Nothing is certain but death, parsing errors and taxes
Parsing errors +10. Thanks for the chuckle.
Why would death be parsing errors and taxes? ;)
IRS claims it can read your e-mail without a warrant
41–50 of 186 posts
Re: IRS claims it can read your e-mail without a warrant
#42Earlier quoted context omitted.
Except that the mail server gets to see the body of the email, which is not even remotely private. Encryption gives you privacy; instead of politely asking people to not read your mail, why not politely ask people to encrypt messages?
While I would not argue against encryption giving you privacy, I think it is easy to argue that there is an expectation of privacy in sending emails. At least, as much of one as if you were sending actual correspondence. Consider, in a public restroom there is very little done to prevent people from seeing each other. However, one almost certainly has a reasonable expectation of privacy in such a situation. Hell, con…
We put doors on restrooms. Claiming that unencrypted email should carry a legitimate expectation of privacy is like claiming that people should expect privacy when they go to the bathroom on the side of the highway. People may want their email to be private, but that does not mean that we should pretend that email really is private.
Really, we need encryption to be widely used, for people to learn about it in school, and for people to generally expect messages to be encrypted. We have not really won this fight until people encrypt private messages and get angry when private things are sent in the clear.
Re: IRS claims it can read your e-mail without a warrant
#43This statement: "Newly disclosed documents prepared by IRS lawyers says that Americans enjoy 'generally no privacy' in their e-mail, Facebook chats, Twitter direct messages, and similar online communications" is entirely consistent with the existence of Warshack. Warshack covers the Sixth Circuit, which includes the following states: Kentucky, Michigan, Ohio, and Tennessee. The IRS is bound by this precedent in those…
> If you understand how SMTP works, it's hard to argue that it's a private means of communication. You send a clear-text message to a publically-accessible service that is empowered to forward the message to other publically-accessible servers if necessary. Whoa, hold it, I don't think so. Almost every SMTP server out there today requires authentication and quite a few require either SSL or TLS. That is the very defi…
Have you asked your attorney why he adds that warning, and asked whether attorney-client privilege is waived if email messages and documents are exchanged over an SMTP system which allows the messages to be read by providers and intermediaries?
I asked once. The answer was: no, it is not waived and no warning need be attached. Applicable law revolves around intent and that is largely determined by who you choose for recipients. There is some allowance for typos and mistakes when addressing or sending. The warning is just to remind people of appropriate conduct, encourage them to report incorrectly addressed messages, and make the intent extra clear.
Re: IRS claims it can read your e-mail without a warrant
#44Earlier quoted context omitted.
Gmail has SSL to Google's e-mail server. If you e.g. send a mail to someone using Outlook, it's sent in clear text. And at both ends it's scanned to deliver everyone involved targeted advertising. "Reasonable expectation of privacy" doesn't have an implicit "only as against the government." If you're knowingly exposing the contents to Google and Microsoft to scan, you can't claim to have a "reasonable expectation of…
Is it reasonable to have different feelings about an automated system than some random person? The ad-bots at Google aren't known to be very gossipy. (I don't mean this to be snide. I think this is an instance of a very interesting phenomenon, where we reason about our society as if it were a village.)
The law avoids anthropomorphizing computers. So the "person" here is Google, not the ad-bots. The ad-bots are just tools used by the person who has access to your e-mail.
Re: IRS claims it can read your e-mail without a warrant
#45It's funny how in one breath the government tells us that there is no reasonable expectation of privacy for data on the internet and in another the DMCA says that the act of knowingly breaking any security, no matter how weak, is a serious crime.
Re: IRS claims it can read your e-mail without a warrant
#46When will "does not give the option to encrypt all outgoing correspondence with my PGP public key" become as embarrassing for an important website as "doesn't have an SSL cert" or "emails/stores passwords in plaintext"? Edit: added word "outgoing" for pedant below. ;) Of course it'd be nice to get their public key too if you had to correspond back without going through say their https website.
