Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

I don't think Google delivers over TLS (it doesn't to my server anyway), so in general your mail is subject to wiretapping anyway. And even if it did there's no way protocol I know (maybe DKIM has a section for destination verification?) for them to know that they're really delivering it to the right host.

Basically unencrypted email is a lost cause already. If you care about this stuff you need to dump webmail right now and go with a client encryption solution (and convince all your friends to use it).



I'm seeing TLS connections with google, both inbound and outbound:

  Anonymous: TLSv1 with cipher RC4-SHA (128/128 bits)
   209.85.214.42    mail-bk0-f42.google.com
   209.85.160.42    mail-pb0-f42.google.com
   209.85.213.170   mail-yx0-f170.google.com
   209.85.214.198   mail-ob0-f198.google.com


That's good to know. Maybe I have my postfix misconfigured, I'll check. Still, the MitM hole is present. Without destination host verification, the FBI could simply sit outbound on the network insert themselves into the transaction.


Agreed.

Something else is weird; I see both trusted and untrusted outgoing SMTP TLS connections in the logfiles, including untrusted connections to machines that I know have valid startssl certs. Maybe I have my postfix misconfigured as well!


Gmail is https by default.


That's between your browser and their server. I'm referring to the content of the SMTP connection over which the mail travels, which remains almost always unencrypted in the modern world. Which essentially means that the FBI doesn't need Google's assistance to wiretap your email per se, they just use and machine they probably have sitting on the backbone pipe anyway.


POP, IMAP, and SMTP access to Gmail servers all require TLS. https://support.google.com/mail/bin/answer.py?hl=en&answ... and https://support.google.com/mail/bin/answer.py?hl=en&answ...

Edit: oh you mean from e.g. comcast.com server to mail.google.com server. Never mind.


And again, that's between the client and the server. The path between Gmail's mail server and the sender/recipient of the mail's server is not always encrypted.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: