76

In many services, email can be used to reset the password, or do something that is sensitive. Sensitive data is also quite often sent to you by email, e.g. long links that enable access to your account or similar.

However for most people, their email service provider can read all their emails, can see what is being sent, and can send email themselves as "you". So doesn't that give your email service provider basically full access to your accounts? This seems like the incorrect medium to send such information via.

I don't really know if this matters, however you never really see these email services sending you "encrypted" email with your pgp key.

Also, it is well known that email is inherently insecure, or not designed with privacy or security in mind.

However it keeps being used for these purposes.

Improve this question
13
  • 8
    +1. In addition to the vulnerabilities that you describe, certificate authorities often use email verification to validate domain ownership when issuing SSL certificates. See docs.aws.amazon.com/acm/latest/userguide/…. So, a rogue email provider could easily get a fake CA-signed certificate for your site.
    – mti2935
    Commented Jan 1, 2021 at 13:43
  • 86
    "So doesn't that give your email service provider basically full access to your accounts" - you mean like your bank can steal all your money? At some point you have to trust someone else with your stuff if you want to live in modern society.
    – NotThatGuy
    Commented Jan 1, 2021 at 22:05
  • 8
    @NotThatGuy Or, a bit closer to home: your domain registrar could steal your domain, and with it your website/email/etc.
    – marcelm
    Commented Jan 1, 2021 at 22:15
  • 24
    @mti2935 You still have to trust 51% of the blockchain miners. And you still have to trust other people to accept the cryptocurrency. You can not live in a society with other people without trusting somebody, at some point. Otherwise, your only chance is to become a hermit.
    – Polygnome
    Commented Jan 2, 2021 at 11:47
  • 5
    @Polygnome and only a few thousand people control 51% of BTC mining, most of them in China. It would be fairly trivial for the Chinese government to take over Bitcoin entirely if they wanted to or at least damage it significantly to erode public trust.
    – JonathanReez
    Commented Jan 4, 2021 at 6:36

8 Answers 8

Reset to default
76

This seems like a very wrong medium to send such information via.

Email is used for the same reasons Social Security Numbers get re-used as account identifiers in the US: Ubiquity.

Not everyone has a Facebook account. Not everyone has a Twitter account. But almost certainly, anyone with Internet access has an email account. It is a reasonable expectation that customers can provide an email contact for businesses to use.

And I don't really know if this matters, however you never really see these email services sending you "encrypted" email with your pgp key.

Because pitifully few people have a PGP key, and even fewer are set up with an email client that integrates encrypted email.

I once wished to purchase software, and the vendor would only sell to people who communicated with them via PGP email. I tried sending the PGP-encrypted blob as an attachment, I tried inlining it, and I tried add-on software that integrated PGP email into my mail client - none of them passed muster with the vendor. I never purchased the software. PGP email is neither ubiquitous nor, it seems, trivially interoperable.

Also, quite often it is mentioned that email is inherently insecure, or not designed with privacy or security in mind.

However it keeps being used for that.

And it will keep being used for that until something better comes along and something better is available to everyone to use, trivially.

Improve this answer
10
  • 12
    An additional point of interest here: the reason SMS two-factor authentication and mobile app two-factor authentication have caught on is that almost everyone has access to a phone that can receive those messages, and most people in the developed world have a phone that can run a 2FA app like Google Authenticator. There wasn't really any publicly accessible 2FA service in the early 2000s or before because not enough people owned cellphones.
    – Polynomial
    Commented Jan 1, 2021 at 23:55
  • 6
    @Polynomial but then, many supposedly 2FA really require only one factor : access to the phone.
    – Eric Duminil
    Commented Jan 2, 2021 at 8:57
  • 6
    @EricDuminil The other factor is your password, or access to the email account. But that's really missing the point of what I said - ubiquity drives usage.
    – Polynomial
    Commented Jan 2, 2021 at 19:34
  • 8
    @Ram Theoretical capability often does not translate to practical usability. I can attest that gowenfawr's anecdote about struggling to establish PGP communications with a third party is an unfortunately common pattern, regardless of how standardised S/MIME is. Another fun anecdote: some implementations of S/MIME PGP in mail clients (iirc Thunderbird with OpenPGP on macOS is one) encode encrypted attachments as base64 inline with the message, which can completely lock up receiving clients as they try to render 40MB of base64.
    – Polynomial
    Commented Jan 2, 2021 at 19:44
  • 7
    One piece is missing: email is federated, standard protocol. If a service chooses Facebook or Twitter or Google for authentication you have no recourse should they decide to deactivate your account, hand it over to someone else, use your authentications to snoop on you, or you just don't want to do business with them. They are monopolies. In contrast, you choose your email provider. You can change email providers and have them forward your email. Or if you control your domain name, you can change providers and retain your email address. Email is a marketplace.
    – Schwern
    Commented Jan 2, 2021 at 23:52
27