It'll happen only when PGP isn't just used by .001% [1] of email users. It needs some really good integration with an email client somewhere, where addresses are picked up from a public key server and automatically encrypted. I'm picturing an iMessage style thing where as you're typing someones email address, the keyserver is getting pinged and the address turns a different color and a lock icon appears by it. Now al…
I think a better solution is identity based encryption, so that the sender can encrypt the message before the receiver has their private key. Senders should have multiple IBE services to choose from, and we should have standards that allow or even require threshold IBE (so that no single party can decrypt all messages). IBE services may fail to take verification seriously, but the sender of a message could simply refuse to use services with a reputation for being lazy or malicious. It might also make sense to create a hybrid system, combining IBE with PGP.
https://en.wikipedia.org/wiki/Identity_based_encryption
[Edit: it pains me to say this, of course; I am not a fan of systems where some other party or coalition of parties can decrypt messages. However, it would be better than what we have now, and it is closer to the "putting a letter in an envelope" abstraction.]
Re: IRS claims it can read your e-mail without a warrant
#47Earlier quoted context omitted.
Google's email isn't encrypted, it is sent as text over a network. Authentication doesn't change the fact that your email can be intercepted through the network in which it has been sent or received.
> Google's email isn't encrypted, it is sent as text over a network I just grepped my personal email server log to double check, here's an obfuscated entry from this morning: > localhost postfix/smtpd[14440]: TLS connection established from mail-xxxxxxxx.google.com[xxx.xx.xxx.xxx]: TLS v1 with cipher RC4-SHA (128/128 bits) Doesn't look like clear text to me.
Based on my server logs, Google will offer STARTTLS and also use STARTTLS when offered. So there can be MTAMTA encryption. Unfortunately, many MTAs don't do one or both, and that includes those run by some of the largest ISPs.
Edit: A test tool... https://www.checktls.com/
Re: IRS claims it can read your e-mail without a warrant
#48Earlier quoted context omitted.
> If you understand how SMTP works, it's hard to argue that it's a private means of communication. You send a clear-text message to a publically-accessible service that is empowered to forward the message to other publically-accessible servers if necessary. Whoa, hold it, I don't think so. Almost every SMTP server out there today requires authentication and quite a few require either SSL or TLS. That is the very defi…
Have you asked your attorney why he adds that warning, and asked whether attorney-client privilege is waived if email messages and documents are exchanged over an SMTP system which allows the messages to be read by providers and intermediaries? I asked once. The answer was: no, it is not waived and no warning need be attached. Applicable law revolves around intent and that is largely determined by who you choose for…
The law of client/attorney privilege and the Constitutional prohibitions against unreasonable search have distinct bases and are governed by different law. Attorney/client communication focuses on the whole communication, while 4th amendment focuses on the specific piece of evidence. So if you for example gave your client some advice relayed through your secretaries, you could invoke the privilege if they were questioned. However, if you gave your secretary a note to pass to your client, and she kept a copy, you cannot invoke the 4th amendment.
Re: IRS claims it can read your e-mail without a warrant
#49Earlier quoted context omitted.
Google's email isn't encrypted, it is sent as text over a network. Authentication doesn't change the fact that your email can be intercepted through the network in which it has been sent or received.
> Google's email isn't encrypted, it is sent as text over a network I just grepped my personal email server log to double check, here's an obfuscated entry from this morning: > localhost postfix/smtpd[14440]: TLS connection established from mail-xxxxxxxx.google.com[xxx.xx.xxx.xxx]: TLS v1 with cipher RC4-SHA (128/128 bits) Doesn't look like clear text to me.
[deleted]
Re: IRS claims it can read your e-mail without a warrant
#50It's funny how in one breath the government tells us that there is no reasonable expectation of privacy for data on the internet and in another the DMCA says that the act of knowingly breaking any security, no matter how weak, is a serious crime.
And in fact securing something can be interpreted by some as intent to deceive. Only terrorists use PGP and really serious encryption.
"if you don't have anything to hide, you have nothing to fear" -- Eric Schmidt of Google