31–40 of 53 posts
Interesting to see peaks on weekends. Guessing more private (person-to-person) traffic, so more traffic to/from domains that encrypt?
I wonder what's happening on weekends? Every weekend, the percentage of encrypted outbound mail decreases, but the percentage of encrypted inbound mail increases. If you click on "90 days", you can see that this trend has been going on for quite some time. Could this be due to the difference between the usage patterns of work email vs. personal email? Or could it be a specific email service provider (or providers) wh…
The 99.9% freak me out. The huge problem with email encryption right now is that you can't reasonably make it mandatory (as you can see, a lots of domain do not support it) so it can be easily be stripped à la sslstrip, and there is no such a thing as HSTS. (Again, please, build pinning into everything.) So an active attacker able to MitM can simply turn encryption off, and those 99.9% make me wonder if that happened…
> The huge problem with email encryption right now is that you can't reasonably make it mandatory Sure you can, see pgp. Really, its nice to see they are encrypting coms between each other but I don't really see how this affects me. If I want something secure I will use pgp. Email encryption, has and, always will be a client side problem. There is nothing the middle men and women can do for you that you can reasonabl…
I need to worry about where my organization's email goes, because quite simply, people do dumb things. Things like put payment information in email. Or PII subject to HIPPA or some other regulatory regime.
Secure SMTP gives me no solace whatsoever, because even if I ensure that my receiving party's email gateway is secure, I have no assurance that any relaying happening behind that gateway is secure to the standards that I need to meet. For example, under many corporate security policies, MPLS tagged connections between offices is deemed secure -- they trust the telco. My organization requires an encrypted link or fiber owned and managed by the organization.
IMO, you're better off operating under the assumption that your email is a postcard, because it is. Sensitive information should be shared in this order: in person, in a registered paper letter (the US government permits material up to the secret level via this means), first class mail, on the phone, via internal IT systems to other internal recipients, via homing pigeon, email.
Earlier quoted context omitted.
> The huge problem with email encryption right now is that you can't reasonably make it mandatory Sure you can, see pgp. Really, its nice to see they are encrypting coms between each other but I don't really see how this affects me. If I want something secure I will use pgp. Email encryption, has and, always will be a client side problem. There is nothing the middle men and women can do for you that you can reasonabl…
But Google likes to read your email so they can target ads. Even they don't want you to encrypt on the client.
Earlier quoted context omitted.
> The huge problem with email encryption right now is that you can't reasonably make it mandatory Sure you can, see pgp. Really, its nice to see they are encrypting coms between each other but I don't really see how this affects me. If I want something secure I will use pgp. Email encryption, has and, always will be a client side problem. There is nothing the middle men and women can do for you that you can reasonabl…
But Google likes to read your email so they can target ads. Even they don't want you to encrypt on the client.
Interesting to see peaks on weekends. Guessing more private (person-to-person) traffic, so more traffic to/from domains that encrypt?
Earlier quoted context omitted.
> The huge problem with email encryption right now is that you can't reasonably make it mandatory Sure you can, see pgp. Really, its nice to see they are encrypting coms between each other but I don't really see how this affects me. If I want something secure I will use pgp. Email encryption, has and, always will be a client side problem. There is nothing the middle men and women can do for you that you can reasonabl…
But Google likes to read your email so they can target ads. Even they don't want you to encrypt on the client.
• Take Google's list of mail domains they see (they offer a CSV file for download) and look up all of the mail exchangers for all of the domains.
• Remove duplicates from the list of MX hostnames.
• Write a short program that does the following for each of those mail exchangers:
- Connect to tcp/25, send a valid EHLO, and see if the server indicates that it supports STARTTLS.
- If it doesn't, disconnect and move on to the next hostname.
- Send STARTTLS and start a TLS session. Put a NULL cipher at the top of your client's ciphersuite list to see if anyone bites. Record the certificate chain the server sends.
- See if the leaf certificate is valid and if you can make it actually chain up to a trusted CA via the server's certificate chain.
- Disconnect.
You now have a list of some of the largest mail exchangers on the Internet, whether or not each one supports STARTTLS, and whether or not each one supplies a (valid) certificate that actually chains up to a CA anyone trusts. Write a blog post containing pretty graphs for these statistics. Poke fun at the most egregiously broken TLS configurations, certificates, and certificate chains you see. Idly wonder if the proliferation of (sometimes completely broken) opportunistic TLS with SMTP and the relative scarcity of authenticated TLS with SMTP will push passive attackers into becoming active attackers so they can continue to easily grab messages in-flight. Bemoan the broken CA system. Drink heavily. Dream.