Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Gmail Will Warn If Message Is Not Authenticated/Encrypted

gmailblog.blogspot.com

Post reply on HN
Print view View original

131–140 of 216 posts

Re: Gmail Will Warn If Message Is Not Authenticated/Encrypted

#131

Post by fungi »

jms703 wrote: post #86
jcoffland wrote: post #30

This sounds great but Google has been making it harder and harder to run your own mail server even for personal use. I think they would be happy of email servers were only run by a few large companies. They make it sound like they are doing the right thing but really they are bully the industry to do it their way. So many people have Gmail accounts that you can't run an email server that cannot send email to Google.…

> Google has been making it harder and harder to run your own insecure mail server

You can tick every box securing your email server and still get rejected or flagged as spam.

Re: Gmail Will Warn If Message Is Not Authenticated/Encrypted

#132

Post by dcw303 »

There's a lot of things that I question about Google, but forcing their Gmail customers to adopt more secure practices is worthy of praise. They are the biggest free email provider in the world, and they are owning up to a responsibility to ensure their users can work safely.

Those running their own email servers have a similiar responsibility to their own users, even if it's only themselves. You had time to set up the server in the first place, so you have time to make it work with TLS. Now that Let's Encrypt is here there's no excuse to be running an insecure email (or web) server.

Re: Gmail Will Warn If Message Is Not Authenticated/Encrypted

#133

Post by wzdd »

jms703 wrote: post #86
jcoffland wrote: post #30

This sounds great but Google has been making it harder and harder to run your own mail server even for personal use. I think they would be happy of email servers were only run by a few large companies. They make it sound like they are doing the right thing but really they are bully the industry to do it their way. So many people have Gmail accounts that you can't run an email server that cannot send email to Google.…

> Google has been making it harder and harder to run your own insecure mail server

This is not entirely true. Gmail (and other big email providers) blacklist blocks of IP addresses belonging to hosting providers who are perhaps not as proactive as they should be at detecting and removing spammers. If you unwittingly sign up at one of these providers, it doesn't matter how perfect your mail configuration is: anything you send to a gmail address is gonna go to spam. Gmail of course doesn't publish these lists, so the only way to find out about them is to run into one.

I understand gmail's problem, and I don't have a better solution, but it's not just about insecure mail servers.

Re: Gmail Will Warn If Message Is Not Authenticated/Encrypted

#134

Post by techsupporter »

qewrffewqwfqew wrote: post #128
techsupporter wrote: post #96

Earlier quoted context omitted.

If it helps, I recently rebuilt my mail server and changed from FreeBSD+qmail+Courier to Ubuntu+Postfix+Dovecot. In doing so, I used this series from Ars Technica: http://arstechnica.com/information-technology/2014/02/how-to... It shows how to set up SPF, DKIM, TLS, anti-spam filtering, Sieve, certificate-based authentication (I still haven't figured out how to do this with an iPhone), and so on. The only bolt-on it…

are you able to mail folks at google/live without going to spam? Genuinely curious.

Yes. I periodically test with various recipients and mail goes through without a hitch. The only difference I might have versus people starting out fresh is that the domains I host are relatively aged. The newest is two years old and the oldest is nineteen. I also made sure that DNS is set up properly, both forward and reverse, and especially for IPv6.

Re: Gmail Will Warn If Message Is Not Authenticated/Encrypted

#135

Post by zAy0LfpBZLC8mAC »

tantalor wrote: post #126
pera wrote: post #89

Earlier quoted context omitted.

Hi there, I have two questions: first, which CAs will you use? and second, what will you do when a CA gets compromised? Thanks!

This might help: https://support.google.com/mail/answer/21291?hl=en What are the SSL certificate authority requirements? We do not accept self-signed certificates. For a certificate to be valid it needs to chain up to a valid CA, like one in the Mozilla CA list.

That's obviously for mail retrieval, so doesn't apply here.

Re: Gmail Will Warn If Message Is Not Authenticated/Encrypted

#136

Post by zAy0LfpBZLC8mAC »

makomk wrote: post #129
linkregister wrote: post #84

Earlier quoted context omitted.

