Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Gmail Will Warn If Message Is Not Authenticated/Encrypted

gmailblog.blogspot.com

Post reply on HN
Print view View original

141–150 of 216 posts

Re: Gmail Will Warn If Message Is Not Authenticated/Encrypted

#141

Post by inopinatus »

jcoffland wrote: post #30

This sounds great but Google has been making it harder and harder to run your own mail server even for personal use. I think they would be happy of email servers were only run by a few large companies. They make it sound like they are doing the right thing but really they are bully the industry to do it their way. So many people have Gmail accounts that you can't run an email server that cannot send email to Google.…

I'm in the same boat as you - running a personal/friends/family mail toaster for 16 years now. But I disagree that Google have made the administration harder. Internet mail servers don't live in isolation, and context has always been changing. I have no issue with adapting configuration as expectations change, so Gmail's evolution has never inhibited my ability to exchange email with the world. This move is no different. Really, I feel that the elephant has been tremendously careful not to tread on the mice.

I don't believe this particular change materially improves security, since it isn't representing an end-to-end behaviour, but if it raises awareness and challenges mass surveillance then so much the better.

Personally I would like them to advocate for other necessary infrastructure advances and include, for non-IPv6-capable MTAs, an icon of a lurching monster that refuses to die.

Re: Gmail Will Warn If Message Is Not Authenticated/Encrypted

#142

Post by middleclick »

keehun wrote: post #67
Diederich wrote: post #58

Earlier quoted context omitted.

+1 for fastmail. I've been using them for the past few years to host my 'other' main e-mail (the one I've had since 1994) and it's been a delight.

+1 for fastmail, here, too. Amazing service, really good communication during rare downtime, contributes heavily to open-source/community, decent prices, can heavily customize filters/etc, and as far as I'm aware, probably the most mainstream email provider that won't give into the NSA.

I like Fastmail (paying customer here) but let's not kid ourselves that they are anymore safe from the NSA or the Five Eyes. That's wishful thinking and is the same argument as if you host your email in Switzerland, it's magically untouchable from mass surveillance.

Re: Gmail Will Warn If Message Is Not Authenticated/Encrypted

#143

Post by vsviridov »

Cool, just spent 20 minutes getting a proper cert from let's encrypt, and setting postfix to opportunistically encrypt outgoing mail.

Used this service to make sure my setup is correct: http://www.checktls.com/index.html

Also, thunderbird apparently does not like Alternate Subject Name for smtp, but with Let's encrypt I can just issue a mail server-specific key.

Re: Gmail Will Warn If Message Is Not Authenticated/Encrypted

#144

Post by qewrffewqwfqew »

techsupporter wrote: post #134
qewrffewqwfqew wrote: post #128

Earlier quoted context omitted.

are you able to mail folks at google/live without going to spam? Genuinely curious.

Yes. I periodically test with various recipients and mail goes through without a hitch. The only difference I might have versus people starting out fresh is that the domains I host are relatively aged. The newest is two years old and the oldest is nineteen. I also made sure that DNS is set up properly, both forward and reverse, and especially for IPv6.

maybe my sin is hosting at linode - for a new recipient at either of the behemoths, I seem to have 50% chance of going to spam. Thanks for your comment.

Re: Gmail Will Warn If Message Is Not Authenticated/Encrypted

#145

Post by Kadin »

elihu wrote: post #81
emergentcypher wrote: post #41

Earlier quoted context omitted.

Now I can just get a free cert and turn on TLS. What's the problem, exactly? Most people are not capable of running their own mail server. The convenience of services like Google, plus the risk of turning your mail box into a spam machine, vastly outweighs the downsides for most people.

> What's the problem, exactly? > Most people are not capable of running their own mail server. I think that is a big part of the problem. It should be relatively straightforward for someone who isn't a full-time email server administrator to setup a mail server correctly, but it's not. At least, it wasn't easy last time I tried it with Postfix and (iirc) Courier on Ubuntu. All the cryptography options are disabled by…

Most ISPs don't allow inbound (or, often, outbound) connections on port 25, so the number of people who can run mail servers at home is pretty limited. I think even Cox stopped allowing it a while ago, and they were among the most lenient of the big ISPs. (Comcast hasn't allowed it for a while.)

That, I think, is why the distribution managers don't make the default configurations a little more friendly/sane; most users aren't interested in installing a MTA to do anything but local delivery or smarthosting, and the people who are, are probably going to tweak the configs to death anyway, so it's not worth spending the time making it run well and securely straight out of the box.

It wouldn't be too hard to build a "mailserver in a box" with (say) Debian + Postfix + LetsEncrypt + BIND that you could stand up in an hour and be reasonably secure (and I'd be kinda surprised if that doesn't exist in some form already), but I don't know how many people would want it who aren't running mailservers already, and have the capability of doing so.

Re: Gmail Will Warn If Message Is Not Authenticated/Encrypted

#146

Post by devinegan »

kbenson wrote: post #26
Animats wrote: post #8

Other mailers should warn about Gmail, with "Your message was scanned for advertising purposes".

