4 ms·

I think if you're really concerned about the Feds snooping on email, you need to use end-to-end encryption. Any large ISP or portal is going to be a juicy targe

I think if you're really concerned about the Feds snooping on email, you need to use end-to-end encryption. Any large ISP or portal is going to be a juicy target, and since the majority of people don't want to run their own email servers, the only recourse is not to depend on trusting the servers. Even if you managed to convince everyone to leave G-Mail, they'd still congeal back into another 2-3 big services that the NSA can target.

nutjob2 13y ago
If the NSA is targeting you, or you think they're targeting you, then your email provider is the least of your problems.
- dredmorbius 13y ago
  As Bruce Schneier has commented: he's not against targeted surveillance, undertaken with cause and a specific warrant. It's bulk surveillance of everyone, everywhere and at all times, that's a problem. Taking measures which raise the cost of surveillance helps ensure that if they get your data, it's because they really want it. Not just because they can.
- anilgulecha 13y ago
  This standard response misses the nuance of end-to-end encryption: If the default everywhere was EoE encryption, it becomes significantly harder for anyone to target you (for an average value of you)
  - XorNot 13y ago
    Well every second start proposition on HN is "you give us access to your..." So if the default was EoE, it still wouldn't matter.
    - lifeisstillgood 13y ago
      this is really pedantic but why is End To End Encryption shortened as EoE?
      - XorNot 12y ago
        No idea - I was just grabbing some terminology used in the post I was responding to. EtE would make more sense.
  - harlanlewis 13y ago
    Targeted surveillance always gets its man. Global EoE encryption's benefit is making it significantly (and perhaps prohibitively) more expensive to engage in bulk surveillance.
fphhotchips 13y ago
And let's face it, if you run your own email server, it would be a full time job trying to harden it such that the NSA (and others) couldn't get in.
- ds9 13y ago
  I'm pretty sure that would be a wasted effort. Basically, you could be nearly NSA-proof only if you use your own cert and are prepared to shut down the whole thing when the Feds demand private keys. But then it wouldn't be useful for general email: it will get blacklisted by various parties you would want to exchange email with, unless you use a CA. Really the only readily-practical approach for NSA-proofing will be something that's user-friendly in the UI and encrypts end to end. This prevents snooping in transit, but still exposes metadata, and of course there are endpoint attacks.

nutjob2 13y ago

If the NSA is targeting you, or you think they're targeting you, then your email provider is the least of your problems.

dredmorbius 13y ago
As Bruce Schneier has commented: he's not against targeted surveillance, undertaken with cause and a specific warrant. It's bulk surveillance of everyone, everywhere and at all times, that's a problem. Taking measures which raise the cost of surveillance helps ensure that if they get your data, it's because they really want it. Not just because they can.
anilgulecha 13y ago
This standard response misses the nuance of end-to-end encryption: If the default everywhere was EoE encryption, it becomes significantly harder for anyone to target you (for an average value of you)
- XorNot 13y ago
  Well every second start proposition on HN is "you give us access to your..." So if the default was EoE, it still wouldn't matter.
  - lifeisstillgood 13y ago
    this is really pedantic but why is End To End Encryption shortened as EoE?
    - XorNot 12y ago
      No idea - I was just grabbing some terminology used in the post I was responding to. EtE would make more sense.
- harlanlewis 13y ago
  Targeted surveillance always gets its man. Global EoE encryption's benefit is making it significantly (and perhaps prohibitively) more expensive to engage in bulk surveillance.

fphhotchips 13y ago

And let's face it, if you run your own email server, it would be a full time job trying to harden it such that the NSA (and others) couldn't get in.

ds9 13y ago
I'm pretty sure that would be a wasted effort. Basically, you could be nearly NSA-proof only if you use your own cert and are prepared to shut down the whole thing when the Feds demand private keys. But then it wouldn't be useful for general email: it will get blacklisted by various parties you would want to exchange email with, unless you use a CA. Really the only readily-practical approach for NSA-proofing will be something that's user-friendly in the UI and encrypts end to end. This prevents snooping in transit, but still exposes metadata, and of course there are endpoint attacks.