Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Gmail Will Warn If Message Is Not Authenticated/Encrypted

gmailblog.blogspot.com

Post reply on HN
Print view View original

161–170 of 216 posts

Re: Gmail Will Warn If Message Is Not Authenticated/Encrypted

#161

Post by jonknee »

inopinatus wrote: post #157
Lunatic666 wrote: post #149

Earlier quoted context omitted.

That's not right, I host some email servers for small companies and private people who all have problems with Google accounts although supporting DKIM, SPF and a TLS connection. They block them as bulk mail and in their FAQ the option hosting your own server isn't even listed. Of course contacting them is impossible, so the only way left is creating a ton of fake accounts on gmail and add the addresses to their conta…

Maybe they have a reputation system in which I've gained a good standing and you haven't. Have you considered that your attempts to game their system have actually been regarded as abuse?

All major email providers do similar things because this is exactly the setup you'd have if you were a spam operation. Email is just something that you shouldn't try and do yourself on a small scale.

Re: Gmail Will Warn If Message Is Not Authenticated/Encrypted

#162

Post by _cudgel »

amichal wrote: post #150
dheera wrote: post #148

Earlier quoted context omitted.

So run it on AWS. In general, I think running mail servers off a residential, or even business ISP is very sketchy. E-mail is my primary line of communication for important matters, and I can't afford to have a snowstorm, busted hard drive, orange juice spill, or basement flood take out my mail sever.

Ec2 blocks/throttles outgoing smtp

EC2 blocks/throttles outgoing SMTP by default.

As with so many things in AWS, it's left up to the customer to inform AWS that a) you're running a mail server, b) what the purpose/use case is and c) request they configure the reverse lookup associated with the elastic IP you've allocated.

Source: I've been running public facing SMTP servers in EC2 for years with no issues.

Re: Gmail Will Warn If Message Is Not Authenticated/Encrypted

#163

Post by brongondwana »

_cudgel wrote: post #162
amichal wrote: post #150

Earlier quoted context omitted.

Ec2 blocks/throttles outgoing smtp

EC2 blocks/throttles outgoing SMTP by default . As with so many things in AWS, it's left up to the customer to inform AWS that a) you're running a mail server, b) what the purpose/use case is and c) request they configure the reverse lookup associated with the elastic IP you've allocated. Source: I've been running public facing SMTP servers in EC2 for years with no issues.

AWS also has an outbound SMTP service you can use:

https://aws.amazon.com/ses/faqs/

Still, unless you're running a server for a lot of people and you have tons of free time, you'll discover that it's more expensive than paying any of a bunch of people to take care of email for you.

Source: I work at FastMail

Re: Gmail Will Warn If Message Is Not Authenticated/Encrypted

#164

Post by brongondwana »

Navarr wrote: post #90
ecthiender wrote: post #53

There are really good, albeit few, alternatives: Fastmail ( https://www.fastmail.com/ ) Tutanota ( https://tutanota.com/ ) Riseup ( https://help.riseup.net/ )

I would be surprised if Fastmail didn't adopt similar policies. These are good-for-the-user policies.

We've played with it in the past - it was on beta for a while - but too much legit email would have been marked as invalid. We're not big enough to force something like this through. Google is :) Good for them. I'm 100% in agreement with them on this work, and we'll definitely be doing something similar.

Re: Gmail Will Warn If Message Is Not Authenticated/Encrypted

#165

Post by wstrange »

KirinDave wrote: post #98
mynameisvlad wrote: post #91

Earlier quoted context omitted.

Well, no, it really isn't. None of that really occurs on a personal server, and local ISPs probably don't do wholesale data storage because that's not their business, but it is Google's.

Well, you have no reliable way to assert your personal mail server is not bugged and observed right now. You're one judge's pen-stroke away from having personal property seized and then it's just a matter of how real your machine's physical security measures are.

Indeed - and playing Devil's Advocate:

Google is likely to have more legal resources to fend off unjust requests to access to your data.

Re: Gmail Will Warn If Message Is Not Authenticated/Encrypted

#166

Post by wstrange »

mynameisvlad wrote: post #114
KirinDave wrote: post #111

Earlier quoted context omitted.

> We all know Google is doing it, though. What, precisely, do we "know" Google/Microsoft/FUDCo is doing? Certainly not willingly collaborating with every quasi-legal search and seizure presented to them.

Do you even know what you originally replied to? Because it's right there. We already know Google stores a great big swath of data about you for various purposes, including advertising. We know that one of the many sources of this data is what is gleamed from scanning emails for advertisements. Don't act like it's not common knowledge.

Yes - it is common knowledge that Google (and others) use email for advertising.

But you (or perhaps upthread) are implying that Google willingly hands over data to government authorities.

The evidence would point to the contrary: Google (and Microsoft I might add) are complying with the law, but are not simply rolling over and handing out whatever is asked of them.

Their ability to fight back against unwarranted requests is probably much better than someone running their own mail server in their basement.

Re: Gmail Will Warn If Message Is Not Authenticated/Encrypted

#167

Post by caf »

lstamour wrote: post #18
finnn wrote: post #9

>If you receive a message that can’t be authenticated, you’ll see a question mark in place of the sender’s profile photo, corporate logo, or avatar. This makes it sound like I (the sender) can set the image displayed if I am using DKIM. Is that the case? Or is it only if I have DKIM and have a Google account with that email?

Gmail uses an associated Google+ profile for authenticated emails, so you need both for it to work going forward, I presume. To get started, check https://www.google.com/business/ Outlook uses Facebook and Twitter, if you have these contacts integrated. Yahoo does this too: http://techcrunch.com/2015/03/04/smart-contact-cards-arrive-... There really should be some kind of standard or mail header though. :) Come to th…

You could have your client look up the sender at gravatar?

Re: Gmail Will Warn If Message Is Not Authenticated/Encrypted

#168

Post by jcrites »

jcranmer wrote: post #154
skybrian wrote: post #74

Earlier quoted context omitted.

You're arguing that we shouldn't do anything, instead of taking a step in the right direction. Email is an old ecosystem, so it's not possible to make big improvements all at once.

I'm not arguing that we shouldn't do anything. I'm arguing that the presentation of the data is at best meaningless and at worst downright harmful. DKIM authentication is in no way an attestation that it was sent by its sender. Furthermore, from what I can tell, more damage is caused by spoofing that works on the "I use a very similar name which is hard to see the difference" level (e.g., animenewsnetwork.com versus…

> I'm not arguing that we shouldn't do anything. I'm arguing that the presentation of the data is at best meaningless and at worst downright harmful.

What do you think should be done to make progress that's better than Google's proposal? Personally I think encouraging all senders to adopt DKIM, transport layer TLS, DMARC, SPF, etc. by displaying auth results from those protocols in the UI is a good first step. It's similar to the push for HTTPS on the web.

> DKIM authentication is in no way an attestation that it was sent by its sender.

Google didn't mention DKIM in the blog post we're discussing. Are you referring to a related effort? The blog post was about encryption in transit with TLS.

> I'm arguing that the presentation of the data is at best meaningless and at worst downright harmful.

Google's DKIM solution is as close as one can reasonably get given modern technology. If I send a DKIM-signed email from example.com that passes validation, then it means the following is true: I sent an email through a server managed by the domain owner, that had access to the DKIM key and chose to sign my email. It's not authenticating a person, but it's authenticating that the domain's mail servers sent the message. The attestation is at the domain level, not the sender level. This attestation is still useful though: if the domain owner did not want to allow you to send email from jcranmer@example.com, then it would not accept that email from you or DKIM sign it.

Re: Gmail Will Warn If Message Is Not Authenticated/Encrypted

#169

Post by technion »

makomk wrote: post #129
linkregister wrote: post #84

Earlier quoted context omitted.

Long before Let's Encrypt, SMTP transactions with STARTTLS have permitted self-signed and non-root-CA chained certificates. The pervasiveness of self-signed certificates for SMTP servers means that rejecting them would drop large amounts of email. STARTTLS is basically useful for thwarting passive collection of network traffic.

Gmail's new rules on unencrypted e-mail don't support self-signed certificates though - you have to use an offcial CA-issued certificate from one of Google's approved CAs.

That doesn't bring a lot of extra security though, because there's no name verification. I can get a valid letsencrypt cert on anyrandomdomain.com, and if I can hijack your MX and point at it, it's "valid".

Re: Gmail Will Warn If Message Is Not Authenticated/Encrypted

#170

Post by ecthiender »

linkregister wrote: post #94
keehun wrote: post #67

Earlier quoted context omitted.

+1 for fastmail, here, too. Amazing service, really good communication during rare downtime, contributes heavily to open-source/community, decent prices, can heavily customize filters/etc, and as far as I'm aware, probably the most mainstream email provider that won't give into the NSA.

I'm sure that Australian Federal Police and Victoria law enforcement would be able to exercise search warrants on Fastmail's servers if they needed to. Since you're in Tennessee (and thus a U.S. Person), you're actually ineligible for collection under FAA 702. Gmail/Hotmail/Yahoo, etc. would actually be the safest place for your information. Of course that assumes that you believe the NSA follows U.S. law. If you don…

Checkout Riseup from my above comment. They release warrant canaries regularly.
Post reply on HN