Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Gmail Will Warn If Message Is Not Authenticated/Encrypted

gmailblog.blogspot.com

Post reply on HN
Print view View original

151–160 of 216 posts

Re: Gmail Will Warn If Message Is Not Authenticated/Encrypted

#151

Post by caf »

pera wrote: post #83
emergentcypher wrote: post #41

Earlier quoted context omitted.

Now I can just get a free cert and turn on TLS. What's the problem, exactly? Most people are not capable of running their own mail server. The convenience of services like Google, plus the risk of turning your mail box into a spam machine, vastly outweighs the downsides for most people.

My first concern is, if nowadays is so easy to get your certs signed by a CA how can "Authenticated/Encrypted" emails successfully prevent phishing attacks? In my modest opinion there are many week points in X.509 and how CAs are verifying identities, and even if this things were fixed you still have the problem of state-sponsored attacks that have no solution within the current www pki. I personally have no problem…

The use of TLS (which is what uses a CA-issued certificate) isn't to prevent phishing attacks, it's to prevent emails being read or modified in transit.

DKIM (which does not use a CA-issued certificate, it uses a public key published in DNS) is the technology that's intended to authenticate the email sender. It still wouldn't stop phishing attacks where the purported email sender is something like "admin@facebook-account-verification-2016.net" though, and I don't know that there really is a good technical solution to that sort of thing.

Re: Gmail Will Warn If Message Is Not Authenticated/Encrypted

#152

Post by [deleted] »

tantalor wrote: post #126
pera wrote: post #89

Earlier quoted context omitted.

Hi there, I have two questions: first, which CAs will you use? and second, what will you do when a CA gets compromised? Thanks!

This might help: https://support.google.com/mail/answer/21291?hl=en What are the SSL certificate authority requirements? We do not accept self-signed certificates. For a certificate to be valid it needs to chain up to a valid CA, like one in the Mozilla CA list.

[deleted]

Re: Gmail Will Warn If Message Is Not Authenticated/Encrypted

#153

Post by assocguilt »

Sir_Substance wrote: post #31
fwn wrote: post #25

Earlier quoted context omitted.

I never understood this sentiment. I doubt that there is a way to build a webmailer without processing the emails content at some point. And as it is processed anyway; using it to adjust your ads doesn't appear to me as something significant.

>I doubt that there is a way to build a webmailer without processing the emails content at some point. It is disingenuous and/or ignorant to suggest that temporarily loading an email into memory for the purpose of displaying it on the users screen is the same as parsing and catagorising the text and storing the results of the analysis in a database for the purpose of manipulating the user.

Dude, never let anyone that has worked for GCHQ have another job! If the worked for the Gov then they must be evil!!! OMG!!!

Still no comment on Turing?

Re: Gmail Will Warn If Message Is Not Authenticated/Encrypted

#154

Post by jcranmer »

skybrian wrote: post #74
jcranmer wrote: post #64

Unfortunately, this is the sort of a change that's a red herring for any actual improvements to email security. The use of unencrypted or encrypted link to the receiving email provider's MX server doesn't change all that much in terms of who can read the email: it's still sitting in plaintext on the recipient's server (as well as the sender's server), and the group of actors who can sniff traffic on the backbone like…

You're arguing that we shouldn't do anything, instead of taking a step in the right direction. Email is an old ecosystem, so it's not possible to make big improvements all at once.

I'm not arguing that we shouldn't do anything. I'm arguing that the presentation of the data is at best meaningless and at worst downright harmful.

DKIM authentication is in no way an attestation that it was sent by its sender. Furthermore, from what I can tell, more damage is caused by spoofing that works on the "I use a very similar name which is hard to see the difference" level (e.g., animenewsnetwork.com versus animenewssnetwork.com). Finding and testing solutions to that problem is something that doesn't require changing or deploying anything to new to the ecosystem, and it would arguably bring more benefit than deploying end-to-end encryption.

Re: Gmail Will Warn If Message Is Not Authenticated/Encrypted

#155

Post by linkregister »

NeutronBoy wrote: post #104
linkregister wrote: post #94

Earlier quoted context omitted.

