Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

IRS claims it can read your e-mail without a warrant

news.cnet.com

Post reply on HN
Print view View original

31–40 of 186 posts

Re: IRS claims it can read your e-mail without a warrant

#31

Post by sliverstorm »

maratd wrote: post #21
rayiner wrote: post #3

This statement: "Newly disclosed documents prepared by IRS lawyers says that Americans enjoy 'generally no privacy' in their e-mail, Facebook chats, Twitter direct messages, and similar online communications" is entirely consistent with the existence of Warshack. Warshack covers the Sixth Circuit, which includes the following states: Kentucky, Michigan, Ohio, and Tennessee. The IRS is bound by this precedent in those…

> If you understand how SMTP works, it's hard to argue that it's a private means of communication. You send a clear-text message to a publically-accessible service that is empowered to forward the message to other publically-accessible servers if necessary. Whoa, hold it, I don't think so. Almost every SMTP server out there today requires authentication and quite a few require either SSL or TLS. That is the very defi…

Authentication is to prevent someone from pretending to be you. This is not the same as trying to keep your messages private.

Re: IRS claims it can read your e-mail without a warrant

#32

Post by palebluedot »

alexanderh wrote: post #12
rayiner wrote: post #7

Earlier quoted context omitted.

Gmail has SSL to Google's e-mail server. If you e.g. send a mail to someone using Outlook, it's sent in clear text. And at both ends it's scanned to deliver everyone involved targeted advertising. "Reasonable expectation of privacy" doesn't have an implicit "only as against the government." If you're knowingly exposing the contents to Google and Microsoft to scan, you can't claim to have a "reasonable expectation of…

And this is why you always use something along the lines of PGP end to end.

The problem is this works only with 2 parties that have already agreed to, and are willing to use, encryption. How many websites, services, and other sources of email have an option to encrypt your email to you with your public key? Not many at all.

I've stopped putting my public key on emails I send, because almost no one ever encrypted email to me, unless they were specifically sending something perceived to be sensitive.

Re: IRS claims it can read your e-mail without a warrant

#33

Post by __david__ »

sp332 wrote: post #28
Jach wrote: post #15

When will "does not give the option to encrypt all outgoing correspondence with my PGP public key" become as embarrassing for an important website as "doesn't have an SSL cert" or "emails/stores passwords in plaintext"? Edit: added word "outgoing" for pedant below. ;) Of course it'd be nice to get their public key too if you had to correspond back without going through say their https website.

If you want to send someone a message, you have to use their public key. If a message is encrypted with your public key, it can only be decrypted by your own private key. Edit: ok your edit makes more sense now :)

Yes, he meant if he gives his email out to a website (amazon.com, say) he wants to give them his PGP public key as well so that all correspondence to him will be encrypted through PGP.

I would like this, too. Internet, please get on that.

Re: IRS claims it can read your e-mail without a warrant

#34

Post by mikegioia »

mimiflynn wrote: post #25
maratd wrote: post #21

Earlier quoted context omitted.

> If you understand how SMTP works, it's hard to argue that it's a private means of communication. You send a clear-text message to a publically-accessible service that is empowered to forward the message to other publically-accessible servers if necessary. Whoa, hold it, I don't think so. Almost every SMTP server out there today requires authentication and quite a few require either SSL or TLS. That is the very defi…

Google's email isn't encrypted, it is sent as text over a network. Authentication doesn't change the fact that your email can be intercepted through the network in which it has been sent or received.

It's encrypted if you're sending it to another GMail user or anyone using Google Apps email for their domain.

Re: IRS claims it can read your e-mail without a warrant

#35

Post by habith »

mimiflynn wrote: post #25
maratd wrote: post #21

Earlier quoted context omitted.

> If you understand how SMTP works, it's hard to argue that it's a private means of communication. You send a clear-text message to a publically-accessible service that is empowered to forward the message to other publically-accessible servers if necessary. Whoa, hold it, I don't think so. Almost every SMTP server out there today requires authentication and quite a few require either SSL or TLS. That is the very defi…

Google's email isn't encrypted, it is sent as text over a network. Authentication doesn't change the fact that your email can be intercepted through the network in which it has been sent or received.

> Google's email isn't encrypted, it is sent as text over a network

I just grepped my personal email server log to double check, here's an obfuscated entry from this morning:

> localhost postfix/smtpd[14440]: TLS connection established from mail-xxxxxxxx.google.com[xxx.xx.xxx.xxx]: TLS v1 with cipher RC4-SHA (128/128 bits)

Doesn't look like clear text to me.

