Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Gmail Will Warn If Message Is Not Authenticated/Encrypted

gmailblog.blogspot.com

Post reply on HN
Print view View original

41–50 of 216 posts

Re: Gmail Will Warn If Message Is Not Authenticated/Encrypted

#41

Post by emergentcypher »

jcoffland wrote: post #30

This sounds great but Google has been making it harder and harder to run your own mail server even for personal use. I think they would be happy of email servers were only run by a few large companies. They make it sound like they are doing the right thing but really they are bully the industry to do it their way. So many people have Gmail accounts that you can't run an email server that cannot send email to Google.…

Now I can just get a free cert and turn on TLS. What's the problem, exactly?

Most people are not capable of running their own mail server. The convenience of services like Google, plus the risk of turning your mail box into a spam machine, vastly outweighs the downsides for most people.

Re: Gmail Will Warn If Message Is Not Authenticated/Encrypted

#42

Post by emergentcypher »

jcoffland wrote: post #30

This sounds great but Google has been making it harder and harder to run your own mail server even for personal use. I think they would be happy of email servers were only run by a few large companies. They make it sound like they are doing the right thing but really they are bully the industry to do it their way. So many people have Gmail accounts that you can't run an email server that cannot send email to Google.…

Now I can just get a free cert and turn on TLS. What's the problem, exactly?

Most people are not capable of running their own mail server. The convenience of services like Google, plus the risk of turning your mail box into a spam machine, vastly outweighs the downsides for most people.

Re: Gmail Will Warn If Message Is Not Authenticated/Encrypted

#44

Post by vonklaus »

wdewind wrote: post #38
jcoffland wrote: post #30

This sounds great but Google has been making it harder and harder to run your own mail server even for personal use. I think they would be happy of email servers were only run by a few large companies. They make it sound like they are doing the right thing but really they are bully the industry to do it their way. So many people have Gmail accounts that you can't run an email server that cannot send email to Google.…

Just to play devil's advocate: the vast majority of (even technical) people have no interest in running a mail server. Who should Google optimize for?

The question is Who does google optimize for?

As a publicly traded company, it optimizes for GOOG. I have nothing against google, but I do think there is not enough skepticism our fear about them eating the whole stack.

* Receive gmail link from friend. * Use Chrome Browser as gateway to internet. * Use DNS to resolve that URL. * Site built on Angular and has new SPDY tags. * Libraries and Fonts served from CDN.

see something unclear at the url.

* use google search to find that link * google analytics beacons on both websites report your traffic.

I am concerned about the temptation for google to get up to something naughty. Luckily, as we now, it is an undisputed fact that our data is 100% safe with google and there are no organizations trying to actively attack their network or intercede. We also know, that compromising an individual (either an employee or a customer of google) is 100% impossible, never has happened, and never conceivably could happen. So it isn't a big deal.

So, is the issue you can't run a mailserver? Maybe. Maybe not.

You can't crawl many valuable sites now, unless you are google bot or a big vendor.

2 (3 if we count microsoft) companies can ban you from competing on mobile.

etc.

The slight losses in some areas to optimize for what google wants are small. In aggregate, they are wildly irresponsible for us to accept and we shoudlnt.

Re: Gmail Will Warn If Message Is Not Authenticated/Encrypted

#45

Post by masterzora »

Sir_Substance wrote: post #31
fwn wrote: post #25

Earlier quoted context omitted.

I never understood this sentiment. I doubt that there is a way to build a webmailer without processing the emails content at some point. And as it is processed anyway; using it to adjust your ads doesn't appear to me as something significant.

>I doubt that there is a way to build a webmailer without processing the emails content at some point. It is disingenuous and/or ignorant to suggest that temporarily loading an email into memory for the purpose of displaying it on the users screen is the same as parsing and catagorising the text and storing the results of the analysis in a database for the purpose of manipulating the user.

> It is disingenuous and/or ignorant to suggest that temporarily loading an email into memory for the purpose of displaying it on the users screen [...]

I may be wrong, but I think they were referring to things like spam detection, malware detection, possibly search indexing, and such rather than just "temporarily loading an into memory for the purpose of displaying it."

Re: Gmail Will Warn If Message Is Not Authenticated/Encrypted

#46

Post by kevincox »

I'm glad that companies are starting to display warnings about insecurity. It used to be that the insecurity was only advertised if something that was supposed to be secure was broken. However not having any security in the first place is often worse. I would like to see this trend continue and start warning everyone about systems that aren't secure.

