Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

IRS claims it can read your e-mail without a warrant

news.cnet.com

Post reply on HN
Print view View original

171–180 of 186 posts

Re: IRS claims it can read your e-mail without a warrant

#171

Post by sliverstorm »

maratd wrote: post #158
sliverstorm wrote: post #140

Earlier quoted context omitted.

Maybe I'm expressing myself in too cryptic of a fashion. I'm simply asserting that while privacy and authentication sometimes overlap, they are not the same thing. From the parent of my original comment: Almost every SMTP server out there today requires authentication ... That is the very definition of trying to keep things private. Do you disagree with me? Do you believe that SMTP authentication contributes to priva…

Hey, hey, what's with the "..." and cutting out the relevant parts? I explicitly mention SSL and TLS. Those are encryption standards that are designed exclusively for privacy. If I am using them to communicate with a 3rd party, I have a reasonable expectation of privacy between myself and that 3rd party. You would most certainly need a warrant to turn around and try to get access to a message stored on their servers.…

Hey, hey, what's with the "..." and cutting out the relevant parts? I explicitly mention SSL and TLS. Those are encryption standards that are designed exclusively for privacy.

I cut out the SSL and TLS because I don't disagree; SSL and TLS certainly says "privacy". I wanted to specifically address the notion that "authentication =~ privacy"

Re: IRS claims it can read your e-mail without a warrant

#172

Post by sliverstorm »

eruditely wrote: post #170
sliverstorm wrote: post #140

Earlier quoted context omitted.

Maybe I'm expressing myself in too cryptic of a fashion. I'm simply asserting that while privacy and authentication sometimes overlap, they are not the same thing. From the parent of my original comment: Almost every SMTP server out there today requires authentication ... That is the very definition of trying to keep things private. Do you disagree with me? Do you believe that SMTP authentication contributes to priva…

While you are making your point, you're being overly pedantic, and the point is irrelevant. Email should not be able to be accessed by a third party without warrant period. Whether or not the analogies line up.

It may seem like pedantry, and it may not be directly applicable to the article, but it is a common security fallacy I wanted to call out.

Re: IRS claims it can read your e-mail without a warrant

#173

Post by AnthonyMouse »

mpyne wrote: post #156
AnthonyMouse wrote: post #149

Earlier quoted context omitted.

Presumably you can pick a lock or attach a lineman's handset to the POTS phone lines outside of someone's house too, but aren't we talking about the expectation of privacy?

You should never expect privacy over an unencrypted connection. However where I do disagree with rayiner is that you should be able to expect that third parties which you willingly entrust your communication to, should not be compelled to turn over that message without a warrant. If they turn it over willingly that's caveat emptor, but email to me feels more like a hand-to-hand transfer of a postcard than dropping a…

>You should never expect privacy over an unencrypted connection.

What does "should" have to do with it? A landline telephone isn't encrypted, people still expect their conversations to be private. And I don't see why email should be different -- if it came out that human Google employees have been reading your emails it would be a huge scandal.

> If they turn it over willingly that's caveat emptor

I don't know about that. Do you think it would also be reasonable without a court order for them to provide your private emails to a party other than the government, like a reporter or your company's customers or suppliers?

Re: IRS claims it can read your e-mail without a warrant

#174

Post by varjag »

mpyne wrote: post #162
varjag wrote: post #36

Earlier quoted context omitted.

> You send a clear-text message to a publically-accessible service that is empowered to forward the message to other publically-accessible servers if necessary. This is how postal system works.

And yet you enjoy no 4th Amendment protections for parcels you send by a private carrier such as UPS or FedEx. They can snoop in your stuff all the want and it would be at most a civil matter (with rare exceptions). Your analogy would make better sense if you were talking about using a government-provided email service. But trust me, you don't want to do that, at least if it's anything like my government-provided wor…

Substituting the postal service with private carrier services, the point still stands. People just not expect their correspondence to be peeked into, no matter how technically easy is that.

When you have a conversation in a busy mall, you have no expectation of privacy. When you communicate one on one in confines of private apartment, your speech isn't meant for others to be heard, even if that would be laughably easy to eavesdrop for a government agency.

It's not really a technicality we are arguing about but very basic expectations from a communication medium. If I write an email to my wife I don't expect it to be exposed to arbitrary strangers, although I understand that it's not as secure media as say diplomatic cables cough.

Re: IRS claims it can read your e-mail without a warrant

#175

Post by varjag »

betterunix wrote: post #134
varjag wrote: post #76

Earlier quoted context omitted.

You can't normally read SMTP exchange between two arbitrary servers. Granted, there's a range of attacks possible to a motivated hacker, but they are exactly that: attacks. Your email is normally not exposed to third parties.

"Your email is normally not exposed to third parties." Except for the mail servers...

Yes, in the way your snail mail is exposed to postal trucks, mail handling agents and office clerks.

Re: IRS claims it can read your e-mail without a warrant

#176

Post by taeric »

betterunix wrote: post #164
taeric wrote: post #161

Earlier quoted context omitted.

