Tag Info

Hot answers tagged

154

It's not just about you. By forcing users to use TLS, they're creating a more secure environment for everyone. Without TLS being strictly enforced, users are susceptible to attacks such as sslstrip. Essentially, making unencrypted connections an option leads to the possibility of attackers forcing users into unencrypted connections. But that's not all. ...


78

Let me rephrase your question with a few extra details, which are implicit but maybe not obvious to everybody: "Isn't Google being Evil by providing me with a free email service and gigabytes of storage and forcing me into a secure connection when I access that service which they have generously granted to me and that nobody forces me to use even if I don't ...


20

Yes, this email is a scam. Ignore it! I work at a major web hosting firm, and our customers receive these emails on a frequent basis. There are a number of characteristics that are visible from this perspective which confirm that they are a scam: The emails are never sent by a recognizable, reputable domain registrar. Most of them use generic names, such ...


14

In fact, no, Google is not evil with this, not at all. The first important thing about this is that the use of secure connection is not a user preference or some personalized setting. Some people might find this confusing because they are familiar with a system only from the position of an end-user. Being a software developer myself, I can tell you that ...


10

Evil for forcing you to use a secure connection? No, I don't think it's evil. It protects the community at large with no downside to you as an individual. I think its only evil if they're forcing you to use SSL/TLS, then failing to use forward secrecy, thus giving you and everyone else using the service a false sense of security. Without forward secrecy, ...


8

It's sad that people's first reaction is to defend Google by using the "you don't HAVE to use it" fallacy. As for transaction of money, don't you think your own personal information which they sell to advertisers has monitory value? Google isn't free, it still requires a payment which most people don't even realize they are making. Now, to answer the ...


7

Yes, this email is a scam. I have received several in the past, and once I played along with them for amusement. I expressed interest in registering the domain names that were 'under dispute', and they sent me a pricelist for various .cn, .tw, .hk, and .in domains, ranging from USD $40 to $80 per year. They also offered me 'trademark protection' for USD ...


6

Google not only protects you and your data, but also themselves. The vast majority of internet users out there does not know about security, and does not care about. When offering any insecure path as fallback, user's would use it, and if it is some man-in-the-middle breaking everything else. If your account is compromised, that's not only a problem for ...


6

Software companies and email providers Default support for PGP from Microsoft (Outlook.com and the Outlook mail client), Apple (default support in iOS and OSX), Yahoo and Gmail. They should make people aware, and create pgp-wizards to set it up with a few steps. Google can make this happen, but they have a conflict of interest, bigger than Apple or MS. ...


4

The domain name that is used for the email address of a scammer may be only loosely related to the scammer himself. E.g. if a scammer uses an Hotmail address, would you conclude that Microsoft (the owner of Hotmail) is an accomplice ? Probabilities are quite high that the names and addresses indicated in the whois database are fake, or point to an innocent ...


3

If you want just email encryption it would probably be enough that the major mail providers include an S/MIME certificate with each mail address and use it by default inside their web interface and make it easy to use in standard mail clients. But, if you want real security and not just encryption you have to start somewhere else. The major problem is not ...


3

My amateur take on this Technically I think in short that cryptography needs to be made easier to use. This could happen if companies like Google, Microsoft, Yahoo, Facebook, etc. implemented cryptography on their web based email. While cryptography already has been made very easy (there are for example Firefox extensions/add-ons that make it easy), it ...


3

Googles hands are tied. Google arent just doing it to protect you. They are doing it to protect themselves. They dont want other people to mess with your stuff because they are carrying it for you, and they have a whole lot of legal obligations that come with hosting other peoples stuff. They are obligated to prevent any account being used in a way that ...


2

Malware in an email can theoretically compromise your system even if you don't open it. Every mail that comes in is processed to some degree, and vulnerabilities in the email program could be used my embedded malware. This has happened in the past IIRC, several years ago, and I believe it had to do with image processing. Currently there are no published ...


2

As others say, normally you have nothing to lose by using encryption instead of non-encryption, even if you think you don't need encryption. But if you really want to access it non-encrypted (perhaps to prove to someone observing your line that you are doing nothing evil), you could set up some HTTP server, which itself connects to Google by HTTPS, and ...


2

You can subscribe to the US-CERT maillist It provides a variety of products. Covers mainly below four topics: Alerts - timely information about current security issues, vulnerabilities, and exploits Bulletins — weekly summaries of new vulnerabilities. Patch information is provided when available Tips - advice about common security issues for the general ...


2

For this your main concern is making sure that the information is only accessible to the intended recipient; which sounds a lot like what public cryptography / PGP tries to achieve. Unless you want to see if the target non-user has a PGP key published, or if you can get his certificate to encrypt the email with his public key; I think you'd just need to ...


1

It sounds like a phishing email to me. If it was a real company asking for confirmation, they would only require confirmation action by you in order to approve the 'registration' and would not require action on your part in order to disapprove the 'registration'. Also, the whole premise is bogus. The internet is free to register domain names even if they ...


1

An example is Italy's "Posta Certificata": a web mail that by law guarantees the recipient is a real person: https://www.postacertificata.gov.it/home/index.dot To activate it you need to go to a post office and provide an ID card. This shifts the problem to a different domain: ID cards and all their associated issues: how can we be sure that the Post ...


1

On top of what others have suggested, there's one fundamental issue here: the human side. It's not a matter of tooling or mathematical background. We have these already. What we need is to get out of For e-mail encryption to go mainstream, it needs to be the path of least resistance. As in - encrypt by default, transparently, unless the user explicitly ...


1

Lets take a step back. If we added some form of TLS that allowed for an "On The Fly" key exchange like we have with SSL web sites, this would already be a big step forward. Yes, PGP and related technologies that would keep your email from curious ISP's as well is an even better step forward, using an SSL/TLS style tunnel to move data between mail servers ...


1

File name "extensions" are immaterial. There is no real standard for these few letters, only loosely maintained traditions. The PKCS#7 standard (now called CMS) describes how to encode and decode signed and/or encrypted and/or authenticated "messages" into sequences of bytes. How these sequences of bytes are stored or exchanged is completely out of scope; in ...


1

Security advisories are normally posted by the project maintainers. In the case of Heartbleed, that would be the OpenSSL team. You should subscribe to the Project Announcements mailing list at https://www.openssl.org/support/community.html. This OpenSSL mailing list (linked to above) will only address security vulnerabilities (and project releases) ...


1

TL;DR: It's better, but it's not good enough. The chance of having a tapped connection versus the costs of this type of security are obvious and require no further consideration than "yes this is required". It is vital to remember that SSL might not be perfect and the implementations are very unlikely to be waterproof. Additionally, especially in a case ...


1

It is not as secure as it most likely should be, though there are occasional justifiable reasons for storing a password in clear-text (for example, unattended third party service access when authorization token's aren't an option). It is certainly not secure to provide the decrypted password back to the user EVER.



Only top voted, non community-wiki answers of a minimum length are eligible