3 ms·
E-mail between secure servers is perfectly secure (and end-to-end encryption only adds content encryption but keeps the amount of metadata generated the same).
by claudius 12y ago
E-mail between secure servers is perfectly secure (and end-to-end encryption only adds content encryption but keeps the amount of metadata generated the same). The problem is that Google’s email servers are not secure; nor are those of any other email provider. Strictly speaking, not even hosting your own dedicated server somewhere will protect you from these issues.
- andreasvc 12y agoUh no it's not perfectly secure because if you don't use e2e encryption you only get opportunistic TLS and you can't control whether your mail will be transported over unencrypted connections. Furthermore, the contents of the email arrives unencrypted at every mail server. So you're basically agreeing with exactly what I said ...
- claudius 12y agoYou get the TLS you configure the servers to use and a server that only does opportunistic TLS is certainly not a “secure” server.
- andreasvc 12y agoA mail server that only talks TLS is not following the SMTP protocol and is not a part of the global system commonly understood with the term e-mail. Maybe it would be a great idea to migrate the whole world to such a configuration, but in practice it wouldn't give me much confidence. If my server A hands something off to B for it to be delivered to C, then I have no control over whether the link between B and C is secured, so e2e is the only way to be sure.