Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Google's Backdoor Access System into Gmail Accounts

schneier.com

Post reply on HN
Print view View original

31–40 of 96 posts

Re: Google's Backdoor Access System into Gmail Accounts

#31

Post by SageRaven »

pudquick wrote: post #26
SageRaven wrote: post #20

Not that I think this would truly help (they probably replicate all inbound/outbound mail to some vast pool for statistical analysis), but is there an automated way to delete all mail from one's Gmail account? I use fetchmail to remove mail from my inbox and manage it on my workstation, but must periodically log on via the web interface and go to my "All Mail" folder and do a manual select and delete.

Well, if you use POP3 - it can definitely be automatic. Client-side configuration on how long to retain messages seen on the server.

Mail removed from the inbox (or most other "folders" on gmail) works as expected. However, they still remain in the "All Mail" folder, which doesn't appear to be accessible to POP/IMAP clients.

Re: Google's Backdoor Access System into Gmail Accounts

#32

Post by maqr »

truthtechnician wrote: post #29

I run my own mail server with a roundcube frontend interface, for $5 a month (if that) on Amazon EC2. What's the point of SSL in Gmail if Google has your certs?

SSL is for end-point to end-point security. SSL does not attempt to solve the problem of either end being compromised. This means that SSL won't help you if your computer is infected with rogue software or if the server you're talking to is compromised.

SSL does, however, help to prevent eavesdropping between point A and point B.

Re: Google's Backdoor Access System into Gmail Accounts

#33

Post by Bootvis »

pragmatic wrote: post #5

Could anyone recommend a hosted email service that does not allow spying on users? Alternatively I wonder what Bruce Schneier recommends? Do you have to host your own email server?

You could try Hushmail (http://www.hushmail.com/). They claim to encrypt your e-mail but off course you can never be sure with third parties.

Re: Google's Backdoor Access System into Gmail Accounts

#35

Post by forwardslash »

pragmatic wrote: post #5

Could anyone recommend a hosted email service that does not allow spying on users? Alternatively I wonder what Bruce Schneier recommends? Do you have to host your own email server?

A good bet might be a Swiss hosted e-mail service such as Neomailbox which is what I use. Lavabit is another one which might be what you're looking for.

Re: Google's Backdoor Access System into Gmail Accounts

#36

Post by beagle3 »

Some people on this discussion mention that they simply run their own mail servers -- that's dandy for incoming mail. But how do you guys make sure your outgoing mail is not blacklisted/ignored/considered spam? That's been a non trivial problem for me in the past when I was running a mail server (and spam was not such a big problem back then).

Also, is there any mail server you can run/recommend that has gmail-speedy searches and tagging? (And maildir support would be a super-extra-plus?)

Re: Google's Backdoor Access System into Gmail Accounts

#37

Post by mike-cardwell »

SageRaven wrote: post #22
hvs wrote: post #9

Earlier quoted context omitted.

Under U.S. laws, providers are often required to give information to the government if they have a warrant. If you want (more) security, host it yourself.

True, however some providers make attempts to thwart this by making it impossible for even themselves to access mail by way of encryption. I haven't looked at it in a long while, but lavabit.com was one such company, and it's a pretty good raw POP/IMAP service (at last check the web interface and spam measures were somewhat lacking).

I like what lavabit has done, but at the end of the day, if they are forced to, they can modify their server side software to log your password when you log in, and then use that password to decrypt all of your email on the server side.

It also doesn't secure the email on the client side. If your IMAP client stores the email on disk, then you need to make sure it is encrypting it in a secure fashion first.

Lavabit should offer an extra layer of encryption whereby they allow you to upload a public pgp key which they encrypt all your incoming email with using PGP/MIME.

Re: Google's Backdoor Access System into Gmail Accounts

#38

Post by jamespo »

maqr wrote: post #32
truthtechnician wrote: post #29

I run my own mail server with a roundcube frontend interface, for $5 a month (if that) on Amazon EC2. What's the point of SSL in Gmail if Google has your certs?

SSL is for end-point to end-point security. SSL does not attempt to solve the problem of either end being compromised. This means that SSL won't help you if your computer is infected with rogue software or if the server you're talking to is compromised. SSL does, however, help to prevent eavesdropping between point A and point B.

Worthwhile if you use wireless networks, particularly unencrypted ones to access your email.

And with the cost of a godaddy or similar certificate so low, well worth implementing on your own box.

Post reply on HN