For anyone wishing to run their own mail server, check out Mail-in-a-Box[0]. It's relatively easy to set up, comes with a nice Web GUI and they recently added support for automatic provisioning of TLS certificates with Let's Encrypt.
Gmail Will Warn If Message Is Not Authenticated/Encrypted
121–130 of 216 posts
Re: Gmail Will Warn If Message Is Not Authenticated/Encrypted
#122Earlier quoted context omitted.
> some new technology that Gmail demands > everyone is going to switch, now The article is pretty clear that gmail users can keep emailing others who don't support TLS or authentication; they will just now see an additional icon informing them of that condition. Nobody is being demanded to switch anything. disclaimer: works for Google
For now they will just warn on it. In a few months they will send it to spam. Just wait.
> For now they will just warn on it. In a few months they will send it to spam
As a recipient of all kinds of mail, I'm okay with that. I'd rather not see that unencrypted email than have it QUANTUM INSERT'd or whatever the Chinese equivalent is.
Re: Gmail Will Warn If Message Is Not Authenticated/Encrypted
#123Earlier quoted context omitted.
Now I can just get a free cert and turn on TLS. What's the problem, exactly? Most people are not capable of running their own mail server. The convenience of services like Google, plus the risk of turning your mail box into a spam machine, vastly outweighs the downsides for most people.
> What's the problem, exactly? > Most people are not capable of running their own mail server. I think that is a big part of the problem. It should be relatively straightforward for someone who isn't a full-time email server administrator to setup a mail server correctly, but it's not. At least, it wasn't easy last time I tried it with Postfix and (iirc) Courier on Ubuntu. All the cryptography options are disabled by…
Have a look at opensmtpd. Easiest-to-configure mail server I've ever used.
Re: Gmail Will Warn If Message Is Not Authenticated/Encrypted
#124Earlier quoted context omitted.
> Which is different from any other email provider in any substantial way (including your local ISP or personal server) because... Single point of failure. Government entities have to go through physical work to seize multiple mail servers distributed geographically. This keeps the cost of fishing expeditions high enough that they won't just do it by default. With everything at Gmail, Yahoo, and Microsoft, you only n…
> Single point of failure. Okay? > Government entities have to go through physical work to seize multiple mail servers distributed geographically. This keeps the cost of fishing expeditions high enough that they won't just do it by default. Except they seem pretty seize-happy and the only thing protecting your house is the say-so of a judge. > With everything at Gmail, Yahoo, and Microsoft, you only need to serve 3 e…
> Except they seem pretty seize-happy and the only thing protecting your house is the say-so of a judge.
You're being obtuse. Even if every judge rolls over, if you have to seize multiple email servers in multiple jurisdictions, the paperwork represents expense and time that law enforcement simply will not do unless they have a really strong reason. "People are lazy" is the universal constant. We fear computerization of things precisely because computers aren't lazy.
> That seems quite unfair, as at least 2 have been very public about their expenditures to try and make such attacks impossible in the future, and have vocally fought subpoenas.
That's what they say publicly. However, if they roll over for governments like China, they're going to roll over for the US who can genuinely affect their revenue stream.
> The lawsuit should I discover it would probably make me richer and more famous than all the buyout events I've experienced.
Your naivete is touching. Google wouldn't do anything actionable. They scan your email store and know not to invest. You'll never prove anything for a passive non-action like this.
Even for positive action failures, it's very difficult to prove. This is the whole point of "parallel construction". You dragnet to find something incriminating, and then build the legal path to what you now know to search for.
Re: Gmail Will Warn If Message Is Not Authenticated/Encrypted
#125Earlier quoted context omitted.
Which is different from any other email provider in any substantial way (including your local ISP or personal server) because... they have a reasonable hope for reliable storage? Seriously: this is calling out Google in a way that's comical since it's equally applicable to your own computer.
You can use full disk encryption on your own server. Not every country has laws that force you to forfeit your crypto passwords
> You can use full disk encryption on your own server. Not every country has laws that force you to forfeit your crypto passwords
It won't count for anything if the emails your server is sending/receiving are not encrypted, which exactly is what Google is advocating. I don't understand GP's smug rejoinder, as if encrypting emails in transit is a bad thing.
