41–50 of 96 posts
"The rumor that China used a system Google put in place to enable lawful intercepts, which I used as a news hook for this essay, has not been confirmed. At this point, I doubt that it's true." http://www.schneier.com/blog/archives/2010/02/more_details_o...
Could anyone recommend a hosted email service that does not allow spying on users? Alternatively I wonder what Bruce Schneier recommends? Do you have to host your own email server?
i host my own server, but the best i found - about a year ago when i looked into this - was a norwegian company called runbox http://www.runbox.com/ their support was also friendly, helpful, and technically clued up when i discussed some issues (i didn't go with them in the end because i've hosted my own email before, know how to do it, and decided it wasn't worth paying anyone else). [edit: to be clear, not only do…
Also, rackspace has a hosted email offering - http://www.rackspace.com/apps/email_hosting/
people like you write the laws mandating backdoors, people like you force companies to implement it, people like you actually implement it. After all that, you dare to express displeasure with the thing you done pretty much by yourself to yourself. Man up and take responsibility for your actions. Next time you're groped by a TSA agent, you can find a relief in the thought that you (or your friend working at Google) groped the agent's Gmail account. Tit-for-tat.
You guys realise that this essay was published on January 23, 2010 right? I'm sure it's been posted here before.
http://www.schneier.com/blog/archives/2010/02/more_details_o...
Earlier quoted context omitted.
Well, if you use POP3 - it can definitely be automatic. Client-side configuration on how long to retain messages seen on the server.
Mail removed from the inbox (or most other "folders" on gmail) works as expected. However, they still remain in the "All Mail" folder, which doesn't appear to be accessible to POP/IMAP clients.
When a message is marked as deleted and expunged from the last visible IMAP folder:
all this evil isn't done by some special evil people. It is you or people like you who does it. people like you write the laws mandating backdoors, people like you force companies to implement it, people like you actually implement it. After all that, you dare to express displeasure with the thing you done pretty much by yourself to yourself. Man up and take responsibility for your actions. Next time you're groped by…
You, being a good geek, encrypt your personal systems out the wazzoo.
Then you want to take the next step: encrypted communications (examples: legal, business).
This now makes your request of everyone you deal with to dink with public/private keys and - likely - some sort of infrastructure.
What's the best real-world (i.e., non-propellerhead) solution to this?
Some people on this discussion mention that they simply run their own mail servers -- that's dandy for incoming mail. But how do you guys make sure your outgoing mail is not blacklisted/ignored/considered spam? That's been a non trivial problem for me in the past when I was running a mail server (and spam was not such a big problem back then). Also, is there any mail server you can run/recommend that has gmail-speedy…
I so far haven't had the mail server blacklisted even once since I started using it 18 months ago. I have a number of other customers on it, including one that sends out a 500-odd subscriber newsletter, using software I developed. I have taken a couple of precautions against spam: I use SPF records for as many domains as possible, the mail server itself is locked down tighter'n a flea's bunghole (including some proactive security measures), I have remote monitoring that keeps an eye on the server constantly, and (so far) I've had the pleasure of only doing business with people I trust.
It requires a lot of effort to build a good mail server, and there isn't a single "perfect" tutorial on the web for it. So, for a lot of people, it might not be worth it. For me though, I haven't touched my Gmail account in a very long time, and I really do love the fact that I have complete control over every aspect of my email (and my customers').
Earlier quoted context omitted.
True, however some providers make attempts to thwart this by making it impossible for even themselves to access mail by way of encryption. I haven't looked at it in a long while, but lavabit.com was one such company, and it's a pretty good raw POP/IMAP service (at last check the web interface and spam measures were somewhat lacking).
I like what lavabit has done, but at the end of the day, if they are forced to, they can modify their server side software to log your password when you log in, and then use that password to decrypt all of your email on the server side. It also doesn't secure the email on the client side. If your IMAP client stores the email on disk, then you need to make sure it is encrypting it in a secure fashion first. Lavabit sh…
I think fundamentally you can't circumvent the law with technical measures. You need to change the law to require warrants.
So let's go with a rational assumption, which is that your email provider has the capability to read your email (scenarios: warrant, hacker, bored sysadmin). You, being a good geek, encrypt your personal systems out the wazzoo. Then you want to take the next step: encrypted communications (examples: legal, business). This now makes your request of everyone you deal with to dink with public/private keys and - likely -…