Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Gmail Will Warn If Message Is Not Authenticated/Encrypted

gmailblog.blogspot.com

Post reply on HN
Print view View original

211–216 of 216 posts

Re: Gmail Will Warn If Message Is Not Authenticated/Encrypted

#211

Post by darkr »

viraptor wrote: post #34
darkr wrote: post #23

Earlier quoted context omitted.

It's still not ready for production use. One problem with e2e is that it's JavaScript based and runs in he browser, so there is a certain attack vector present there. To defend against this, ideally e2e needs to work with a smartcard (such as the yubikey neo) so that the private key cannot be stolen. There was an issue I was tracking a while back to integrate this support, but it's still a work in progress.

It doesn't even need the hardware part in most cases. OS keyrings support pkcs11 interface with signing exposed. That means you can just send data to be encrypted for example by gnome-keyring and the browser never sees the actual key.

But e2e doesn't use the OS keyring. It uses it's own JavaScript keyring that runs in the browser and uses localstorage for storing private keys.

Re: Gmail Will Warn If Message Is Not Authenticated/Encrypted

#213

Post by collinmanderson »

jcoffland wrote: post #30

This sounds great but Google has been making it harder and harder to run your own mail server even for personal use. I think they would be happy of email servers were only run by a few large companies. They make it sound like they are doing the right thing but really they are bully the industry to do it their way. So many people have Gmail accounts that you can't run an email server that cannot send email to Google.…

If you run your own postfix server, the first part is as easy as setting smtp_tls_security_level = may. You don't need to certificate or anything.

The DKIM authentication just requires a self-signed certificate. It doesn't need to be signed by a CA, I believe.

Re: Gmail Will Warn If Message Is Not Authenticated/Encrypted

#214

Post by scrupulusalbion »

nyan4 wrote: post #59
scrupulusalbion wrote: post #13

Earlier quoted context omitted.

More importantly, end-to-end encryption means that your desktop/laptop/tablet/phone/TI-83 is doing the crypto, especially signatures. On a somewhat related note, I remember reading some documentation on a one-time password scheme, which I can't find anymore. It briefly mentioned something about using DES calculators to handle crypto signatures (for what reason i cannot remember). For our purposes, a PGP/GPG hand-held…

> phone/TI-83 is doing the crypto Phone? Can we remotely trust nowadays smartphones not to have a number of backdoors?

I don't think that phones are secure, but people do use them for things like 2-factor authentication. I suppose that it is the form-factor that is more relevant, since most phones are smaller than a TI-83, so much so that people are willing to carry them around everywhere.

Ultimately, what I envision would be a cross between a Blackberry (size, QWERTY keyboard) and the TI-83 (focus on being a simpler, lower-end computer). Heck, one may as well give it a unix-like OS and leave out wireless communications and sophisticated graphics. I think this is feasible, but the market would be quite small.

Re: Gmail Will Warn If Message Is Not Authenticated/Encrypted

#215

Post by hueving »

technion wrote: post #169
makomk wrote: post #129

Earlier quoted context omitted.

Gmail's new rules on unencrypted e-mail don't support self-signed certificates though - you have to use an offcial CA-issued certificate from one of Google's approved CAs.

That doesn't bring a lot of extra security though, because there's no name verification. I can get a valid letsencrypt cert on anyrandomdomain.com, and if I can hijack your MX and point at it, it's "valid".

What? How can you get a cert for a domain you don't control?

Re: Gmail Will Warn If Message Is Not Authenticated/Encrypted

#216

Post by technion »

hueving wrote: post #215
technion wrote: post #169

Earlier quoted context omitted.

That doesn't bring a lot of extra security though, because there's no name verification. I can get a valid letsencrypt cert on anyrandomdomain.com, and if I can hijack your MX and point at it, it's "valid".

What? How can you get a cert for a domain you don't control?

I don't need to control your domain. If I control my own domain, which could be any throwaway domain I just purchased, I can get an SSL certificate on it.

And if I can point your MX records there, via hijack or any other means, then I have a valid SSL certificate for receiving your email.

Post reply on HN