phasing out non-SSL email, will _force_ the rest of the world to add SSL to outgoing email connections, thereby protecting all email worldwide from passive interception. Right now, I think about 75% of email traffic is encrypted between sender and recipient, so this would protect that remaining 25%. (Percentages _greatly_ dependent on who and where you measure.)
  - mjn 13y ago
    I agree with that view. I think this is largely a bit of opportunist advertising, but also that this specific measure is actually useful. Like with more companies moving towards HTTPS-by-default, it's useful in cutting down the number of places where things can be easily intercepted. Even cutting down the number of places where non-government parties can intercept something is useful, because: 1) that's in itself good for privacy; and 2) non-government parties are a major source of government information, because some of them voluntarily turn over or sell the information to governments, and others end up being forced to hand it over.
- muyuu 13y ago
  It's better to be subject to just your government instead of both your government and the self-proclaimed world police. The US terror machine needs to be avoided at all costs as it's the greatest threat to peace and freedom worldwide.

benzimmer 13y ago

What they claim to do is basically what everybody is already doing. SSL between email servers can be considered standard, as well as SSL or at least StartTLS between client and server. De-Mail is another thing which was introduced some years ago now. In short: Messages are encrypted on the client side, then decrypted on the server, then again encrypted and sent to the recipient where it is decrypted again...Imagine your post-office opening you mail before forwarding it to the recipient. Along with some other things no sane person would ever suggest to do with email, De-Mail is a complete farce... TL;DR: I'm from Germany, and my opinion is that this is the most brutal kind of PR bullshit you can get...

blablabla123 13y ago
Still better than having all your data traffic piped to the NSA. Don't forget that this pipe is behind the SSL-Wall of Google. Being from Germany too, I'm seriously considering to move my mail account from GMail to Web.de. Already started moving my private Docs away from Google. I like Google services and even before Snowden I was aware of the fact that international communication is watched by Secret agency. But really, why do they keep track of everything?

linohh 13y ago

Snake oil. Election day is coming, the conservative idiots in charge want some good press. The german interpretation of e-Mail (de-Mail) is utter bullshit. Encrypted e-Mail that is decrypted multiple times on its way, of course that will prevent the Government from reading my mail. NOT. It seems that there are enough idiots in the world who are willing to reelect that treacherous pile of smelly shit impersonating a federal government at the moment.

junto 13y ago
I don't see what a bunch of corporate entities have to do within election campaign. This is a response the the German publics concern that a foreign government is doing content analysis on emails within Germany. This makes it harder for the spooks down in Ramstein to analyse the traffic flowing between German consumers and German corporations, which is a damn good thing. This spying might also be (mis)used for corporate espionage as well. It isn't going to stop a German police warrant or BND investigation requiring these companies to hand over your emails, and the EU data retention polices are still in place, but it does stop the foreign spooks sticking their noses in where it isn't wanted. DE-MAIL, is as you say, bullshit, but that isn't why this is really about. I know that from my GMX account I can email someone on a Web.de account, and even if the Internet decides to route my email over the Atlantic first or through Frankfurt where I hazard a guess the NSA will be doing they optical splitting, it doesn't matter. If they want to read my emails they have to brute force that or have a copy of the keys. This is a small, but great step forward in my opinion.
- OGC 13y ago
  > I don't see what a bunch of corporate entities have to do within election campaign > I don't see what a bunch of corporate entities have to do within election campaign > I don't see what a bunch of corporate entities have to do within election campaign Read. that. again. Good god.
- darklajid 13y ago
  Maybe I'm missing something, but .. what do you think is _new_ about this 'made in Germany' mails here? Using TLS for smtp (which seems to be what you're referring to for the 'route over the Atlantic' thing)? Using TLS for submission/the client? Every respectable site and certainly every web mail client that isn't utterly broken offers https / TLS already. I see nothing but a stupid media campaign and fishing for scared and clueless end users that read about this in their favorite tabloid. A.k.a. the BILD/Computer BILD target crowd.

northwest 13y ago

It's a trap! https://de.wikipedia.org/wiki/Dagger_Complex https://de.wikipedia.org/wiki/Dagger_Complex

greenyoda 13y ago
Translated from German (via Google Translate), the first paragraph reads: The so-called Dagger Complex ... is a base of military intelligence services of the United States in Darmstadt at the district border to the town of Griesheim. It is located at the south of the former way Eberstädter August Euler airfield. It is believed that the secret services operate in the United States spy here.

andyl 13y ago

It seems to me that NSA is working directly against the interests of American technology companies. Ironic. I think this is going to be remembered as the high-water mark of American Social Media. I grew up in Michigan and well remember the demise of the auto-industry. They had a good thing going, and thought it could never end. People grew complacent. There is no guarantee that American technology business will continue to dominate. Eric Schmidt's "you have no privacy" attitude was both arrogant and short-sighted. We've needlessly shot ourselves in the foot.