I'm sure that Australian Federal Police and Victoria law enforcement would be able to exercise search warrants on Fastmail's servers if they needed to. Since you're in Tennessee (and thus a U.S. Person), you're actually ineligible for collection under FAA 702. Gmail/Hotmail/Yahoo, etc. would actually be the safest place for your information. Of course that assumes that you believe the NSA follows U.S. law. If you don…

> I'm sure that Australian Federal Police and Victoria law enforcement would be able to exercise search warrants on Fastmail's servers if they needed to. Nobody is arguing against search warrants. People are concerned about warrantless searches.

Nobody in this thread mentioned warrants. It appears that all the posters here care about the disclosure of their information, full stop.

Re: Gmail Will Warn If Message Is Not Authenticated/Encrypted

#156

Post by thrownaway2424 »

jcranmer wrote: post #64

Unfortunately, this is the sort of a change that's a red herring for any actual improvements to email security. The use of unencrypted or encrypted link to the receiving email provider's MX server doesn't change all that much in terms of who can read the email: it's still sitting in plaintext on the recipient's server (as well as the sender's server), and the group of actors who can sniff traffic on the backbone like…

There's a lot of supposition in your post and no evidence in favor. First of all what makes you think Gmail stores user data in plain text at rest? Secondly think about your definition of "backbone" networks. Google's own network is extremely large in scope, and generally user traffic lands in Google's network at a point very close to the user. For example if a user in Japan sends mail to Google, that connection will be terminated in Japan, and backhauled across Google's network to wherever the actual servers are located. Google intentionally shrinks the scope of network surveillance by minimizing the network distance between the user and Google's frontends.

Re: Gmail Will Warn If Message Is Not Authenticated/Encrypted

#157

Post by inopinatus »

Lunatic666 wrote: post #149
inopinatus wrote: post #141

Earlier quoted context omitted.

I'm in the same boat as you - running a personal/friends/family mail toaster for 16 years now. But I disagree that Google have made the administration harder. Internet mail servers don't live in isolation, and context has always been changing. I have no issue with adapting configuration as expectations change, so Gmail's evolution has never inhibited my ability to exchange email with the world. This move is no differ…

That's not right, I host some email servers for small companies and private people who all have problems with Google accounts although supporting DKIM, SPF and a TLS connection. They block them as bulk mail and in their FAQ the option hosting your own server isn't even listed. Of course contacting them is impossible, so the only way left is creating a ton of fake accounts on gmail and add the addresses to their conta…

Maybe they have a reputation system in which I've gained a good standing and you haven't. Have you considered that your attempts to game their system have actually been regarded as abuse?

Re: Gmail Will Warn If Message Is Not Authenticated/Encrypted

#158

Post by asquabventured »

ksk wrote: post #43

Its great that Google wants all the lines carrying data from their servers to be secure and tamper proof. It would be interesting to see if they ever support end to end encryption which would lock them out of scanning the data as well.

lol

Re: Gmail Will Warn If Message Is Not Authenticated/Encrypted

#159

Post by asquabventured »

MicroBerto wrote: post #15

In my opinion, you should just behave like your emails are public record. This is the best way of approaching that technology.

Not only email[full stop] all your comments[full stop] on anything electronic.

#chillingeffect

Welcome to 2016

Re: Gmail Will Warn If Message Is Not Authenticated/Encrypted

#160

Post by shkkmo »

Lunatic666 wrote: post #149
inopinatus wrote: post #141

Earlier quoted context omitted.

I'm in the same boat as you - running a personal/friends/family mail toaster for 16 years now. But I disagree that Google have made the administration harder. Internet mail servers don't live in isolation, and context has always been changing. I have no issue with adapting configuration as expectations change, so Gmail's evolution has never inhibited my ability to exchange email with the world. This move is no differ…

That's not right, I host some email servers for small companies and private people who all have problems with Google accounts although supporting DKIM, SPF and a TLS connection. They block them as bulk mail and in their FAQ the option hosting your own server isn't even listed. Of course contacting them is impossible, so the only way left is creating a ton of fake accounts on gmail and add the addresses to their conta…

Huh, I've had more problems with other blocklists, but never with google. It certainly can be a pain. We need something simple, maybe sort of like EV SSL certs, to allow more painless establishment of email sending reputation on new IPs and domains.
Post reply on HN