3 ms·

What is problematic with mail ? It's because it's in clear text most of the time and easy to tap with MITM attack? What about an alternate messaging system add

• kintamanimatt 13y ago
  Email is more or less sent in clear text for a significant portion of its journey in most cases. Sender ----> SMTP ---*unencrypted*---> SMTP ----> Recipient I'm leaving out a lot of transport detail for brevity, but that's the essence. Also, email is generally stored unencrypted at rest. Even if you take precautions to secure your own mailbox, the recipient might just have it floating around in plain text in their Gmail account, just waiting for it to be nabbed by whoever can get a court order, or whatever. Also, even if your email is encrypted, the metadata isn't. So you can figure out who is talking to whom, when, and usually from where (by the IP address). Also, there are a lot of headers indicating details about your computer (if you used a fat client rather than webmail), such as the user-agent header which indicates what software you're running (e.g. Thunderbird, version x, on Linux/Windows/OS X for x architecture, etc) which can give clues about how to attack that client with some 0day exploit.
  • welterde 13y ago
    Actually the MTA can use opportunistic TLS to transfer the mail. And in a lot of cases my mail server actually does. So it's only not encrypted in 20% of the time (depending on who you communicate with).
• spyder 13y ago
  As you can see from the news the safer alternatives are getting shut down.
  • mpyne 13y ago
    Well, shutting themselves down since they can't deliver perfectly safe and secure email because the problem is technically impossible. SilentCircle's other services are still up and running, for example, because they can be made secure. Ironic in SilentCircle's case (if you're an HNer) is that PZ noted to the BBC how important his service was because it protects Navy SEALs deployed to areas fighting terrorism where they might otherwise be detected.
• northwest 13y ago
  > What about an alternate messaging system addressIng these issues ? In case he was talking about unencrypted email, it's obvious: -> Only use encrypted email (with an email client). In case he was talking about encrypted email, all the "metadata" is still open (sender/receiver address, time/frequency, message subject). Then you can cross-reference that data with other data to get a more precise picture of the users. -> Only communicate using one of the "darknet" platforms: https://en.wikipedia.org/wiki/Darknet_%28file_sharing%29 https://en.wikipedia.org/wiki/Darknet_%28file_sharing%29
  • johnchristopher 13y ago
    >>-> Only use encrypted email (with an email client). > >In case he was talking about encrypted email, all the "metadata" is still open (sender/receiver address, time/frequency, message subject). Then you can cross-reference that data with other data to get a more precise picture of the users. But this isn't much different from the technological metadata needed to transport snail mail (the sender of an e-mail is usually, unless messing around, known whereas snail mail only has a return address ; the subject field isn't mandatory). Mail encryption ensures the same level of privacy (regarding the 4th) a user of snail mail could expect.
    • ams6110 13y ago
      Snail mail can be sent anonymously though. It can be dropped in a public mailbox with no return address on the envelope and it will be delivered. It's also much more physically difficult to track. Yes the post office does now optically scan mail for sorting and routing, but that doesn't happen until it gets to regional sorting centers, making the precise origin impossible to discern.