3 ms·
If you want to avoid being in a dragnet, just requiring TLS using policies on your SMTP server is enough. That's what many organizations do already. If you jus
by MichaelGG 12y ago
If you want to avoid being in a dragnet, just requiring TLS using policies on your SMTP server is enough. That's what many organizations do already.
If you just want "encryption" as a checkbox, then just use Gmail with everyone and your data isn't going anywhere outside Google anyways.
I'm wondering who the users are that have threat models that make them concerned about attackers able to compromise, say, Google, but not capable enough of getting fake keys out.
This article in particular says fake keys aren't important because the attacker needs access to the mailbox. Well if they don't have access, you don't need encryption in the first place!
Sure, there's a marginal improvement (ignoring all the downsides of encryption, like forgetting your passphrase means losing all data) but it doesn't seem to be useful for actual targeted users.
- aw3c2 12y agoYou are not seriously suggesting that Gmail is perfectly private, are you? You must have missed how the NSA was tapping between Google's servers. http://www.washingtonpost.com/world/national-security/nsa-infiltrates-links-to-yahoo-google-data-centers-worldwide-snowden-documents-say/2013/10/30/e51d661e-4166-11e3-8b74-d89d714ca4dd_story.html http://www.washingtonpost.com/world/national-security/nsa-in... End to end encryption is safe, mail server to mail server leaves your mail unencrypted on an unknown number of servers. If those are in the US or a similarly crazy country, they are just one letter away from being read.
- MichaelGG 12y agoNo, I'm suggesting that the tradeoffs if PGP are unacceptable for most users, and that using TLS between mail servers (even on private fiber) would be a good way to stop full on collection. The NSA story is a nice addition, but tales of the FBI carnivore system reading all email by connecting at big interexchanges is decades old, yet no one is taking even that part seriously.
- MichaelGG 12y agoNo, I'm suggesting that the tradeoffs if PGP are unacceptable for most users, and that using TLS between mail servers (even on private fiber) would be a good way to stop full on collection. The NSA story is a nice addition, but tales of the FBI carnivore system reading all email by connecting at big interexchanges is decades old, yet no one is taking even that part seriously.