Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Google releases stats on email encryption in transit

google.com

Post reply on HN
Print view View original

21–30 of 53 posts

Re: Google releases stats on email encryption in transit

#21

Post by FiloSottile »

higherpurpose wrote: post #19
FiloSottile wrote: post #7

The 99.9% freak me out. The huge problem with email encryption right now is that you can't reasonably make it mandatory (as you can see, a lots of domain do not support it) so it can be easily be stripped à la sslstrip, and there is no such a thing as HSTS. (Again, please, build pinning into everything.) So an active attacker able to MitM can simply turn encryption off, and those 99.9% make me wonder if that happened…

STARTTLS seems to work like that joke in Anchorman: It works 60 percent of the time...every time.

Worse, it works 100%... 99.9% of the times.

The other times, it's when someone wants it not to work.

Re: Google releases stats on email encryption in transit

#23

Post by sjbach »

Twirrim wrote: post #12
DiabloD3 wrote: post #6

Earlier quoted context omitted.

Probably because it allows connections that aren't perfectly secure, such as supporting anything less than 256 bits.

That wouldn't explain why Google would have difficulty. It implies some kind of inconsistency in configuration or something on the servers Google's sending email to?

Transit encryption requires that both sides are game. Google always supports it, but the server on the other side may not.

Re: Google releases stats on email encryption in transit

#24

Post by jonlarson »

sp332 wrote: post #2

Why is hotmail between 50% and 90%?

That's a good question. I've been involved with some research, outside of Google, on this exact topic. Because we don't have the same data sets that Google has, we have a slightly different methodology for gathering data and we found that hotmail (or any Microsoft mail provider) never even has the option to encrypt if you want to. We always though it was strange that they didn't, and this new data seems to suggest that there may be something else going on.

One possibility that was already pointed out is heterogeneous architectures. It's possible that different systems in hotmail, maybe in different geographic regions or across national borders, use encryption.

Re: Google releases stats on email encryption in transit

#25

Post by lugg »

FiloSottile wrote: post #7

The 99.9% freak me out. The huge problem with email encryption right now is that you can't reasonably make it mandatory (as you can see, a lots of domain do not support it) so it can be easily be stripped à la sslstrip, and there is no such a thing as HSTS. (Again, please, build pinning into everything.) So an active attacker able to MitM can simply turn encryption off, and those 99.9% make me wonder if that happened…

> The huge problem with email encryption right now is that you can't reasonably make it mandatory

Sure you can, see pgp.

Really, its nice to see they are encrypting coms between each other but I don't really see how this affects me. If I want something secure I will use pgp. Email encryption, has and, always will be a client side problem. There is nothing the middle men and women can do for you that you can reasonably trust.

If google really wants to solve this problem they will make pgp features native to gmail. I'm guessing they're heading that way with the chrome extension being discussed here at the minute[1].

[1] https://news.ycombinator.com/item?id=7842696

Re: Google releases stats on email encryption in transit

#26

Post by lugg »

FiloSottile wrote: post #21
higherpurpose wrote: post #19

Earlier quoted context omitted.

STARTTLS seems to work like that joke in Anchorman: It works 60 percent of the time...every time.

Worse, it works 100%... 99.9% of the times. The other times, it's when someone wants it not to work.

My guess is dem pesky 99.9% sla's and routing around the downtime in some way.

Re: Google releases stats on email encryption in transit

#28

Post by kijin »

I wonder what's happening on weekends?

Every weekend, the percentage of encrypted outbound mail decreases, but the percentage of encrypted inbound mail increases. If you click on "90 days", you can see that this trend has been going on for quite some time.

Could this be due to the difference between the usage patterns of work email vs. personal email? Or could it be a specific email service provider (or providers) who do something differently during weekends?

Re: Google releases stats on email encryption in transit

#29

Post by SilasX »

FiloSottile wrote: post #7

The 99.9% freak me out. The huge problem with email encryption right now is that you can't reasonably make it mandatory (as you can see, a lots of domain do not support it) so it can be easily be stripped à la sslstrip, and there is no such a thing as HSTS. (Again, please, build pinning into everything.) So an active attacker able to MitM can simply turn encryption off, and those 99.9% make me wonder if that happened…

But email providers don't need end user cooperation to implement intra-provider encryption, i.e. encryption of intermediate hops before it's finally read. (If you email another gmail user, Google can keep the whole voyage encrypted, and likewise if you email a Yahoo user after they agree to encrypt email between the services.)

Yes, such schemes are leaky, as they allow the attacker to read it at any link between providers that haven't cooperated to set up a secure link. And it probably doesn't change the "expectation of privacy" issue, as the provider will be applying encryption to the plaintext, but it decreases the attack surface without requiring end user action.

Post reply on HN