Re: Gmail Will Warn If Message Is Not Authenticated/Encrypted

#47

Post by gscott »

tantalor wrote: post #37
jcoffland wrote: post #30

This sounds great but Google has been making it harder and harder to run your own mail server even for personal use. I think they would be happy of email servers were only run by a few large companies. They make it sound like they are doing the right thing but really they are bully the industry to do it their way. So many people have Gmail accounts that you can't run an email server that cannot send email to Google.…

> some new technology that Gmail demands > everyone is going to switch, now The article is pretty clear that gmail users can keep emailing others who don't support TLS or authentication; they will just now see an additional icon informing them of that condition. Nobody is being demanded to switch anything. disclaimer: works for Google

For now they will just warn on it. In a few months they will send it to spam. Just wait.

Re: Gmail Will Warn If Message Is Not Authenticated/Encrypted

#48

Post by vonklaus »

joshstrange wrote: post #40
wdewind wrote: post #38

Earlier quoted context omitted.

Just to play devil's advocate: the vast majority of (even technical) people have no interest in running a mail server. Who should Google optimize for?

Couldn't agree more. I run a number of my own services on my own servers but email is not one of them. I don't have the time or energy to keep up with it and it's imperative that I receive all emails sent to me and all my sent emails are received. Google apps does that perfectly for me and I don't have to worry about it. As far as "I take issue with Google making the decision that everyone is going to switch, now and…

To play devil's advocate, why is email shit? It is pretty much a way to send someone a document in the original way Berners Lee defined html which was essentially sgml. I get not letting people mail active scripts, but every large mail provider also makes a browser.

So email is shitty because providers fuck with it at the mailserver level (i think this is the case, and have heard that about providers) as it doesn't seem to be a problem at the view level.

So this is sort of the issue. We couldn't get consensus on this early on, so no one was able to force standardization, now only a few players have the ability to define standards but they all own large scale messaging channels outside of email.

edit: meant to say that browsers obviously view html and css3 is pretty good as well. We could probably standardize this enough to allow people to write emails in this format and embed imagery. We would not allow JS for obvious reasons, but sending cool emails would be fun and we could also add new features. I mean, the web has developed somewhat shittily, but adding a few new features outside of like the 16 original tags would be cool. Not sure what percentage of tags and attributes actually work, but then again, no one is...

Re: Gmail Will Warn If Message Is Not Authenticated/Encrypted

#49

Post by cornholio »

andygambles wrote: post #4
more_corn wrote: post #3

meh. This doesn't seem very interesting. What would be really interesting is gmail support for public key encryption. They're perfectly positioned to roll out a user-friendly key management system.

Yep surprised they haven't rolled one out yet. Ideally placed.

> Yep surprised they haven't rolled one out yet. Ideally placed.

In fact, they will fight tooth and nail against it since their business model relies on having access to the plain text of the message. It's the very reason they are releasing this technology: a user sees a padlock icon that's confusing similar to other "encrypted" mail offerings, for example OpenPGP. For Google, it's essential that end-to-end encryption does not become the norm and that plain text emails are kept inside their walled garden.

That being said, as a form of opportunistic encryption, TLS on the SMTP layer is great and there are really no excuses not to use it in 2016. Google could push it aggressively and add an (user optional) delay against servers that try to deliver email over a plain connection: "472 Try again in 30 sec or use STARTTLS"

Re: Gmail Will Warn If Message Is Not Authenticated/Encrypted

#50

Post by cromwellian »

Sir_Substance wrote: post #31
fwn wrote: post #25

Earlier quoted context omitted.

I never understood this sentiment. I doubt that there is a way to build a webmailer without processing the emails content at some point. And as it is processed anyway; using it to adjust your ads doesn't appear to me as something significant.

>I doubt that there is a way to build a webmailer without processing the emails content at some point. It is disingenuous and/or ignorant to suggest that temporarily loading an email into memory for the purpose of displaying it on the users screen is the same as parsing and catagorising the text and storing the results of the analysis in a database for the purpose of manipulating the user.

How do you run an efficient server-side search without maintaining a parsed index? I have 40,000 emails in my inbox. You want this to be linearly scanned everytime?
Post reply on HN