4 ms·

What's wrong with email? It's a 40 year old standard that still works great.

by bitJericho 12y ago

Someone1234 12y ago
It is insecure in so many ways...
- PaulHoule 12y ago
  One thing that amazes me is that I get a huge volume of spam emails that claim to be from financial institutions. I use gmail for two reasons: (i) deliverability to mailing lists I need to be on and (2) other mail programs don't filter that junk out. In 2015 it should be impossible to send a fake email from chase.com
  - bitJericho 12y ago
    If chase.com uses dkim and spf records and if your mail server is properly configured then it is indeed impossible.
    - me1010 12y ago
      and, of course, DMARC -- so rejection policies can be set. PGP FTW! Now if only STEED would be implemented... http://g10code.com/docs/steed-usable-e2ee.pdf http://g10code.com/docs/steed-usable-e2ee.pdf But, unfortunately, even mail from a properly configured mail server on properly protected domain will still end up in gmail users' spam boxes by default. Domain and server rep systems are a bear to work with.
- bitJericho 12y ago
  In what ways? Mail servers can be configured to require only encrypted connections. You can also use GPG to encrypt your messages.
jcrites 12y ago
I believe he's referring to the fact that a lot of email communication is still plaintext: https://www.google.com/transparencyreport/saferemail/ https://www.google.com/transparencyreport/saferemail/ Of the communication that's nominally protected by TLS, a lot of it can probably be trivially broken by an active MITM attack that either (1) prevents a connection from being upgraded to TLS, in which case it typically remains plaintext (see STARTTLS), or (2) establishes the connection under a self-signed certificate, which will suffice since many email systems do not perform certificate path validation.
mauricemir 12y ago
Mm you mean RFC 822 - well thats the down side of internet standards x.400 had a lot of nice security features but the cheap and cheerful SMTP email standards won that war a long time ago. I used to do X.400 and x.500 for a Large Telco back in the Day. It's a trade off between ease of use and cost - and is a tech example of Gresham's Law

What's wrong with email? It's a 40 year old standard that still works great.

Someone1234 12y ago

It is insecure in so many ways...

PaulHoule 12y ago
One thing that amazes me is that I get a huge volume of spam emails that claim to be from financial institutions. I use gmail for two reasons: (i) deliverability to mailing lists I need to be on and (2) other mail programs don't filter that junk out. In 2015 it should be impossible to send a fake email from chase.com
- bitJericho 12y ago
  If chase.com uses dkim and spf records and if your mail server is properly configured then it is indeed impossible.
  - me1010 12y ago
    and, of course, DMARC -- so rejection policies can be set. PGP FTW! Now if only STEED would be implemented... http://g10code.com/docs/steed-usable-e2ee.pdf http://g10code.com/docs/steed-usable-e2ee.pdf But, unfortunately, even mail from a properly configured mail server on properly protected domain will still end up in gmail users' spam boxes by default. Domain and server rep systems are a bear to work with.
bitJericho 12y ago
In what ways? Mail servers can be configured to require only encrypted connections. You can also use GPG to encrypt your messages.

jcrites 12y ago

I believe he's referring to the fact that a lot of email communication is still plaintext: https://www.google.com/transparencyreport/saferemail/ https://www.google.com/transparencyreport/saferemail/ Of the communication that's nominally protected by TLS, a lot of it can probably be trivially broken by an active MITM attack that either (1) prevents a connection from being upgraded to TLS, in which case it typically remains plaintext (see STARTTLS), or (2) establishes the connection under a self-signed certificate, which will suffice since many email systems do not perform certificate path validation.

mauricemir 12y ago

Mm you mean RFC 822 - well thats the down side of internet standards x.400 had a lot of nice security features but the cheap and cheerful SMTP email standards won that war a long time ago. I used to do X.400 and x.500 for a Large Telco back in the Day. It's a trade off between ease of use and cost - and is a tech example of Gresham's Law