3 ms·
Even if it's not stored at their end in plaintext it's a security issue that it's emailed in plaintext.
by CiaranMcNulty 12y ago
Even if it's not stored at their end in plaintext it's a security issue that it's emailed in plaintext.
- aunty_helen 12y agoThere was an article on HN in the last week (or so) claiming that both inbound and outbound encryption of email was happening. http://readwrite.com/2014/06/06/google-gmail-encryption-fail-comcast#awesm=~oHUqmuxHLxmbAM http://readwrite.com/2014/06/06/google-gmail-encryption-fail... Correct me if I'm wrong but wouldn't this mean that only the email stored on the recipient's email provider's server was then unencrypted.
- gpvos 12y agoIt happens, but way too little.
- jedbrown 12y agoUnfortunately, STARTTLS is subject to service degradation attacks and it is very common for email servers to use unsigned keys. Simply enabling STARTTLS protects against passive attacks, but until email servers refuse connections that do not create a TLS session with proper certs, email will remain subject to MITM attacks. Meanwhile, this failure mode is a usability problem for email. My experience with notifying companies about insecure email practices has been extremely disappointing, even among those that should know better (like national labs and financial institutions).
- deleted 12y ago[deleted]
- deleted 12y ago[deleted]