Re: IRS claims it can read your e-mail without a warrant

#36

Post by varjag »

rayiner wrote: post #3

This statement: "Newly disclosed documents prepared by IRS lawyers says that Americans enjoy 'generally no privacy' in their e-mail, Facebook chats, Twitter direct messages, and similar online communications" is entirely consistent with the existence of Warshack. Warshack covers the Sixth Circuit, which includes the following states: Kentucky, Michigan, Ohio, and Tennessee. The IRS is bound by this precedent in those…

> You send a clear-text message to a publically-accessible service that is empowered to forward the message to other publically-accessible servers if necessary.

This is how postal system works.

Re: IRS claims it can read your e-mail without a warrant

#37

Post by taeric »

betterunix wrote: post #29
maratd wrote: post #21

Earlier quoted context omitted.

> If you understand how SMTP works, it's hard to argue that it's a private means of communication. You send a clear-text message to a publically-accessible service that is empowered to forward the message to other publically-accessible servers if necessary. Whoa, hold it, I don't think so. Almost every SMTP server out there today requires authentication and quite a few require either SSL or TLS. That is the very defi…

Except that the mail server gets to see the body of the email, which is not even remotely private. Encryption gives you privacy; instead of politely asking people to not read your mail, why not politely ask people to encrypt messages?

While I would not argue against encryption giving you privacy, I think it is easy to argue that there is an expectation of privacy in sending emails. At least, as much of one as if you were sending actual correspondence.

Consider, in a public restroom there is very little done to prevent people from seeing each other. However, one almost certainly has a reasonable expectation of privacy in such a situation. Hell, consider using the restroom in someone else's house. If you record videos of everyone that uses your restroom...

Re: IRS claims it can read your e-mail without a warrant

#38

Post by __david__ »

Jach wrote: post #15

When will "does not give the option to encrypt all outgoing correspondence with my PGP public key" become as embarrassing for an important website as "doesn't have an SSL cert" or "emails/stores passwords in plaintext"? Edit: added word "outgoing" for pedant below. ;) Of course it'd be nice to get their public key too if you had to correspond back without going through say their https website.

It'll happen only when PGP isn't just used by .001% [1] of email users.

It needs some really good integration with an email client somewhere, where addresses are picked up from a public key server and automatically encrypted. I'm picturing an iMessage style thing where as you're typing someones email address, the keyserver is getting pinged and the address turns a different color and a lock icon appears by it. Now all your correspondence with that person is encrypted. PGP purists might not like it ("but you're automatically trusting some random key!! The web of trust, the web of trust!") but it would be a step in the right direction.

[1] Statistic I just made up.

Re: IRS claims it can read your e-mail without a warrant

#39

Post by maxerickson »

rayiner wrote: post #7
DanielBMarkham wrote: post #6

Earlier quoted context omitted.

But now that gmail has ssl access, this is no longer true, right?

Gmail has SSL to Google's e-mail server. If you e.g. send a mail to someone using Outlook, it's sent in clear text. And at both ends it's scanned to deliver everyone involved targeted advertising. "Reasonable expectation of privacy" doesn't have an implicit "only as against the government." If you're knowingly exposing the contents to Google and Microsoft to scan, you can't claim to have a "reasonable expectation of…

Is it reasonable to have different feelings about an automated system than some random person?

The ad-bots at Google aren't known to be very gossipy.

(I don't mean this to be snide. I think this is an instance of a very interesting phenomenon, where we reason about our society as if it were a village.)

Re: IRS claims it can read your e-mail without a warrant

#40

Post by rayiner »

Spooky23 wrote: post #18
rayiner wrote: post #3

This statement: "Newly disclosed documents prepared by IRS lawyers says that Americans enjoy 'generally no privacy' in their e-mail, Facebook chats, Twitter direct messages, and similar online communications" is entirely consistent with the existence of Warshack. Warshack covers the Sixth Circuit, which includes the following states: Kentucky, Michigan, Ohio, and Tennessee. The IRS is bound by this precedent in those…

So by your reasoning, if I mail you a postcard, and you put the postcard in a locked container placed inside of the trunk of a rental car, it is OK for the police to bypass your access controls and read the postcard? How you transmitted or handled something at a point in time is not relevant to it's status at rest. This issue here is that the government asserts that email is a communications system only. The problem…

Your analogy is completely inapt:

1) A rental car, like a rented house, is still under your control. But your e-mail account on Google's servers is under their control. They can do whatever they want with it. It's more like your friend letting you use part of his garage to store stuff--a third party still retains full control over the space.

2) As far as I can tell, Google can access your e-mail whenever it wants, so the "locked container" analogy also fails.

Again, I think the fact that Google/Microsoft/etc can scan your emails and documents to send you targeted ads is determinative here. If you're voluntarily exposing the contents of your documents to that process, how can you claim to have an expectation of privacy?

Post reply on HN