Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Gmail Will Warn If Message Is Not Authenticated/Encrypted

gmailblog.blogspot.com

Post reply on HN
Print view View original

101–110 of 216 posts

Re: Gmail Will Warn If Message Is Not Authenticated/Encrypted

#101

Post by dhimes »

mgbmtl wrote: post #24
Esau wrote: post #19

Earlier quoted context omitted.

That's what I do as email is more akin to a postcard than a letter. If that makes someone uncomfortable, then they should choose another medium.

This is what GMail is doing: making sure that sending an email is like sending a letter (instead of a postcard). TLS email is not 100% secure (private, authenticated, etc), but not 100% insecure either. Verifying TLS for email is an easy step in making email a bit less insecure, and it requires no intervention from users. If you need something secure, then yes, go for GnuPG or other forms of end-to-end encryption (if…

When I saw the HN headline, I thought they were going to start enforcing the PGP encryption. I think I had a small medical event...

Re: Gmail Will Warn If Message Is Not Authenticated/Encrypted

#102

Post by cromwellian »

Sir_Substance wrote: post #52
cromwellian wrote: post #50

Earlier quoted context omitted.

How do you run an efficient server-side search without maintaining a parsed index? I have 40,000 emails in my inbox. You want this to be linearly scanned everytime?

Yeah, I really do, it'd be funny as hell. Jesus fuck man, clean your inbox.

My inbox is clean, those emails are archived. I still want to search them.

Re: Gmail Will Warn If Message Is Not Authenticated/Encrypted

#103

Post by cromwellian »

nyan4 wrote: post #57
cromwellian wrote: post #50

Earlier quoted context omitted.

How do you run an efficient server-side search without maintaining a parsed index? I have 40,000 emails in my inbox. You want this to be linearly scanned everytime?

Indexing for search != parsing for advertisement.

Once you have to index or parse the email for search, it can no longer be stored as ciphertext, that is, end to end encryption interferes with search.

At best, you could search headers if they aren't encrypted.

Until a viable ciphertext search scheme arrives. (there are some, but everyone I've seen has some caveat or hole)

Re: Gmail Will Warn If Message Is Not Authenticated/Encrypted

#104

Post by NeutronBoy »

linkregister wrote: post #94
keehun wrote: post #67

Earlier quoted context omitted.

+1 for fastmail, here, too. Amazing service, really good communication during rare downtime, contributes heavily to open-source/community, decent prices, can heavily customize filters/etc, and as far as I'm aware, probably the most mainstream email provider that won't give into the NSA.

I'm sure that Australian Federal Police and Victoria law enforcement would be able to exercise search warrants on Fastmail's servers if they needed to. Since you're in Tennessee (and thus a U.S. Person), you're actually ineligible for collection under FAA 702. Gmail/Hotmail/Yahoo, etc. would actually be the safest place for your information. Of course that assumes that you believe the NSA follows U.S. law. If you don…

> I'm sure that Australian Federal Police and Victoria law enforcement would be able to exercise search warrants on Fastmail's servers if they needed to.

Nobody is arguing against search warrants. People are concerned about warrantless searches.

Re: Gmail Will Warn If Message Is Not Authenticated/Encrypted

#105

Post by bsder »

KirinDave wrote: post #78
etiam wrote: post #70

Earlier quoted context omitted.

More worrisome, "Your message has been added to your permanent record at wholesale data storage and may be used against you, in perpetuity, by current and/or future regimes, partner corporations and other select criminal organizations (tax-funded or independent) for reasons including but not limited to financial or political gain, manipulation, incrimination, assassination and personal entertainment."

Which is different from any other email provider in any substantial way (including your local ISP or personal server) because... they have a reasonable hope for reliable storage? Seriously: this is calling out Google in a way that's comical since it's equally applicable to your own computer.

> Which is different from any other email provider in any substantial way (including your local ISP or personal server) because...

Single point of failure.

Government entities have to go through physical work to seize multiple mail servers distributed geographically. This keeps the cost of fishing expeditions high enough that they won't just do it by default.

With everything at Gmail, Yahoo, and Microsoft, you only need to serve 3 entities, who already are known to roll over.

However, far more concerning to the HN crowd should be this fact: Do you want the companies most likely to buy you out for a large value to be the ones holding all of your internal emails?

At this point, Google probably knows more about the quality of business than the businesses do. It would be an interesting question as to whether Google could be considered a corporate insider for a vast number of companies.

Re: Gmail Will Warn If Message Is Not Authenticated/Encrypted

#106

Post by chii »

mynameisvlad wrote: post #82
Navarr wrote: post #80

Earlier quoted context omitted.

