7 ms·

"Our e-mail, photos, calendars, address books, messages, and documents are on servers belonging to Google, Apple, Microsoft, Facebook, and so on." That's not a

by rsync 13y ago

"Our e-mail, photos, calendars, address books, messages, and documents are on servers belonging to Google, Apple, Microsoft, Facebook, and so on." That's not a given. Not only is it trivially easy to host your own email, there are a number of very positive side-effects of doing so. For instance, when I email my wife, it's just a local copy operation - no network traffic is generated, and thus nothing can be intercepted by third parties. Further, although I have not done it yet, it appears to be only slightly more technically challenging to provide your own dialtone. In 2013 the Internet traffic I actually do generate is much more secure than the Internet traffic I generated 20 years ago. Now I have a VPN to various endpoints around the globe. That's much better than telnet to tc.umn.edu :) The disconnect here is that he is talking about particular consumer properties (walled gardens) that happen to exist on the Internet. It surprises me, given who the author is.

euphemize 13y ago
> Not only is it trivially easy to host your own email Perhaps for you, but average Joe does not know, nor care how to do this. I've worked with "technical people" who couldn't figure out how to use PGP to encrypt emails, imagine trying to explain to random people what a VPN is. As long as signing up with gmail stays easier than hosting your own email, nobody will ever bother - and this is the danger schneier is talking about.
diminoten 13y ago
Be it Google/Apple/Microsoft/Facebook in a managed solution, AWS/Rackspace in a hosted solution, or Comcast/AT&T/Verizon/Level3/Cogent/SBC in a private solution, you don't control your data at some point in transit. If you want to interact with more than just your wife, you must give up something.
7952 13y ago
The biggest reason for having Gmail is that it is backed up and accessible anywhere. But this is easily replicated in local caches: You can make it accessible anywhere with a smart phone. You can back up by encrypting the data with a public key and sending to a drop box type service; with the private key stored offline. Most web apps could be easily replicated by storing the data in an append only structure with timestamps. The internet then just becomes a messaging system. I think the VPN tunnel approach should be pushed by everyone. Lots of companies could secure most of their communication by creating a few tunnels to key clients. Email would be immediately secure without any PKI.
grecy 13y ago
> That's not a given. I think it's safe to say he was referring to the 99.99% of internet users for which his statement is true. Sure, he's generalizing a tiny bit, but it's basically true.
CodeMage 13y ago
Maybe it's trivially easy to host your own e-mail, but isn't it pretty hard to convince other servers to accept e-mail originating from your host? I haven't been following things closely, but I remember reading about stuff like DKIM and SPF and I seem to recall that you need a static IP for some of the stuff involved. All in all, sounds like a non-trivial hassle and non-trivial cost. On that note, is there a down-to-earth guide to setting up your own e-mail host?
- claudius 13y ago
  You need a static IP, yes, but any VPS will get you one, so that can hardly be an issue. In seven years of hosting my own email I never had issues with delivering mail to other providers. Setting up an SMTP daemon and IMAP/POP3 server is rather easy, the most difficult decision being which SMTPd to choose (I like Postfix, but Exim is Debian’s default and hence supposedly good as well, others like Courier) and then reading the relevant manpages :) If you search for, e.g., "Postfix tutorial", you'll find plenty of reasonably good guides.
  - Theodores 13y ago
    I don't understand why email hosting has to be so difficult. You say it is easy, which it is if you know what you are doing, but it is not really that simple, is it? There is no out of the box solution that just works, even the microsoft effort called exchange is not that. You should be able to configure a mail server with the ease that you can configure a mail client.
    - devicenull 13y ago
      Spam is the reason. Mail servers are easy to set up, it's all the crap you need to do to actually get your mail accepted that's hard.
      - rsync 13y ago
        In 16 years of running my own mail server(s) I have never done anything to "get my mail accepted", other than make sure relaying is turned off, which I think it is by default in just about every implementation since 1998.
kgosser 13y ago
> In 2013 the Internet traffic I actually do generate is much more secure than the Internet traffic I generated 20 years ago. For someone to be successful in 1993 to use the Internet, you had to be knowledgable enough to do the things you're talking about. I'd wager roughly 97%+ of the population is not smart enough, which is why Bruce's statements are in effect true.
ArbitraryLimits 13y ago
Serious question: is there any point until everyone encrypts their email?
- rsync 13y ago
  Yes, I think so - especially for intercompany email and your family. It may interest you to know that not one piece of intercompany email at rsync.net has ever traversed any network. It's all just a local copy operation.[1] So, no encryption, but ... that's not relevant in this case. The same could be true for your family, or small social circles that share an email server. If you use a secure mail client to connect to the server, and all mail on that domain doesn't traverse a network ... that's a win, even without "email encryption".
blazingice 13y ago
It may be trivially easy to host your own email, but in my experience it is nowhere as easy to do your own spam filtering. A few years ago when I ran my own mail server, having only one false negative was a good day. Google can throw teams of people at the problem.