jivatmanx 13y ago
There's a big gap between the philosophies of "Everything is public by default" and "Secretly giving all of your private communications to the NSA". The former is utopian, though naive. The latter is just old school tyranny.
- mpyne 13y ago
  And what if the actual truth really is somewhere in that big gap you mentioned? Even PRISM doesn't give all @gmail.com to NSA after all.
  - junto 13y ago
    I think the end goal is exactly that. Sigint is about getting everything.
    - mpyne 13y ago
      Certainly it would be easier, but even NSA doesn't have enough hard drives to store all of GMail, Outlook.com, Skype, etc. Some selectivity is required for them to do analysis, for the same reason we would run "grep foo <star>.cpp" instead of "find / -name '<star>.cpp' -exec grep foo {} \;"
      - derefr 13y ago
        > Certainly it would be easier, but even NSA doesn't have enough hard drives to store all of GMail, Outlook.com, Skype, etc. Actually, that's an interesting point. I don't bother keeping copies of television series I've downloaded and watched laying about on my disk, because I know I can just go and retrieve them from the internet again if-and-when I want to watch them. In effect, I'm using the internet as a large, slow (but reliable!) disk. The parallel being, I don't see why the NSA would bother to build its own datacenters for storing data. Google's, Apple's, Microsoft's, whoever's datacenters, are the NSA's datacenters. They don't have to retain information themselves; they just have to send a FISA notice to these companies telling them to retain the information, indefinitely, until the NSA has need of it.

sentenza 13y ago

Don't use any of these email providers. First up, they are not trustworthy, especially Deutsche Telekom. DT is the privatised former state-owned telco monopolist, with a gigantic share of userbase and partial ownership by the German federal state. Most likely, every intelligence agency, domestic or foreign, that is operating in Germany with sanction of the government will have access to anything on their servers. Also there is Quellen-TKÜ, which means that every single one of the three gives access to their servers to German law enforcement. If I remember correctly, the Quellen-TKÜ law says that any online service provider that has more than X users (10k?) has to provide access to law enforcement in such a way that the provider operators themselves don't know about the individuall access operations.

junto 13y ago
That isn't the point is it? The step forward here is that the comumunications between these providers is now encrypted by default and foreign entities such as the NSA will now have a harder job to do traffic and content analysis on German emails being sent to and from German nationals. I don't have a problem with a German judge in a German court, granting a search warrant with reasonable grounds where all checks and balances are in place. I do have a problem with secret courts with secret laws and gag orders hiding this kind of thing from the public. If foreign intelligence agencies are allegedly granted unhindered access to their servers then I see that as a scandal. Have you got any evidence to back up that claim?
- sentenza 13y ago
  In principle I agree with you and I think you are right considering what the police is allowed to do and what not. As far as I know, a judge still needs to sign a warrant for the police to do anything. However... https://netzpolitik.org/2013/500-millionen-verbindungsdaten-im-monat-bnd-betreibt-vorratsdatenspeicherung-durch-die-hintertur/ https://netzpolitik.org/2013/500-millionen-verbindungsdaten-... I would be really surprised if the BND wasn't using that same access infrastructure (admittedly as supposition on my part). Combined with the story on how the BND protects our data by removing email addresses that end on .de, this again becomes worst case-ish. Now this is only metadata, but at least in the case of email, processing the metadata means having parsed the message. Since the infrastructure is supposed to be set up in such a way that they get it from the server of the provider, encrypting the communication with said provider is kind of useless, at least in regard to the NSA. I'd also like to add that your comment makes an important point. Most people, including me, are quite OK with law enforcement operating under the rule of law within clear boundaries in this realm. But how do we get the intelligence community from hitchhiking on the law enforcement infrastructure?

kriro 13y ago

Telekom has actually been selling their own cloud services with "German privacy laws/not hosted in the US" before the NSA stuff. It was a very noteable point of emphasis for them when selling to small/midsized corporations so I'm not surprised they are all over this. They are a pretty crappy company in general (imo) but they got this right very early. And by got this right I mean that they are using it for marketing/sales. I mean yay SSL but German mail providers tend to be...meh

rdl 13y ago

Are they seriously talking about enforcing TLS on all SMTP? That would break deliverability to a lot of servers, but would be pretty awesome. I assume it wouldn't actually check certs in any meaningful way, though, so only protecting from passive eavesdropping, but it's a big positive step. I'm increasingly tempted to throw that switch myself, or at least start filtering all my non-TLS'd mail into a special mailbox of "figure out if I actually care if these people become unreachable in 6mo when I actually enforce TLS." Arguably it would be worse to accept the message and then bounce it, since you'd have received the text in the clear, but maybe log and send an informative-to-end-user rejection notice based on envelope, and to me?

