This is ironic, as Gmail has never supported email encrypted (or even signed) using S/MIME and digital certificates.
See the other gmail announcement today: https://code.google.com/p/end-to-end/
Google releases stats on email encryption in transit
11–20 of 53 posts
Re: Google releases stats on email encryption in transit
#12I'm confused as to why anything isn't 100%. I guess I could maybe understand 0%, but how can it be 50%? I would imagine you either encrypt all email or you don't encrypt any email. What is the in-between?
Probably because it allows connections that aren't perfectly secure, such as supporting anything less than 256 bits.
That wouldn't explain why Google would have difficulty.
It implies some kind of inconsistency in configuration or something on the servers Google's sending email to?
Re: Google releases stats on email encryption in transit
#13Funny that meanwhile they still won't support XMPP encryption...
Re: Google releases stats on email encryption in transit
#14I'm confused as to why anything isn't 100%. I guess I could maybe understand 0%, but how can it be 50%? I would imagine you either encrypt all email or you don't encrypt any email. What is the in-between?
With my small personal domain I was just using a self-signed cert until a few weeks ago, and I could see that some sending servers quit and sent in plain text after encountering a self signed cert, others delivered regardless.
Re: Google releases stats on email encryption in transit
#15Funny that meanwhile they still won't support XMPP encryption...
Maybe because they're dropping support for XMPP altogether.
Re: Google releases stats on email encryption in transit
#16This is ironic, as Gmail has never supported email encrypted (or even signed) using S/MIME and digital certificates.
See the other gmail announcement today: https://code.google.com/p/end-to-end/
I still think DarkMail will be better than any PGP-based solution. But of course DarkMail doesn't actually "exist" yet, so I guess PGP wins by default for now.
Re: Google releases stats on email encryption in transit
#17The 99.9% freak me out. The huge problem with email encryption right now is that you can't reasonably make it mandatory (as you can see, a lots of domain do not support it) so it can be easily be stripped à la sslstrip, and there is no such a thing as HSTS. (Again, please, build pinning into everything.) So an active attacker able to MitM can simply turn encryption off, and those 99.9% make me wonder if that happened…
> The huge problem with email encryption right now is that you can't reasonably make it mandatory
Many services can make it mandatory, as long as you're willing to take the hit to convenience, so at least your outbound email is always protected (and you get some level of canary for inbound email).
This is usually for some compliance rule or another because they want enterprise business, so even the mainstream ones like Google Apps[1] and Office 365[2] have support for requiring TLS.
[1] https://support.google.com/a/answer/2520500?hl=en
[2] http://technet.microsoft.com/en-US/library/jj723154%28v=exch...
Re: Google releases stats on email encryption in transit
#18The 99.9% freak me out. The huge problem with email encryption right now is that you can't reasonably make it mandatory (as you can see, a lots of domain do not support it) so it can be easily be stripped à la sslstrip, and there is no such a thing as HSTS. (Again, please, build pinning into everything.) So an active attacker able to MitM can simply turn encryption off, and those 99.9% make me wonder if that happened…
That problem is quite common on the internet in general. Just think how common ftp still is! We constantly use public networks and then have to mitigate the fact that the packets are public. It would be better to treat encryption like a peering arrangement. When there is sufficient traffic between two large networks all packets should be routed via an encrypted tunnel.
Re: Google releases stats on email encryption in transit
#19The 99.9% freak me out. The huge problem with email encryption right now is that you can't reasonably make it mandatory (as you can see, a lots of domain do not support it) so it can be easily be stripped à la sslstrip, and there is no such a thing as HSTS. (Again, please, build pinning into everything.) So an active attacker able to MitM can simply turn encryption off, and those 99.9% make me wonder if that happened…
STARTTLS seems to work like that joke in Anchorman: It works 60 percent of the time...every time.
Re: Google releases stats on email encryption in transit
#20I'm confused as to why anything isn't 100%. I guess I could maybe understand 0%, but how can it be 50%? I would imagine you either encrypt all email or you don't encrypt any email. What is the in-between?
Take Cisco.com for example. There are a lot of systems there that are sending out emails. Employees and newsletters are probably encrypted but only make up a small portion of their outbound mail. Things like ticket updates are going to result in a huge volume of email. Cisco may have (wrongly) decided that because the ticketing system is a trusted source it doesn't need to be encrypted. So some of their email is going directly out from the tool and some is going through a smart host. This is probably why it's <50%.