When I send an email from my gmail account to another mail server (apple, microsoft, yahoo...), is the connection encrypted in the path between the two servers?
2
-
Sometimes it is, sometimes it isn't. Even if it is, it might still be vulnerable to active MitM, and finally since all those mailservers aren't trustworthy in the first place, it doesn't really matter if the NSA compels a backbone or microsoft/google.– CodesInChaosCommented Aug 16, 2013 at 9:50
-
related : security.stackexchange.com/questions/6489/…– BlueBerry - Vignesh4303Commented Aug 16, 2013 at 12:26
Add a comment
|
1 Answer
Let's see:
$ host -t mx gmail.com
gmail.com mail is handled by 5 gmail-smtp-in.l.google.com.
[...]
$ telnet gmail-smtp-in.l.google.com 25
Trying 74.125.142.27...
Connected to gmail-smtp-in.l.google.com.
Escape character is '^]'.
220 mx.google.com ESMTP ab10si598143icc.38 - gsmtp
ehlo example.com
250-mx.google.com at your service, [24.114.93.99]
250-SIZE 35882577
250-8BITMIME
250-STARTTLS
250-ENHANCEDSTATUSCODES
250 CHUNKING
See that "250-STARTTLS" ? It tells me that the SMTP server which handles incoming emails for Gmail supports SSL/TLS, and is ready to use it.
If I try again with apple.com server, I also get an announced SSL/TLS support. Therefore, servers on both sides are apparently ready to use TLS and ought to use it when talking to each other.
That's about the best that can be inferred from the outside. You cannot really know whether a specific email will be protected with SSL while in transit between the two servers, or even whether a given email was SSL-protected, because that's not written in the email itself. Similarly, SSL protects against Man-in-the-Middle attacks only as long as the SSL client duly validates the SSL server's certificate, including revocation checks, and nothing tells us whether Apple and/or Google does that properly. Without such protection, SSL is good only against passive attackers.
Also, remember that SSL is only for data in transit, between two SMTP servers: within the SMTP servers themselves, emails are not encrypted, and won't be encrypted in the destination mailbox (an email service could encrypt emails before storage, in a way precluding decryption by the server itself; Lavabit was doing just that until it was shut down recently; but Gmail does not do that, in particular since they quite openly scan email contents in order to make targeted ads for each user).
answered Aug 16, 2013 at 12:38