yrro 13y ago
You would configure your email server to reject the two following cases: Case 1: SMTP client that knows nothing about TLS S: 220 server.example ESMTP Greetings! C: HELO host.example S: 550 TLS only, thanks! Case 2: ESMTP client that knows nothing about TLS S: 220 server.example ESMTP Greetings! C: EHLO host.example S: 250-STARTTLS C: MAIL FROM: user@host.example S: 550 TLS only, thanks! Sadly, a client that refuses to attempt TLS negotiation will always leak the sender address of the message it wants to send you. This happens in many protocols when TLS is bolted on as an afterthought. We're actually worse off using the standardized TLS extension to SMTP here than we are with the non-standardized SSL: a connection to port 465, followed by immediate SSL negotiation won't leak anything to a passive eavesdropper. This only gets you so far however. An active attacker can MITM the connection with ease, since there is no convention for how to verify an SMTP peer's certificate. I don't see this changing until DNSSEC is deployed in every domain you correspond with, and the peer's certificate is somehow authenticated with information from their DNS zone. Aside: for a protocol that is designed even worse than SMTP with regards to leaking information over insecure channels, look at IMAP: S: * OK [CAPABILITY IMAP4rev1 LITERAL+ SASL-IR LOGIN-REFERRALS ID ENABLE IDLE STARTTLS LOGINDISABLED] Dovecot ready. C: 0 login user@example hunter12 S: BAD [ALERT] Plaintext authentication not allowed without SSL/TLS, but your client did it anyway. If anyone was listening, the password was exposed. S: 0 NO [PRIVACYREQUIRED] Plaintext authentication disallowed on non-secure (SSL/TLS) connections. The stupid protocol design results in the client transmitting the user's credentials in plain text as soon as it connects to the server.

mattjaynes 13y ago

Foreign leaders woke up one day to find that the US now has deep spy penetration into their local populace. Oops. Huge national security fail. They haven’t said much publicly, but behind closed doors they're scrambling to figure out how to get their pants back up. This is only the very beginning of a huge shift that most of the US is blind to or in denial about. All around the world, in government offices and in business board rooms, leaders are trying to figure out how to get off the US cloud. The US cloud has been compromised and that trust just isn't coming back. The barrier now is not political will, but a lack of local tech talent that can build viable alternatives to the US cloud services. Many countries are kicking themselves now for not growing/poaching tech talent more aggressively. Interesting times when having good web developers is a big national security asset. You'll see the more tech rich countries move first. It's no surprise Germany's a first mover here. Of course, with any big disruption there will be winners and losers. Who the losers will be is obvious - US cloud companies. Sure, they'll still have the US market (which is huge), but international markets will start drying up. Skeptical? Google is hearing a huge sucking sound of money evaporating from Germany right now. Google's so big, they may not notice a few million yet, but I assure you, they will notice eventually. Karmic justice for short-sightedness in not out-lobbying the big defense contractors in Congress. What's comical is how cheap it would be to out-lobby the defense contractors: http://www.opensecrets.org/industries/indus.php?Ind=D http://www.opensecrets.org/industries/indus.php?Ind=D The top contributing defense contractor (Northrop Grumman) only gave about $3 million last year. I'm sure they paid more than that for actual lobbyists, etc, but it's still not even petty cash at Google. Of course, I don't mean to pick only on Google. There are many multi-multi-billion dollar cloud companies in the US that have been easily out-lobbied by the defense industry. It would have been pennies compared to what they'll ultimately lose in the drying-up international markets. So, who will be the winners? While security companies will see a boon, it's the open source companies that I think will see the biggest win. With open, auditable code, countries can set up their own services. Of course, they'll need support and training and that's where the open source companies really shine. It's important to remember that the goal for these countries will rarely be fool-proof privacy for each individual citizen. Instead, the goal is to prevent a foreign power from having deep intimate access to every detail of your populace. Granted, many of these countries will use this transition to just spy on their own citizens. However, other countries will have a good functioning democracy and a citizenry that values privacy and will avoid those abuses. For those countries that have robust protections and engender international trust, they'll have a big business advantage when it comes to foreign consumers.

tomphoolery 13y ago

"secure" means secure from the US, not from Germany... Doesn't actually mean "secure".

walshemj 13y ago

Next France telecom will announce minitel v2.0 for french "courriel" and the uk will revert to OSI based email using dialcom software - "just don't tell anyone about the Level 7 accounts"

Radle 13y ago

That is why you would use such an E-Mail service: "I don't have a problem with a German judge in a German court, granting a search warrant with reasonable grounds where all checks and balances are in place. I do have a problem with secret courts with secret laws and gag orders hiding this kind of thing from the public." Take it with a little salt anyways, there is always the possibility for American services to get Access on your Data for example if they had an Employee in any of the German companys.

