11–20 of 97 posts
Now they won't allow aws at all and everything is in chaos.
Earlier quoted context omitted.
It would be great to have a service that could manage your mailserver configuration, tracking reputation & avoiding spam, while not having any access at all to the data itself.
Is there any way to tell if a particular email is spam, without knowing the content or the sender of said email?
https://en.wikipedia.org/wiki/Fully_homomorphic_encryption
https://en.wikipedia.org/wiki/Secure_multi-party_computation
There is a huge amount of interest among cryptography researchers and from DARPA and the NSF.
Seems odd that someone wouldn't have understood that even 10-15 years ago. Outsourced means being exposed to risk from your supplier -- by the company itself, by its employees, or by governments. Gmail has somewhat better technical security to protect from outside non-state hackers than your average self-hosted exchange server, and from insiders (the IT guy, like Snowden, may not have the same goals as the organizati…
I wonder if this problem is particularly acute for Eastern European companies who often sell their products to despicable despotic regimes.
Earlier quoted context omitted.
Is there any way to tell if a particular email is spam, without knowing the content or the sender of said email?
If all your actual email is encrypted then by definition spam is the unencrypted stuff. A long time ago in a different galaxy I built a PGP MTA (based on sendmail at the time) which only forwarded mail that was encrypted, and as expected it was spam free, all though these days spammers just might go to the trouble of sending it encrypted if they thought it would get through.
People who target your company and employees specifically, maybe not. But even this could be made more difficult for spammers by only allowing access to your public key directory from trusted IP ranges.
It's also a great idea from the standpoint of giving an encryption policy teeth. I'm thinking of a company where the official line is "We encrypt all our email," but then some IT screwup results in having half the company sending each other cleartext email for several quarters before anybody notices.
If your mailservers reject unencrypted mail, the above scenario can't happen, because presumably people will notice when everyone's mail starts getting discarded, and it'll be fixed very quickly.
Seems odd that someone wouldn't have understood that even 10-15 years ago. Outsourced means being exposed to risk from your supplier -- by the company itself, by its employees, or by governments. Gmail has somewhat better technical security to protect from outside non-state hackers than your average self-hosted exchange server, and from insiders (the IT guy, like Snowden, may not have the same goals as the organizati…
I think he understood the risks, but basically took it as fact that the US was beholden to decent privacy laws restricting access to private (and encrypted) communications like email. One of the main arguments for using Google apps in the past is the technical level of Google's security, and protection from being hacked. But the NSA/prism leaks have raised a new question in peoples minds, in favour of keeping things…
A lot of this was just a quick Google search away, and would have been just as relevant the very year GMail was introduced.
Likewise there's no theoretical reason to trust internal Google policy controls over U.S. government legal and policy controls. Even if what the author thought had been true about U.S. law actually was true, he'd still have been setting his customer up for the possibility of having their confidential data leaked (maliciously or not) or hacked into (e.g. by the always-vulnerable password reset function).
That's not just a nitpick either. There have been a couple of services at work I would have liked to setup on something like Digital Ocean, Basecamp Breeze, etc. that I can't because of PII concerns.
So while I'm sorry that the author made wrong assumptions I don't know what to tell him other than IANAL isn't just a five-letter acronym, and "due diligence" doesn't simply mean "hire a contractor to think about this for me".
Earlier quoted context omitted.
Is there any way to tell if a particular email is spam, without knowing the content or the sender of said email?
It could be a crowd-sourced effort -- e-mails that are spam you mark as spam and upload to some repo that is maintained by someone (a la Adblock). You keep your filters updated, and run your e-mail against the filters file.
I wonder if this problem is particularly acute for Eastern European companies who often sell their products to despicable despotic regimes.
Earlier quoted context omitted.
It could be a crowd-sourced effort -- e-mails that are spam you mark as spam and upload to some repo that is maintained by someone (a la Adblock). You keep your filters updated, and run your e-mail against the filters file.
That's how current spam filters work, every mail server reports back to some central directories which keep tab on IPs, common subjects, keywords and other characteristics used to calculate spam scores. The trick is doing that without giving out access to message content to third-parties. http://en.wikipedia.org/wiki/The_Spamhaus_Project