While you correctly identified problems with e-mail, a mail based verification is still considered sufficiently secure for many cases. While there are alternatives like SMS based verification, automated phone call or even snail mail, these are not as easy and cheap to use as e-mail.

The optimal security measures are usually a balance between usability (i.e. ease of use), deployability and costs vs the security provided by the measure. If more security is required, it usually means that it gets more expensive to deploy and/or harder to use. E-Mail is a good trade-off for many cases.

Improve this answer
10
  • 2
    "While there are alternatives like SMS based verification, automated phone call or even snail mail, these are not as easy and cheap to use as e-mail." – They also assume that the user has a mobile phone, phone, or address, respectively, which is not universally true.
    – Jörg W Mittag
    Commented Jan 1, 2021 at 15:23
  • With snail mail, how would you propose to avoid the security holes caused by the chain of people physically handling it? Any organization that is generating thousands of identical-looking snail mails per day is an obvious target for someone skimming off say 0.01% of them as "lost in the post".
    – alephzero
    Commented Jan 2, 2021 at 5:03
  • @alephzero: I'm not claiming that snail mail is perfectly secure - but neither is SMS or a phone call or an e-mail. I'm only saying that these are different options with different trade-offs regarding usability, costs and security.
    – Steffen Ullrich
    Commented Jan 2, 2021 at 6:44
  • 1
    @JörgWMittag By that logic, it is not universally true that everyone has an email address either, so your line of reasoning doesn't help to distinguish between any of the methods. I know several people (mostly older) who have a mobile phone, phone, and address, but no email address.
    – Jon Bentley
    Commented Jan 2, 2021 at 22:03
  • 1
    @JonBentley: But we are talking about accounts on web sites here. It is reasonable to assume that someone who has an account on a web site will also have access to some sort of means of receiving email, e.g. a gratis webmail provider. For example, homeless people who can briefly use a shared web terminal in a shelter. They will not be able to receive snail mail because they don't have an address. At least in some countries, they will not be able to have a SIM card for the same reason. They will, however, be able to access webmail at least during those times where they can access the web.
    – Jörg W Mittag
    Commented Jan 2, 2021 at 23:48
14

Email is the least worst option.

It's not just the ubiquity of email. Email is federated, standard protocol. No one entity controls email. Email is a marketplace. You choose your email provider. Don't trust them? Take your business elsewhere. There's thousands and, from an authentication perspective, they are all equivalent. You can even run your own service, though server reputation has made this more difficult. Because of this mobility, an email provider has strong incentives to retain your trust and not read your email.

In contrast, private single-sign on services like Facebook or Twitter or Google are monopolies and have monopoly power. You have no recourse should they decide to deactivate your account, hand it over to someone else, use your authentications to snoop on you, or you just don't want to do business with them. This goes for both the users and the site which chooses to use them for sign-on. If a private single sign-on provider decides they don't like your service, country, or industry, or maybe they decide you're the competition, they can yank all your users. Unless you're rich enough to hire lawyers, or popular enough to mount a social media campaign, there isn't much you can do.

Email is the only service which meets all of being both globally ubiquitous, federated, and acceptably secure. Phone numbers take a close second, but because phone numbers cost money they are not as ubiquitous as email. Software OTP is federated and secure, but not ubiquitous.

