71–80 of 216 posts
In my opinion, you should just behave like your emails are public record. This is the best way of approaching that technology.
Securing email end-to-end is a solid step in the right direction towards making it work better for end-users.
Earlier quoted context omitted.
Just to play devil's advocate: the vast majority of (even technical) people have no interest in running a mail server. Who should Google optimize for?
The question is Who does google optimize for? As a publicly traded company, it optimizes for GOOG. I have nothing against google, but I do think there is not enough skepticism our fear about them eating the whole stack. * Receive gmail link from friend. * Use Chrome Browser as gateway to internet. * Use DNS to resolve that URL. * Site built on Angular and has new SPDY tags. * Libraries and Fonts served from CDN. see…
False. The voting stock are not traded, so the founders still have irrevocable rights to do whatever they please.
Earlier quoted context omitted.
And by ideally placed, you mean for the NSA, right? I'd never put any GPG keys of mine in an American cloud provider. That sort of voids the entire point of it.
Why do you believe non-American cloud providers aren't compromised?
Unfortunately, this is the sort of a change that's a red herring for any actual improvements to email security. The use of unencrypted or encrypted link to the receiving email provider's MX server doesn't change all that much in terms of who can read the email: it's still sitting in plaintext on the recipient's server (as well as the sender's server), and the group of actors who can sniff traffic on the backbone like…
Support PGP already!
Unfortunately, this is the sort of a change that's a red herring for any actual improvements to email security. The use of unencrypted or encrypted link to the receiving email provider's MX server doesn't change all that much in terms of who can read the email: it's still sitting in plaintext on the recipient's server (as well as the sender's server), and the group of actors who can sniff traffic on the backbone like…
That's not at all obvious to me. And this sort of backbone sniffing is exactly what we've seen state actors do. What possible downside could rewarding link integrity have on the story for user privacy? A false sense of security? Quite the opposite: that's what we already got in spades.
Earlier quoted context omitted.
> some new technology that Gmail demands > everyone is going to switch, now The article is pretty clear that gmail users can keep emailing others who don't support TLS or authentication; they will just now see an additional icon informing them of that condition. Nobody is being demanded to switch anything. disclaimer: works for Google
For now they will just warn on it. In a few months they will send it to spam. Just wait.
How many months is a "few"?
Other mailers should warn about Gmail, with "Your message was scanned for advertising purposes".
More worrisome, "Your message has been added to your permanent record at wholesale data storage and may be used against you, in perpetuity, by current and/or future regimes, partner corporations and other select criminal organizations (tax-funded or independent) for reasons including but not limited to financial or political gain, manipulation, incrimination, assassination and personal entertainment."
Seriously: this is calling out Google in a way that's comical since it's equally applicable to your own computer.
I like this idea but worry novices won't understand what a red flag (lock) really means and only assume the worst.
It's part of a general trend of moving the needle from "Internet services are insecure and if you really want to send something secure, you should be sure your channel is encrypted" to "These channels should always be secure; if they're not, here's a big red flag to warn you that they are not."
See also the process of bypassing the "This site is insecure" alarm interstitials in Chrome and Firefox these days for sites with bad secure TLS credentials. The frog has been boiling from "We warn the user with a tiny icon they'll probably ignore" to "Users have to know secret words or convoluted config flows to bypass this inescapable error panel."
This sounds great but Google has been making it harder and harder to run your own mail server even for personal use. I think they would be happy of email servers were only run by a few large companies. They make it sound like they are doing the right thing but really they are bully the industry to do it their way. So many people have Gmail accounts that you can't run an email server that cannot send email to Google.…
Without SPF/DKIM you can't be authenticated. Google is showing the user that they cannot verify the sender.
Without TLS email is sent in the clear. Google is showing the user that sensitive information will be visible when sent over the network.
You can run your server fine without this, but users will be warned that you're not following best practices.
It is not Gmail's fault that you're late to best practices.