3 ms·
How can T3mpmail tout its security/privacy and ask"Want to have a private conversation without being snooped on?", when their SSL configuration allows for non-F
by billyhoffman 13y ago
How can T3mpmail tout its security/privacy and ask"Want to have a private conversation without being snooped on?", when their SSL configuration allows for non-Forward Secrecy key exchanges?
In other words, sniff their traffic, and if the server's private key is ever compromised, then all the traffic ever captured can be decrypted.
In a post-Snowden world, starting any email service focused on security and not using DHE or ECDHE is just silly and shows a lack of understanding about your attack vectors.
(SSL Labs report, showing RSA key exchange support and no preference on cipher suites https://www.ssllabs.com/ssltest/analyze.html?d=t3mpmail.com https://www.ssllabs.com/ssltest/analyze.html?d=t3mpmail.com)
- nherment 13y agoIn a post snowden world, thinking email can be secure and talking about client-server encryption shows a lack of understanding in the snowden revelations. Emails will be secure only whith a new protocol different than SMTP. Edit: Sorry my post sounds agressive. It's not the goal. I'm sure you understand the snowden revelation. However I don't think their goal is to provide fully 'secure' email but only quick and anonymous email assuming it is used with a system like Tor of course.