Tag Info

New answers tagged

1

On top of what others have suggested, there's one fundamental issue here: the human side. It's not a matter of tooling or mathematical background. We have these already. What we need is to get out of For e-mail encryption to go mainstream, it needs to be the path of least resistance. As in - encrypt by default, transparently, unless the user explicitly ...


0

It's nontrivial for two highly technical people to exchange email with your requirements satisfied. Accomplishing that for communications between embedded devices and people who are managing them is mind-boggling. Encrypting content is the simplest requirement. OP could use GnuPG, and give each device a unique private key. Or as Basic suggested, OP could use ...


0

This depends on what you mean by "source and destination ip address." Regular internet email based on SMTP records a list of IP addresses in the headers of a message as the message traversers from one "Mail Transfer Agent" (MTA) to another. You probably think of these as "mail servers." It's not uncommon for a single message to transit several MTAs ...


0

Secure email LOL. Cryptography requires keys, and essentially the average person is just too stupid to use them properly. Until we have the technology to build a pervasive system where you somehow are the key, and whatever computer you use to send "messages," email, text, voice, video, etc, can consistently recognize you as your crypto key, encryption just ...


1

An example is Italy's "Posta Certificata": a web mail that by law guarantees the recipient is a real person: https://www.postacertificata.gov.it/home/index.dot To activate it you need to go to a post office and provide an ID card. This shifts the problem to a different domain: ID cards and all their associated issues: how can we be sure that the Post ...


1

Lets take a step back. If we added some form of TLS that allowed for an "On The Fly" key exchange like we have with SSL web sites, this would already be a big step forward. Yes, PGP and related technologies that would keep your email from curious ISP's as well is an even better step forward, using an SSL/TLS style tunnel to move data between mail servers ...


0

Any service you pay for has to know your billing and CC information. They also care who you are because if they stop providing service to you, they stop getting money.


3

If you want just email encryption it would probably be enough that the major mail providers include an S/MIME certificate with each mail address and use it by default inside their web interface and make it easy to use in standard mail clients. But, if you want real security and not just encryption you have to start somewhere else. The major problem is not ...


3

My amateur take on this Technically I think in short that cryptography needs to be made easier to use. This could happen if companies like Google, Microsoft, Yahoo, Facebook, etc. implemented cryptography on their web based email. While cryptography already has been made very easy (there are for example Firefox extensions/add-ons that make it easy), it ...


6

Software companies and email providers Default support for PGP from Microsoft (Outlook.com and the Outlook mail client), Apple (default support in iOS and OSX), Yahoo and Gmail. They should make people aware, and create pgp-wizards to set it up with a few steps. Google can make this happen, but they have a conflict of interest, bigger than Apple or MS. ...


2

For this your main concern is making sure that the information is only accessible to the intended recipient; which sounds a lot like what public cryptography / PGP tries to achieve. Unless you want to see if the target non-user has a PGP key published, or if you can get his certificate to encrypt the email with his public key; I think you'd just need to ...


0

What if instead you sent them a generic link that takes them to a page on your site which then generates a random, temporary url for them and forwards them to the registration page.


1

I don't think you can. You know nothing about the intended recepient, so whomever receives and uses the link is as likely as anyone else to be the right guy. A common half-measure is to make the link valid only for a short time.


1

File name "extensions" are immaterial. There is no real standard for these few letters, only loosely maintained traditions. The PKCS#7 standard (now called CMS) describes how to encode and decode signed and/or encrypted and/or authenticated "messages" into sequences of bytes. How these sequences of bytes are stored or exchanged is completely out of scope; in ...


0

While Google does send similar warnings, this one is clearly a phishing scam trying to steal your account. Phishing scams include e-mails that request your login:password information, or links to fake web-sites that ask for your login:password. For web-sites, the printed link may look valid but the actual link could go someplace different. They often ...


4

The domain name that is used for the email address of a scammer may be only loosely related to the scammer himself. E.g. if a scammer uses an Hotmail address, would you conclude that Microsoft (the owner of Hotmail) is an accomplice ? Probabilities are quite high that the names and addresses indicated in the whois database are fake, or point to an innocent ...


2

You can subscribe to the US-CERT maillist It provides a variety of products. Covers mainly below four topics: Alerts - timely information about current security issues, vulnerabilities, and exploits Bulletins — weekly summaries of new vulnerabilities. Patch information is provided when available Tips - advice about common security issues for the general ...


0

exploit-db by offensive security is pretty good. I don't really know of any other places that list exploits or email exploits. They also have a twitter feed that updates when they post new exploits; Their might be others that i'm not aware of.


1

Security advisories are normally posted by the project maintainers. In the case of Heartbleed, that would be the OpenSSL team. You should subscribe to the Project Announcements mailing list at https://www.openssl.org/support/community.html. This OpenSSL mailing list (linked to above) will only address security vulnerabilities (and project releases) ...