by rsync 13y ago

euphemize 13y ago

> Not only is it trivially easy to host your own email Perhaps for you, but average Joe does not know, nor care how to do this. I've worked with "technical people" who couldn't figure out how to use PGP to encrypt emails, imagine trying to explain to random people what a VPN is. As long as signing up with gmail stays easier than hosting your own email, nobody will ever bother - and this is the danger schneier is talking about.

diminoten 13y ago

Be it Google/Apple/Microsoft/Facebook in a managed solution, AWS/Rackspace in a hosted solution, or Comcast/AT&T/Verizon/Level3/Cogent/SBC in a private solution, you don't control your data at some point in transit. If you want to interact with more than just your wife, you must give up something.

7952 13y ago

The biggest reason for having Gmail is that it is backed up and accessible anywhere. But this is easily replicated in local caches: You can make it accessible anywhere with a smart phone. You can back up by encrypting the data with a public key and sending to a drop box type service; with the private key stored offline. Most web apps could be easily replicated by storing the data in an append only structure with timestamps. The internet then just becomes a messaging system. I think the VPN tunnel approach should be pushed by everyone. Lots of companies could secure most of their communication by creating a few tunnels to key clients. Email would be immediately secure without any PKI.

grecy 13y ago

> That's not a given. I think it's safe to say he was referring to the 99.99% of internet users for which his statement is true. Sure, he's generalizing a tiny bit, but it's basically true.

CodeMage 13y ago

Maybe it's trivially easy to host your own e-mail, but isn't it pretty hard to convince other servers to accept e-mail originating from your host? I haven't been following things closely, but I remember reading about stuff like DKIM and SPF and I seem to recall that you need a static IP for some of the stuff involved. All in all, sounds like a non-trivial hassle and non-trivial cost. On that note, is there a down-to-earth guide to setting up your own e-mail host?

claudius 13y ago
You need a static IP, yes, but any VPS will get you one, so that can hardly be an issue. In seven years of hosting my own email I never had issues with delivering mail to other providers. Setting up an SMTP daemon and IMAP/POP3 server is rather easy, the most difficult decision being which SMTPd to choose (I like Postfix, but Exim is Debian’s default and hence supposedly good as well, others like Courier) and then reading the relevant manpages :) If you search for, e.g., "Postfix tutorial", you'll find plenty of reasonably good guides.
- Theodores 13y ago
  I don't understand why email hosting has to be so difficult. You say it is easy, which it is if you know what you are doing, but it is not really that simple, is it? There is no out of the box solution that just works, even the microsoft effort called exchange is not that. You should be able to configure a mail server with the ease that you can configure a mail client.
  - devicenull 13y ago
    Spam is the reason. Mail servers are easy to set up, it's all the crap you need to do to actually get your mail accepted that's hard.
    - rsync 13y ago
      In 16 years of running my own mail server(s) I have never done anything to "get my mail accepted", other than make sure relaying is turned off, which I think it is by default in just about every implementation since 1998.

kgosser 13y ago

> In 2013 the Internet traffic I actually do generate is much more secure than the Internet traffic I generated 20 years ago. For someone to be successful in 1993 to use the Internet, you had to be knowledgable enough to do the things you're talking about. I'd wager roughly 97%+ of the population is not smart enough, which is why Bruce's statements are in effect true.

ArbitraryLimits 13y ago

Serious question: is there any point until everyone encrypts their email?

rsync 13y ago
Yes, I think so - especially for intercompany email and your family. It may interest you to know that not one piece of intercompany email at rsync.net has ever traversed any network. It's all just a local copy operation.[1] So, no encryption, but ... that's not relevant in this case. The same could be true for your family, or small social circles that share an email server. If you use a secure mail client to connect to the server, and all mail on that domain doesn't traverse a network ... that's a win, even without "email encryption".

blazingice 13y ago

It may be trivially easy to host your own email, but in my experience it is nowhere as easy to do your own spam filtering. A few years ago when I ran my own mail server, having only one false negative was a good day. Google can throw teams of people at the problem.