3 ms·
I don't see why you would single out Gmail at this point. You're basically rejecting email as a secure medium (I don't disagree).
by andreasvc 12y ago
I don't see why you would single out Gmail at this point. You're basically rejecting email as a secure medium (I don't disagree).
- claudius 12y agoE-mail between secure servers is perfectly secure (and end-to-end encryption only adds content encryption but keeps the amount of metadata generated the same). The problem is that Google’s email servers are not secure; nor are those of any other email provider. Strictly speaking, not even hosting your own dedicated server somewhere will protect you from these issues.
- andreasvc 12y agoUh no it's not perfectly secure because if you don't use e2e encryption you only get opportunistic TLS and you can't control whether your mail will be transported over unencrypted connections. Furthermore, the contents of the email arrives unencrypted at every mail server. So you're basically agreeing with exactly what I said ...
- claudius 12y agoYou get the TLS you configure the servers to use and a server that only does opportunistic TLS is certainly not a “secure” server.
- andreasvc 12y agoA mail server that only talks TLS is not following the SMTP protocol and is not a part of the global system commonly understood with the term e-mail. Maybe it would be a great idea to migrate the whole world to such a configuration, but in practice it wouldn't give me much confidence. If my server A hands something off to B for it to be delivered to C, then I have no control over whether the link between B and C is secured, so e2e is the only way to be sure.
- eps 12y agoNo, it's not about rejecting email as a secure medium. It's about denying Google access to the contents of emails I sent to people with mailboxes on their system.
- andreasvc 12y agoSo why single out GMail? Why not worry about Hotmail, Yahoo? How about $LOCAL_ISP_UNDER_GOVERNMENT_SURVEILANCE?