0

I agree with David. This problem showed up today on our end. This article on Yahoo's HelpCentral site (https://help.yahoo.com/kb/account-sending-spam-sln2159.html?impressions=true) explains that: 1) "Forged email appears to be sent from your email address, but your account is not actually affected"; and 2) "Email providers cannot prevent their domain names ...


0

This is the nature of how email works, unfortunately. There is nothing preventing you or I from sending an email from any address we choose, this is by design. What we can tell though is the IP address the email originated from in the mail headers, and this will give us an idea of where the original message came from. In the old internet, most mail ...


1

Of the two, the prior method is more secure and should be used. As imjoevasquez said, its used to curtail signups and make sure email address is legitimate. The other thing you could do is send a randomly generated code to the email, and ask to enter that to let the user create the account.


0

It is a security vs convenience tradeoff. In the first method, it takes longer for the user to register and get access to the service but the server is able to verify the user's email address. Vice versa in the second method. So it is up to the application developer what he/she wants to prioritise.


6

Google not only protects you and your data, but also themselves. The vast majority of internet users out there does not know about security, and does not care about. When offering any insecure path as fallback, user's would use it, and if it is some man-in-the-middle breaking everything else. If your account is compromised, that's not only a problem for ...


3

Googles hands are tied. Google arent just doing it to protect you. They are doing it to protect themselves. They dont want other people to mess with your stuff because they are carrying it for you, and they have a whole lot of legal obligations that come with hosting other peoples stuff. They are obligated to prevent any account being used in a way that ...


4

Was Google evil for requiring you to use the HTTP protocol instead of the Gopher protocol? I don't think most people would argue that it was. But if requiring the use of one protocol over another is not evil, then why would it be evil in this particular case: wrapping SSL around HTTP?


2

As others say, normally you have nothing to lose by using encryption instead of non-encryption, even if you think you don't need encryption. But if you really want to access it non-encrypted (perhaps to prove to someone observing your line that you are doing nothing evil), you could set up some HTTP server, which itself connects to Google by HTTPS, and ...


1

TL;DR: It's better, but it's not good enough. The chance of having a tapped connection versus the costs of this type of security are obvious and require no further consideration than "yes this is required". It is vital to remember that SSL might not be perfect and the implementations are very unlikely to be waterproof. Additionally, especially in a case ...


10

Evil for forcing you to use a secure connection? No, I don't think it's evil. It protects the community at large with no downside to you as an individual. I think its only evil if they're forcing you to use SSL/TLS, then failing to use forward secrecy, thus giving you and everyone else using the service a false sense of security. Without forward secrecy, ...


14

In fact, no, Google is not evil with this, not at all. The first important thing about this is that the use of secure connection is not a user preference or some personalized setting. Some people might find this confusing because they are familiar with a system only from the position of an end-user. Being a software developer myself, I can tell you that ...


8

It's sad that people's first reaction is to defend Google by using the "you don't HAVE to use it" fallacy. As for transaction of money, don't you think your own personal information which they sell to advertisers has monitory value? Google isn't free, it still requires a payment which most people don't even realize they are making. Now, to answer the ...


78

Let me rephrase your question with a few extra details, which are implicit but maybe not obvious to everybody: "Isn't Google being Evil by providing me with a free email service and gigabytes of storage and forcing me into a secure connection when I access that service which they have generously granted to me and that nobody forces me to use even if I don't ...


0

Perhaps they should offer an option to disable SSL if necessary. Perhaps there are some encryption restrictions in some countries or network requirements that would prevent users from accessing the service. I can see some business and user value to providing insecure options, but the defaults should be secure. However, Google likely made this as a business ...


154

It's not just about you. By forcing users to use TLS, they're creating a more secure environment for everyone. Without TLS being strictly enforced, users are susceptible to attacks such as sslstrip. Essentially, making unencrypted connections an option leads to the possibility of attackers forcing users into unencrypted connections. But that's not all. ...


16

If Google wants the content of their servers to be transferred securely, that is entirely within their discretion, even if that content is your email box.


1

It is not as secure as it most likely should be, though there are occasional justifiable reasons for storing a password in clear-text (for example, unattended third party service access when authorization token's aren't an option). It is certainly not secure to provide the decrypted password back to the user EVER.


0

Over the years, Microsoft has done a lot to make it harder to exploit Outlook out of the box, however, any system that processes data from untrusted sources is open to being exploited. There are many potential vectors for this, particularly if you grab additional content for messages beyond the basic text. It's impossible to guarantee you computer couldn't ...


2

Malware in an email can theoretically compromise your system even if you don't open it. Every mail that comes in is processed to some degree, and vulnerabilities in the email program could be used my embedded malware. This has happened in the past IIRC, several years ago, and I believe it had to do with image processing. Currently there are no published ...



Top 50 recent answers are included