These aren't requirements. Gmail is a mail client. What it is doing is adding warnings. Without SPF/DKIM you can't be authenticated. Google is showing the user that they cannot verify the sender. Without TLS email is sent in the clear. Google is showing the user that sensitive information will be visible when sent over the network. You can run your server fine without this, but users will be warned that you're not fo…

> These aren't requirements Well, except they are. Before, yes, they were just best practices. It was great if you had them but by no means required and didn't really impact your experience much if at all. With this switch, though, they became requirements to getting a "normal" experience in Gmail. Even having a warning is a degraded experience at this point.

I don't think there's anything wrong with gmail upping the game. It's not like they are using tech that no one else can get.

If I ran a restaurant that provided extra services, that doesn't stop anyone else from opening a restaurant and provide similar levels of service.

Re: Gmail Will Warn If Message Is Not Authenticated/Encrypted

#107

Post by striking »

vonklaus wrote: post #48
joshstrange wrote: post #40

Earlier quoted context omitted.

Couldn't agree more. I run a number of my own services on my own servers but email is not one of them. I don't have the time or energy to keep up with it and it's imperative that I receive all emails sent to me and all my sent emails are received. Google apps does that perfectly for me and I don't have to worry about it. As far as "I take issue with Google making the decision that everyone is going to switch, now and…

To play devil's advocate, why is email shit? It is pretty much a way to send someone a document in the original way Berners Lee defined html which was essentially sgml. I get not letting people mail active scripts, but every large mail provider also makes a browser. So email is shitty because providers fuck with it at the mailserver level (i think this is the case, and have heard that about providers) as it doesn't s…

Email is also far less instantaneous and is locked into a single kind of infrastructure. It's useful for only one thing.

I don't think it needs to be changed, really. It will stay this useful forever, probably.

Re: Gmail Will Warn If Message Is Not Authenticated/Encrypted

#108

Post by KirinDave »

bsder wrote: post #105
KirinDave wrote: post #78

Earlier quoted context omitted.

Which is different from any other email provider in any substantial way (including your local ISP or personal server) because... they have a reasonable hope for reliable storage? Seriously: this is calling out Google in a way that's comical since it's equally applicable to your own computer.

> Which is different from any other email provider in any substantial way (including your local ISP or personal server) because... Single point of failure. Government entities have to go through physical work to seize multiple mail servers distributed geographically. This keeps the cost of fishing expeditions high enough that they won't just do it by default. With everything at Gmail, Yahoo, and Microsoft, you only n…

> Single point of failure.

Okay?

> Government entities have to go through physical work to seize multiple mail servers distributed geographically. This keeps the cost of fishing expeditions high enough that they won't just do it by default.

Except they seem pretty seize-happy and the only thing protecting your house is the say-so of a judge.

> With everything at Gmail, Yahoo, and Microsoft, you only need to serve 3 entities, who already are known to roll over.

That seems quite unfair, as at least 2 have been very public about their expenditures to try and make such attacks impossible in the future, and have vocally fought subpoenas.

> Do you want the companies most likely to buy you out for a large value to be the ones holding all of your internal emails?

Yes. The lawsuit should I discover it would probably make me richer and more famous than all the buyout events I've experienced.

Re: Gmail Will Warn If Message Is Not Authenticated/Encrypted

#109

Post by infogulch »

skybrian wrote: post #74
jcranmer wrote: post #64

Unfortunately, this is the sort of a change that's a red herring for any actual improvements to email security. The use of unencrypted or encrypted link to the receiving email provider's MX server doesn't change all that much in terms of who can read the email: it's still sitting in plaintext on the recipient's server (as well as the sender's server), and the group of actors who can sniff traffic on the backbone like…

You're arguing that we shouldn't do anything, instead of taking a step in the right direction. Email is an old ecosystem, so it's not possible to make big improvements all at once.

Another case where The Perfect is the enemy of The Good.

Baby steps, people.

Re: Gmail Will Warn If Message Is Not Authenticated/Encrypted

#110

Post by lmm »

Navarr wrote: post #80
jcoffland wrote: post #30

This sounds great but Google has been making it harder and harder to run your own mail server even for personal use. I think they would be happy of email servers were only run by a few large companies. They make it sound like they are doing the right thing but really they are bully the industry to do it their way. So many people have Gmail accounts that you can't run an email server that cannot send email to Google.…

These aren't requirements. Gmail is a mail client. What it is doing is adding warnings. Without SPF/DKIM you can't be authenticated. Google is showing the user that they cannot verify the sender. Without TLS email is sent in the clear. Google is showing the user that sensitive information will be visible when sent over the network. You can run your server fine without this, but users will be warned that you're not fo…

No, best practices are to avoid using any of that and trusting anyone's servers. S/MIME if you trust the CA system, PGP if you don't. Supporting either of those would be a real step forward for privacy - but of course if Google can't snoop on your email then it's not helping them target their ads.
Post reply on HN