Re: Gmail Will Warn If Message Is Not Authenticated/Encrypted
#126Earlier quoted context omitted.
> some new technology that Gmail demands > everyone is going to switch, now The article is pretty clear that gmail users can keep emailing others who don't support TLS or authentication; they will just now see an additional icon informing them of that condition. Nobody is being demanded to switch anything. disclaimer: works for Google
Hi there, I have two questions: first, which CAs will you use? and second, what will you do when a CA gets compromised? Thanks!
This might help:
https://support.google.com/mail/answer/21291?hl=en
What are the SSL certificate authority requirements?
We do not accept self-signed certificates. For a certificate to be valid it needs to chain up to a valid CA, like one in the Mozilla CA list.
Re: Gmail Will Warn If Message Is Not Authenticated/Encrypted
#127I wish someone made a better (non-SMTP) messaging standard which is secure, efficient, easier to understand/implement and without a clutter of all legacy stuff (and hopefully with a decent reference implementation!). Spams would still remain, but at least that would free us from worrying about the transportation layer security. (But then we might need to reinvent something like DNS on the way, so maybe that's why that no one is trying this.)
Re: Gmail Will Warn If Message Is Not Authenticated/Encrypted
#128Earlier quoted context omitted.
> What's the problem, exactly? > Most people are not capable of running their own mail server. I think that is a big part of the problem. It should be relatively straightforward for someone who isn't a full-time email server administrator to setup a mail server correctly, but it's not. At least, it wasn't easy last time I tried it with Postfix and (iirc) Courier on Ubuntu. All the cryptography options are disabled by…
If it helps, I recently rebuilt my mail server and changed from FreeBSD+qmail+Courier to Ubuntu+Postfix+Dovecot. In doing so, I used this series from Ars Technica: http://arstechnica.com/information-technology/2014/02/how-to... It shows how to set up SPF, DKIM, TLS, anti-spam filtering, Sieve, certificate-based authentication (I still haven't figured out how to do this with an iPhone), and so on. The only bolt-on it…
are you able to mail folks at google/live without going to spam? Genuinely curious.
Re: Gmail Will Warn If Message Is Not Authenticated/Encrypted
#129Earlier quoted context omitted.
>Now I can just get a free cert and turn on TLS. What's the problem, exactly? Certs weren't free for business use until let's encrypt.
Long before Let's Encrypt, SMTP transactions with STARTTLS have permitted self-signed and non-root-CA chained certificates. The pervasiveness of self-signed certificates for SMTP servers means that rejecting them would drop large amounts of email. STARTTLS is basically useful for thwarting passive collection of network traffic.
Gmail's new rules on unencrypted e-mail don't support self-signed certificates though - you have to use an offcial CA-issued certificate from one of Google's approved CAs.
Re: Gmail Will Warn If Message Is Not Authenticated/Encrypted
#130Earlier quoted context omitted.
The question is Who does google optimize for? As a publicly traded company, it optimizes for GOOG. I have nothing against google, but I do think there is not enough skepticism our fear about them eating the whole stack. * Receive gmail link from friend. * Use Chrome Browser as gateway to internet. * Use DNS to resolve that URL. * Site built on Angular and has new SPDY tags. * Libraries and Fonts served from CDN. see…
> As a publicly traded company, it optimizes for GOOG. False. The voting stock are not traded, so the founders still have irrevocable rights to do whatever they please.
I meant that the company does what is in its own best interest. It does publicly trade stock with voting rights as GOOGL which has a 1:1 share to vote. It does not allow the class B stock to trade publicly which is 1:10.
I meant, and you correctly pointed out was not clear or a particularly good way to verbalize, that google like most companies does what is best for itself. In googles case this is a combination of maximizing shareholder value and the vision various thoughtleaders in the company have.
I do not believe google is evil or bad.
I used to believe this.
I now believe that google is doing a lot of great things. However by achieving horizontal success in almost every area of such a powerful concept, it effects how the landscape develops and does cause many issues.
Even if we accept google is mostly good, and I mostly do, it is concerning. I hope that their voluntary meta structure will allow them to distribute fault tolerance and limit power consolidation.