What steps do Gmail, Yahoo! Mail, and Hotmail take to prevent eavesdropping on email?

Question

I would like to ask what happens when an email is sent from gmail, yahoo or hotmail public web email services?

I don't understand email protocols in details, but as far as I know email traffic is unencrypted and the messages are passed along many mail servers (in plain text) before reaching their destination server. However, this was questioned recently by other people, and their view was that if one of the big providers is used, the email messages are encrypted and there is no need to worry about security.

Do you know if they are right about this and are emails moderately secure? Thank you!

Answer 1

An SMTP session between two mail servers may be encrypted, but only if both ends support it and if both ends choose to use it. So if you're sending mail from Gmail to example.net, then Google could only encrypt if example.net was ready and willing. For this reason, you cannot trust email to be even moderately secure at the transport layer. (The only safe end-to-end method is to encrypt your email using S/MIME or PGP, but the people you're exchanging email with need to be on board too... just like the mail servers).

As to whether the big three are performing opportunistic STARTTLS, I haven't seen any evidence of it, but I spend less time reading my mail server logs than I used to. And if they are, they're still only half of every SMTP connection they make, and cannot guarantee the use of encryption.

Update:

I just banner tested MX hosts for gmail.com, yahoo.com, and hotmail.com. Only gmail advertises STARTTLS, which is to say, only gmail would be willing to encrypt the SMTP session if the other party wanted to.

I tested gmail outbound by sending mail to a server I own and watching the wire; Google does indeed take advantage of STARTTLS if it is offered and encrypts the SMTP transaction when a gmail user is sending mail. Props to Google.

So as far as "sending" email encryption goes: Google 1, Yahoo 0, Microsoft 0.

Answer 2

There's two different questions here:

1. Does the email system allow emails to be sent to it over an encrypted channel and send email along an encrypted channel when the recipient's mail server supports it.
2. Does the email system encrypt the contents of a mailbox when displaying it to the owner.

gownfawr addresses (1) well.

Gmail does encrypt via default for (2) so when viewing your mail, by default it is done via HTTPS, so a snooper will not be able to observe gmail sending the mail to your browser. I believe the others have not yet followed suite. (Full disclosure, I work for Google).

Gmail is set to use the 'Always use https' setting by default, ...

"Make Your Webmail More Secure" has instructions for avoiding plain-text reads of a mailbox for a number of large webmail providers, but I cannot vouch for it being up-to-date.

Answer 3

There are three points in the chain you need to consider: Transport between mail servers (e.g. between Google and example.org), transport between mail servers and clients, and the mail servers themselves.

Traffic between mail servers may or may not be encrypted; you shouldn't rely on it, and AFAIK, there is no way to enforce it from the client.

Traffic between clients and mail servers may or may not be encrypted; if you connect over SSL (either via a web interface or SMTP), your end of the chain is secure, but you can't say anything about the recipient. Conversely, if you're the recipient, you can fetch mail securely, but if the sender (or anyone in the CC/BCC) doesn't do the same, then there's your leak.

And finally, there's the mail servers themselves. If someone hacks into them, or social-engineers their way in, and the mail server stores content unencrypted, then again you're out of luck.

TL;DR: Unless you control the entire chain (both clients, and all mail servers involved), which is practically never the case, the only way to send emails with reliable security is to encrypt and decrypt locally, using something like PGP.