Long before Let's Encrypt, SMTP transactions with STARTTLS have permitted self-signed and non-root-CA chained certificates. The pervasiveness of self-signed certificates for SMTP servers means that rejecting them would drop large amounts of email. STARTTLS is basically useful for thwarting passive collection of network traffic.

Gmail's new rules on unencrypted e-mail don't support self-signed certificates though - you have to use an offcial CA-issued certificate from one of Google's approved CAs.

What's your source for that?

Re: Gmail Will Warn If Message Is Not Authenticated/Encrypted

#137

Post by kbenson »

necessity wrote: post #55
kbenson wrote: post #26

Earlier quoted context omitted.

What about "Your message was categorized fir Bayesian spam filtering and may have contributed to eventual upstream rules" for all those installations that historically ran SpamAssassin? If you're using Gmail or sending to a gmail address[1], you know what you are in for, and if you don't you should at least know that anything you send to someone else is no longer in your control and you have very little control over…

What alternatives do you suggest, besides running your own mail server? I'm in the invite list for Protonmail and have also used the infamous cock.li for informal stuff, but I was looking for something a bit more established, that I can count on long term stability. It's bad enough to switch email addresses once, to be switching every time a service goes kaput is unacceptable.

What do I suggest in lieu of Gmail or some other large provider that may scan your email? If it really matters to you, your only choice is to run your own mail server. If you don't control your endpoint, then I think no matter what you profess, you don't really care. Personally I just use a combination of Gmail (because I don't care) and a POP/IMAP account at my local ISP (which is not free).

If you want free email, expect to pay in some other way. There's no such thing as a free lunch.

Re: Gmail Will Warn If Message Is Not Authenticated/Encrypted

#138

Post by xrstf »

ams6110 wrote: post #123
elihu wrote: post #81

Earlier quoted context omitted.

> What's the problem, exactly? > Most people are not capable of running their own mail server. I think that is a big part of the problem. It should be relatively straightforward for someone who isn't a full-time email server administrator to setup a mail server correctly, but it's not. At least, it wasn't easy last time I tried it with Postfix and (iirc) Courier on Ubuntu. All the cryptography options are disabled by…

Have a look at opensmtpd. Easiest-to-configure mail server I've ever used. https://www.opensmtpd.org/

I tried it on Ubuntu 14.04, but unfortunately you get only pretty old versions, even via PPA. And no matter what I did, opensmtpd crashed each time it received a mail from localhost to a local receiver.

I'm having high hopes for Ubuntu 16.04 having a more recent version on board. Then I will try to switch from postfix again. Because as you've said, it's really straightforward to set up :)

Re: Gmail Will Warn If Message Is Not Authenticated/Encrypted

#139

Post by zAy0LfpBZLC8mAC »

joshschreuder wrote: post #56
hueving wrote: post #54

Earlier quoted context omitted.

>Now I can just get a free cert and turn on TLS. What's the problem, exactly? Certs weren't free for business use until let's encrypt.

That's kind of the point. They weren't but now are, and now there's even less of an excuse not to have a cert.

I would say the opposite: There is no excuse for cementing the role of CAs for SMTP. DANE doesn't need any CA, and there is no problem with legacy clients that require CA-signed certs.

Re: Gmail Will Warn If Message Is Not Authenticated/Encrypted

#140

Post by bigiain »

hueving wrote: post #54
emergentcypher wrote: post #41

Earlier quoted context omitted.

Now I can just get a free cert and turn on TLS. What's the problem, exactly? Most people are not capable of running their own mail server. The convenience of services like Google, plus the risk of turning your mail box into a spam machine, vastly outweighs the downsides for most people.

>Now I can just get a free cert and turn on TLS. What's the problem, exactly? Certs weren't free for business use until let's encrypt.

It's been a long time since the cost of a cert was an inhibiting factor - at least for 1st world businesses. (I don't suppose I'd want to be paying for a US dollar priced TLS cert in Zambian kwacha or trying to get a petty cash reimbursement for one on a typical IT salary in South Sudan...)
Post reply on HN