But the problem with your argument is you are assuming they did nothing to protect their privacy. They specifically addressed the email to someone. Or had it specifically addressed to them. As the other poster said, consider the urinal. Whether intended or not, there are about to be a lot of images of people at the urinal taken by a capture device. Should men just get used to this idea and expect these pictures onlin…

"As the other poster said, consider the urinal. Whether intended or not, there are about to be a lot of images of people at the urinal taken by a capture device. Should men just get used to this idea and expect these pictures online?" Yes, or else just walk to the stall and pee in the toilet. I see guys doing that all the time where I work -- some men want to be private about it, and urinals are not and have never be…

You missed the point of my last question. Right now. Today. You have an expectation of privacy in your own home. For anyone that understands how surveillance works, you would know that closing your door is pointless as far as keeping the sound in. By your logic, this is not appropriate. Because, "hey, you should know that it is easy to hear inside your home."

However, if police wish to violate this, using relatively common and accessible tools, they have to have a warrant. Consider the phone calls you place. These are just as exposed to third parties as any email you send. Yet to intercept them police need a warrant. For others to do so is illegal.

Note, the deciding point here is not that it is hard or easy to intercept your communications. Or sit outside with a microphone. The point is that those activities require a warrant. Because they are illegal otherwise.

Re: IRS claims it can read your e-mail without a warrant

#177

Post by [deleted] »

bradleyjg wrote: post #109
kyrias wrote: post #77

Earlier quoted context omitted.

email servers generally aren't publicly accessible, rather they're only accessible to authorized (registered) users Yes, sending email requires authorization to the SMTP server but MTA to MTA communications (as in when your mailserver actually sends your email to the recipients mail server) are clear text and can easily be intercepted. The difference between telephone calls and email is that you generally don't have…

The SMTP protocol is used both from client to server and from server to server. RFC 3207 (2002) complaint MTAs communicate with each other over a TLS (i.e. encrypted) connection. Complaint MTAs include: sendmail (>= 8.11), postfix (>= 2.2), MS Exchange (>= 5.5). Patches have existed for qmail to add support since 1.01, though they aren't in the main distribution for reasons that I'm sure make sense to djb.

[deleted]

Re: IRS claims it can read your e-mail without a warrant

#178

Post by beedogs »

mpyne wrote: post #157
beedogs wrote: post #153

Earlier quoted context omitted.

> If you understand how SMTP works, it's hard to argue that it's a private means of communication. This is true, and a great point. I often open my neighbors' postal mail using this same excuse. Sometimes you can even read the letters and notices right through the paper envelope!

Postcards are the better analogy for SMTP, not "opening postal mail". With that said, it's actually a Federal crime to remove mail from someone else's mailbox to obstruct or pry into their business (even for postcards), which would seem to support your overall point. http://www.law.cornell.edu/uscode/text/18/1702

That's sort of my point, yeah. Think of your mailspool (protected by a password and login, at the very least, and oftentimes encrypted via SSL-IMAP or the like) as your postal mailbox and the analogy I was aiming for makes perfect sense.

Sure, it's easy to snoop emails in-flight, but once it arrives at its destination, it ought to be hands-off.

Re: IRS claims it can read your e-mail without a warrant

#179

Post by kamjam »

rayiner wrote: post #90
hpguy wrote: post #78

Earlier quoted context omitted.

The data I put in Google is MY property, I want that data protected and don't care less about servers just as I do not claim ownership to the school locker.

If you want it protected, don't leave it in clear text in the custody of someone else who may or may not choose to hand it over to the authorities without your permission. In other news: you can't invoke the 4th amendment if you stash boxes of weed at a friend's house and he hands them over to the government when asked.

So if I send a letter via USPS do I have the right to expect that someone will not intercept and open that letter without getting the correct permission?

Mail theft was a pretty serious crime in USA I am led to believe, regardless of whether it is sent in encrypted form or not...

Re: IRS claims it can read your e-mail without a warrant

#180

Post by will_brown »

Cadsby wrote: post #97
will_brown wrote: post #17

Earlier quoted context omitted.

Nice analysis. I tend to think the evolution of expectation of privacy from regular mail to email is similar to the evolution of expectation of privacy from land-line phones to cell phones. That is under the 4th Amendment land-line phone users have a reasonable expectation of privacy; therefore, Gov. must obtain a search warrant to use evidence gathered from such sources against the criminal defendant. Yet, Courts de…

> That is under the 4th Amendment land-line phone users have a reasonable expectation of privacy This wasn't always the case. In fact the government argued the exact opposite for years.

The Government (prosecutors at State and Federal levels) but to the best of my knowledge the Courts have always upheld defendants reasonable expectation of privacy as to landlines in the home.

I suppose pay phones are landlines, but reasonable expectation of privacy is more complicated - originally courts upheld reasonable expectation of privacy when there was a phone booth, but not when the pay phone was in the open - this varies from state to state but I would not be surprised if this expectation of privacy has whittled away in the majority of states.

Post reply on HN