What about "Your message was categorized fir Bayesian spam filtering and may have contributed to eventual upstream rules" for all those installations that historically ran SpamAssassin? If you're using Gmail or sending to a gmail address[1], you know what you are in for, and if you don't you should at least know that anything you send to someone else is no longer in your control and you have very little control over…

They don't appear to be scanned for Ads, but talk with the Google Marketing team and they will be able to tell you what domains are sending to your competitors if they use Google Apps.

Re: Gmail Will Warn If Message Is Not Authenticated/Encrypted

#147

Post by Kadin »

magila wrote: post #85
KirinDave wrote: post #76

Earlier quoted context omitted.

> The use of unencrypted or encrypted link to the receiving email provider's MX server doesn't change all that much in terms of who can read the email: it's still sitting in plaintext on the recipient's server (as well as the sender's server), and the group of actors who can sniff traffic on the backbone like that is probably just as easily able to get it from the servers. That's not at all obvious to me. And this so…

A state actor who can sniff traffic can just as easily serve a secret order to the email server operator to compel them to hand over the data. In fact this is already SOP for governments when dealing with communications which are encrypted in-flight but not end-to-end.

Except that's demonstrably not what the NSA was doing; they were sniffing the backbones at the switches, presumably because they didn't want to create any sort of paper trail or get warrants, even secret FISA ones, against particular people.

From Google's perspective, it means they have to be involved, however non-consensually, in the process, rather than having it done to them transparently. So I can see why it's a win for them.

Whether it really matters to Joe Random User is arguable. What Joe User really ought to demand is end-to-end encryption rather than transit encryption, but he's unlikely to do that because key management across multiple devices (and who wants to read their email only on a single device?) is a pain and the companies that would be able to make it less of a pain aren't exactly incentivized to do so.

Re: Gmail Will Warn If Message Is Not Authenticated/Encrypted

#148

Post by dheera »

Kadin wrote: post #145
elihu wrote: post #81

Earlier quoted context omitted.

> What's the problem, exactly? > Most people are not capable of running their own mail server. I think that is a big part of the problem. It should be relatively straightforward for someone who isn't a full-time email server administrator to setup a mail server correctly, but it's not. At least, it wasn't easy last time I tried it with Postfix and (iirc) Courier on Ubuntu. All the cryptography options are disabled by…

Most ISPs don't allow inbound (or, often, outbound) connections on port 25, so the number of people who can run mail servers at home is pretty limited. I think even Cox stopped allowing it a while ago, and they were among the most lenient of the big ISPs. (Comcast hasn't allowed it for a while.) That, I think, is why the distribution managers don't make the default configurations a little more friendly/sane; most use…

So run it on AWS. In general, I think running mail servers off a residential, or even business ISP is very sketchy. E-mail is my primary line of communication for important matters, and I can't afford to have a snowstorm, busted hard drive, orange juice spill, or basement flood take out my mail sever.

Re: Gmail Will Warn If Message Is Not Authenticated/Encrypted

#149

Post by Lunatic666 »

inopinatus wrote: post #141
jcoffland wrote: post #30

This sounds great but Google has been making it harder and harder to run your own mail server even for personal use. I think they would be happy of email servers were only run by a few large companies. They make it sound like they are doing the right thing but really they are bully the industry to do it their way. So many people have Gmail accounts that you can't run an email server that cannot send email to Google.…

I'm in the same boat as you - running a personal/friends/family mail toaster for 16 years now. But I disagree that Google have made the administration harder. Internet mail servers don't live in isolation, and context has always been changing. I have no issue with adapting configuration as expectations change, so Gmail's evolution has never inhibited my ability to exchange email with the world. This move is no differ…

That's not right, I host some email servers for small companies and private people who all have problems with Google accounts although supporting DKIM, SPF and a TLS connection. They block them as bulk mail and in their FAQ the option hosting your own server isn't even listed. Of course contacting them is impossible, so the only way left is creating a ton of fake accounts on gmail and add the addresses to their contacts or ask friends with gmail accounts to add them and mark them as no spam. Google definitely IS the email bully and there's not much you can do about it.

Re: Gmail Will Warn If Message Is Not Authenticated/Encrypted

#150

Post by amichal »

dheera wrote: post #148
Kadin wrote: post #145

Earlier quoted context omitted.

Most ISPs don't allow inbound (or, often, outbound) connections on port 25, so the number of people who can run mail servers at home is pretty limited. I think even Cox stopped allowing it a while ago, and they were among the most lenient of the big ISPs. (Comcast hasn't allowed it for a while.) That, I think, is why the distribution managers don't make the default configurations a little more friendly/sane; most use…

So run it on AWS. In general, I think running mail servers off a residential, or even business ISP is very sketchy. E-mail is my primary line of communication for important matters, and I can't afford to have a snowstorm, busted hard drive, orange juice spill, or basement flood take out my mail sever.

Ec2 blocks/throttles outgoing smtp
Post reply on HN