Vivtek 13y ago
... or if they just ask the BND.

guelo 13y ago

I think the best we can hope for the future of the web is that there will be reliable service providers in many different legal jurisdictions so that users can make a political calculation as to which government they can trust with their information. And that transport encryption remains trustable.

Vivtek 13y ago

Well, if Telekom is on the case, the US has nothing to fear.

platzhirsch 13y ago

This is so embarrassing. So they finally implemented STARTSSL? A standard which is how old? 14 years. That is what they are advertising? Looking at the past events it should be clear, that encryption during transmission is not a final solution. Secure transmission is important, hence HTTPS, but due to the past events, using this marketing gag is just grotesque to fool people who cannot differ between these technologies.

lukele 13y ago

One very interesting tidbit - regardless that this is simply some PR stunt at exactly the right time - according to a renowned german news magazine Die Zeit, two of the founders of Narus, which helped develop the PRISM technology, are now working for the Deutsche Telekom. Go figure! Source: http://www.zeit.de/2013/33/nsa-spionage-industrie-profiteure http://www.zeit.de/2013/33/nsa-spionage-industrie-profiteure

realrocker 13y ago

Privacy-Shrivacy Bollocks. Many here do not get the point. US having intimate information of a foreign populace is akin to having an extra weapon in their arsenal. In today's world data is the new gunpowder. If you have insight(I mean really really know) into what a foreign country would buy/sell you can have an upper hand in trade negotiations. This is not some prudish step to prevent Uncle Sam to look into your private details. This is all out cold war. Diplomats across the world are talking about one thing today: Nullifying the U.S advantage. I guess China foresaw it.

a3n 13y ago

As many commenters here say, it isn't inherently more secure than a US-based service. It may be more socially secure, if the warrant system in Germany is more specific than our general system of warrants to spy on everyone foreign or domestic. However, there's a good reason for German citizens to prefer German services: it takes money away from American service. Money is the only voice that will ever fix this. So I ask every non-US citizen: please, take your money elsewhere. Please.

deleted 13y ago

[deleted]

bhrgunatha 13y ago

Der Spiegel reported that Germany collaborated with the US very, very closely and even use XKeyScore. [1] "The Americans provided the BfV with one of their most productive spying tools, a system called "XKeyscore." It's the same surveillance program that the NSA uses to capture a large share of the up to 500 million data sets from Germany, to which it has access each month, according to internal documents seen and reported on by SPIEGEL on the first of this month." How is this anything but propaganda? [1] http://www.spiegel.de/international/world/german-intelligence-worked-closely-with-nsa-on-data-surveillance-a-912355.html http://www.spiegel.de/international/world/german-intelligenc...

kayoone 13y ago

It seems like a noble move but as a german i know these companies pretty well and i am very sure they only do this to stop german users wandering off to non-german email providers like gmail. Its still a good thing of course, but dont think they do this because they feel its the right thing todo. Heck, if they could they would even charge extra for it.

tillk 13y ago

> Data are encrypted directly by the provider, which means customers need no specific technical know-how and incur no extra costs. All data are stored in secure data centers located in Germany. Not sure how this is the solution. People need to learn how to do encryption themselves. For the average John Doe (or Hans Wurst :-)) there need to be tools to accomplish that without a degree in Math or CS. I don't think provider-side encryption is a solution at all. Collecting vast amounts of meta data would still be possible.

axelfreeman 13y ago

They use us-based "cloud" anti virus scanner in this system. They decrypt it for scanning them. It's ridiculous stupid. No end-to-end encryption. Thats all marketing bullshit. Think about it. In the "De-Mail" system are all sender verified. Thats means that i can kick spammer easily out. Why would they decrypt it for scanning? Bingo! Surveillance. But this is just that what i think. I have written an comment on there blog and i'm exited what they say.

virtualritz 13y ago

All you need to know about this. Aka: response of the German Chaos Computer Club (in German): http://www.ccc.de/en/updates/2013/sommermaerchen http://www.ccc.de/en/updates/2013/sommermaerchen

michalu 13y ago

I have both gmail and GMX and to be honest if "the email made in Germany" will be the same as GMX I will gladly offer my data to NSA and stay with gmail. In other words this whole debate about security will pass and 95% of people will forget or become ignorant so unless they create a service people actually want to use this is just a waste of money. From my experience gmx totally don't get it and if you become their user they will eventually piss you off to the point when you will run towards NSA just to use something like gmail.