Improve this answer
6

It is a simple method for low(/medium) security services with no obvious better alternative. IMHO it may be in many cases a reasonable compromise between usability and security without advertising identity of your "tracking device" (cellular phone number).

Improve this answer
7
  • I told my bank I regard it as less secure as not doing it. Hint: my phone was stolen, where you do think that email went?
    – Joshua
    Commented Jan 4, 2021 at 3:15
  • @Joshua I assume your bank account processes enough money to make it above "low(/medium) security" :-)
    – AnFi onet.eu
    Commented Jan 4, 2021 at 6:51
  • @Joshua I sure hope no bank in the world lets people reset their account by email alone! I've never had a bank that would send anything by email except "there is a message in your account" (which is borderline already) or general information.
    – gerrit
    Commented Jan 4, 2021 at 9:11
  • @gerrit the problem isn't the bank, it's the phone. Banking by phone, banking by text message, banking by app, banking by browser. Whatever new channels you add, customers will figure out how to make them available on their phones, small portable devices that are easily stolen. Banks can't force customers to use desktop computers. And since typing strong passwords on a phone is a huge pain, people either use simple passwords or save them on the phone.
    – barbecue
    Commented Jan 4, 2021 at 14:22
  • @barbecue Sure, but access by password alone would be single factor authorisation so not appropriate for online banking. And people should use password managers on their smartphone (I use keepass2android).
    – gerrit
    Commented Jan 4, 2021 at 17:54
2

Everyone has an E-mail address and is willing to use it to register on some website. And you can easily create disposable addresses. So it is convenient for users - and cheap. On the other hand not everyone is willing to share a phone number and even SMS is not considered secure these days.

Not long ago, I had to register for an auction and the credentials were sent by snail mail. That is an option but it's slow and not as cheap as E-mail.

I completely share your concerns therefore I host my own mail for security and privacy reasons. I also wish more service providers would provide PGP as an option, either for 2FA login or regular correspondence.

Improve this answer
2

The notion is that you have an alternate channel. Most of the time a web account was created then verified by email.

You registered originally giving your email address. Now what does it take for a Black Hat to steal your account:

  • He has to know your login and your email address. (Often the same.) With these he can send a request to change your password.
  • Now he has to be able to intercept the password change request to your email. And this usually has to be done in a short period of time.
Improve this answer
0

As highlighted in many of these answers and comments, trust relations always depend in the end of some 'person' to 'person' relationship of trust. That is, you must trust facebook can manage your account securely, you must trust blockchain miners and algorithm designers, or you must trust that your email provider is secure. These issues are generic in federated trust communities. Examples are where a service accepts validation of your identify from a third party. If you think about it, this is almost always the case: your driver's license or birth certificate are third party validation of your identity - you are who you say you are.

This is why websites that say you can create an account or login using your Google or Facebook credentials are probably more secure than ones that accept any generic email provider because service providers have more confidence in facebook and google than less well known identity providers.

So to recap, your question does identify the requirement for a trust relationship between you, your chosen identity provider and the service provider. There is no way to avoid this: someone must vouch for you.

Improve this answer
2
  • I cannot recall a website which requires google or facebook only (and I would have noticed since I do not have a facebook account and don't use google as my email provider). Do you have an example?
    – jrw32982
    Commented Jan 13, 2021 at 16:31
  • You are correct I didn't mean to imply 'only' Google or Facebook. But by using something like them or another identity provider, it is generally more secure. Consider when services that get hacked and a lot of email addresses and passwords are stolen. That can't happen with an identity provider because the password is never supplied to the service. Now if you are really religious about never reusing passwords you are better off, but an IDP does that for you.
    – mostlyWright
    Commented Jan 28, 2021 at 2:03
0

Email is a ubiquitous common denominator that most people online have access to and it allows a secondary method of verification to decrease the likelihood of spam, scams, and transient accounts. It's not fool proof by any means, and can certainly be circumvented but it increases the barrier to entry.

In addition, for verification purposes it can serve as a very rudimentary multi-factor authentication routine that allows a platform to verify that you are who you say you are to a certain degree.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .