Gmail Will Warn If Message Is Not Authenticated/Encrypted • Hacker News Board

Re: Gmail Will Warn If Message Is Not Authenticated/Encrypted

#201

Post by Navarr » Wed, Feb 10, 2016, 3:22 PM UTC

brongondwana wrote: post #164

Navarr wrote: post #90

Earlier quoted context omitted.

I would be surprised if Fastmail didn't adopt similar policies. These are good-for-the-user policies.

We've played with it in the past - it was on beta for a while - but too much legit email would have been marked as invalid. We're not big enough to force something like this through. Google is :) Good for them. I'm 100% in agreement with them on this work, and we'll definitely be doing something similar.

Google's not particularly marking them invalid though?

The not-being-authenticated indicator is just replacing any avatar with a question mark ("we're not sure this person is this person") and a tiny indicator that warns you that outgoing mail is sent in the clear.

As long as you're not sending mails to spam for this (which Google doesn't seem to be doing, unless of course a DMARC policy tells them to - I imagine) then I don't see the issue?

Re: Gmail Will Warn If Message Is Not Authenticated/Encrypted

#202

Post by kbenson » Wed, Feb 10, 2016, 3:24 PM UTC

necessity wrote: post #183

kbenson wrote: post #137

Earlier quoted context omitted.

What do I suggest in lieu of Gmail or some other large provider that may scan your email? If it really matters to you, your only choice is to run your own mail server. If you don't control your endpoint, then I think no matter what you profess, you don't really care. Personally I just use a combination of Gmail (because I don't care) and a POP/IMAP account at my local ISP (which is not free). If you want free email,…

Obviously every third-party service is trusted, that doesn't mean one "doesn't care". By your logic even a private mail server isn't enough, you'd have to use PGP. If you don't have any recommendations just say so.

> Obviously every third-party service is trusted, that doesn't mean one "doesn't care".

No, I'm serious about this. I wasn't trying to be flippant. If you care enough about the integrity of your email content and it not being used to further a company's profit, the only way to be sure of that, to the extent that you can (which may not be much), is to run your own mail server. If that seems like it's way too much trouble, I think a you should take a close look at your motives for wanting a gmail alternative. Is it about the integrity of your email, or sticking it to Google? If it's avoiding Google because they specifically cause you concern, that's fine, and there likely plenty of choices, but I'm not sure what they are (as I said, I just use Gmail because I don't care).

> By your logic even a private mail server isn't enough, you'd have to use PGP.

Well, by my logic you have to do enough to make yourself comfortable. Depending on your reasons for avoiding some other companies that will be different things.

> If you don't have any recommendations just say so.

I don't have any recommendations for Gmail if you consider a good UI, responsively web based, and free as major components of that. If you are willing to give up one or more of those, there are options. The local ISP I mentioned is Sonic.net. By all accounts (including mine, I've worked there multiple times in the past), a great company, and with great EFF ratings. An email account there is not free though.

Re: Gmail Will Warn If Message Is Not Authenticated/Encrypted

#203

Post by jonknee » Wed, Feb 10, 2016, 4:06 PM UTC

jacquesm wrote: post #189

jonknee wrote: post #161

Earlier quoted context omitted.

All major email providers do similar things because this is exactly the setup you'd have if you were a spam operation. Email is just something that you shouldn't try and do yourself on a small scale.

How long before 'The world wide web is just something that you shouldn't try and do yourself on a small scale.'. Really that's bothers me greatly. Email is the example of a successful open protocol and by all means you should try and do it yourself. The less we are reliant on these giant companies the better and to abdicate email to google just because they've achieved critical mass is to wipe 25 years of internet hi…

There's not a good way to make running your own email server both easy for you and not easy for spammers. It's a shame, but that's how it is.

Re: Gmail Will Warn If Message Is Not Authenticated/Encrypted

#204

Post by talideon » Wed, Feb 10, 2016, 4:24 PM UTC

Bino wrote: post #186

Good initiative. Question is; what does the TLS icon indicate; is it just opportunistic TLS, or do they do any verification? What, if so? Some private consortium where only members can get a "green lock"? What's the next step? Do they have DANE https://en.wikipedia.org/wiki/DNS-based_Authentication_of_Na... in mind, or some other initiative to get verified encryption such as "TES" https://openbit.eu/projekte/trusted-…

DANE comes with its own complications: it means you need DNSSEC, and that's a bit of a pain to set up at the best of times, especially with there being no way to currently automating DS/DNSKEY record updates to maintain the trust chain.

There have been some mutterings in the IETF ProvReg WG on ways of allowing registrants some ability to automate the process, but it's still early days.

Re: Gmail Will Warn If Message Is Not Authenticated/Encrypted

#205

Post by rphlx » Wed, Feb 10, 2016, 4:59 PM UTC

jcoffland wrote: post #30

This sounds great but Google has been making it harder and harder to run your own mail server even for personal use. I think they would be happy of email servers were only run by a few large companies. They make it sound like they are doing the right thing but really they are bully the industry to do it their way. So many people have Gmail accounts that you can't run an email server that cannot send email to Google.…

Well, it would be much worse if they refused to implement those enhancements, or tried to force proprietary or gmail-specific alternatives.

They pretty much had to do something to improve e-mail's abysmal confidentiality and authenticity, and at least they used open technologies which can be configured on a Debian VPS in a couple of hours using a HOWTO.

Re: Gmail Will Warn If Message Is Not Authenticated/Encrypted

#206

Post by KirinDave » Wed, Feb 10, 2016, 6:26 PM UTC

bsder wrote: post #124

KirinDave wrote: post #108

Earlier quoted context omitted.

> Single point of failure. Okay? > Government entities have to go through physical work to seize multiple mail servers distributed geographically. This keeps the cost of fishing expeditions high enough that they won't just do it by default. Except they seem pretty seize-happy and the only thing protecting your house is the say-so of a judge. > With everything at Gmail, Yahoo, and Microsoft, you only need to serve 3 e…

> Except they seem pretty seize-happy and the only thing protecting your house is the say-so of a judge. You're being obtuse. Even if every judge rolls over, if you have to seize multiple email servers in multiple jurisdictions, the paperwork represents expense and time that law enforcement simply will not do unless they have a really strong reason. "People are lazy" is the universal constant. We fear computerization…

So. Let's just put this in perspective.

Your trivial additional inconvenience running what sounds like a non-trivial geographically dispersed non-cloud-service email system warrants not calling out services with poor mail transit security. So millions of customers improved security vs you figuring out how to use LetsEncrypt. Because Google subsidizes the free service with ads.

I do not follow this logic, but what's more:

> Google wouldn't do anything actionable. They scan your email store and know not to invest. You'll never prove anything for a passive non-action like this."

Yeah well having sold a few companies to a few mega-nationals, we try to be honest and deserve the acquisition, as opposed to trying to fleece people. Lame-duck acquisitions shit on employees for investor gain, often for investment clawback and exit.

But also, if you are a paying edu or org customer, they stop scanning for and serving ads.

So forgive me if I don't feel a ton of empathy towards your strong desire to be dishonest in a hypothetical google acquisition where they hypothetically do this.

Re: Gmail Will Warn If Message Is Not Authenticated/Encrypted

#207

Post by _cudgel » Wed, Feb 10, 2016, 8:53 PM UTC

brongondwana wrote: post #163

_cudgel wrote: post #162

Earlier quoted context omitted.

EC2 blocks/throttles outgoing SMTP by default . As with so many things in AWS, it's left up to the customer to inform AWS that a) you're running a mail server, b) what the purpose/use case is and c) request they configure the reverse lookup associated with the elastic IP you've allocated. Source: I've been running public facing SMTP servers in EC2 for years with no issues.

AWS also has an outbound SMTP service you can use: https://aws.amazon.com/ses/faqs/ Still, unless you're running a server for a lot of people and you have tons of free time, you'll discover that it's more expensive than paying any of a bunch of people to take care of email for you. Source: I work at FastMail

You're absolutely correct. The cost of my AWS deployment in service of my personal email, and less than 5 other people comes in at ~$5.06/mo. The time, however, is the real cost. If/when I gain significant users, Fastmail would be at the top of my list of companies to consider.

Re: Gmail Will Warn If Message Is Not Authenticated/Encrypted

#208

Post by ksk » Thu, Feb 11, 2016, 12:50 AM UTC

lern_too_spel wrote: post #61

ksk wrote: post #43

Its great that Google wants all the lines carrying data from their servers to be secure and tamper proof. It would be interesting to see if they ever support end to end encryption which would lock them out of scanning the data as well.

Then how would searching your mail work? That breaks the product on a fundamental level and makes it worse than all competing products for all but a few users with specific needs. The existing end-to-end browser extension is a reasonable compromise.

It would work in the same way as opening any encrypted mailbox works. Your password is used as the key to decrypt your mailbox when you login. The same key could also be used to search the email.

Right now they're already telling you that they scan every email. So yeah, you would have to trust them that they do in-fact discard they keys and don't allow decryption in other scenarios. But large companies with tons of cash to lose if they're sued, will rarely blatantly lie about what they're doing.

Re: Gmail Will Warn If Message Is Not Authenticated/Encrypted

#209

Post by devinegan » Thu, Feb 11, 2016, 2:36 AM UTC

morgante wrote: post #182

devinegan wrote: post #146

Earlier quoted context omitted.

They don't appear to be scanned for Ads, but talk with the Google Marketing team and they will be able to tell you what domains are sending to your competitors if they use Google Apps.

I don't believe that for a second. It would be an outrageous violation of privacy and would lead to mass outcry against Google Apps. Do you have any source for that claim, or is it just pure libel?

The only source I have is a call with them when they told us they could do this. Down vote me all you like, I was shocked when I heard this as well. They suggested this to us, not something we would have ever asked for. Nobody else has ever had this experience?

Re: Gmail Will Warn If Message Is Not Authenticated/Encrypted

#210

Post by bzbarsky » Thu, Feb 11, 2016, 6:04 AM UTC

unprepare wrote: post #199

jacquesm wrote: post #190

Earlier quoted context omitted.

With SSNs the problem is not in the fact that they are in an email, but the fact that they are sensitive information at all.

SSNs have become a complete joke. Like why would I need to give my SSN to register for an account to take the GRE exam? And why would anyone ever make SSN an optional field? If its not required why would you ever ask for it? https://mygre.ets.org/greweb/createAcct/createAcctMain.jsp

> And why would anyone ever make SSN an optional field?

One reason might be that some states have laws on the books that prohibit requiring people to give you their SSN (unless you are actually required to collect it by some other law, of course).

> If its not required why would you ever ask for it?

All the answers to this are depressing. :(