How is it possible that mailing systems like Gmail, Yahoo, and Hotmail are able to check the content of an attached password-protected archived file like WINRAR, if the password cannot be guessed, brute-forced, and recovered? Or is it possible that the WINRAR injected a back-door password and selling it to these mailing systems?
asked Oct 18, 2014 at 11:22
-
3Who said they are able to check an encrypted rar?– UlkomaCommented Oct 18, 2014 at 11:35
-
@Ulkoma: They must check; What if I protect a file containing a virus? Or what if I'm sending an illegitimate file?– Mohammad NamakshenasCommented Oct 18, 2014 at 11:41
-
2Well, they don't, there is no way to check the contents of an encrypted rar– UlkomaCommented Oct 18, 2014 at 12:20
-
This is not your problem then : you are not liable for just receiving illegal content which you did not request. As for the viruses, the mall providers usually do their best to protect you and it ends there.– WoJCommented Oct 18, 2014 at 12:21
-
If it is password-protected how a malicious process could use it in the first place.– elsadekCommented Oct 18, 2014 at 17:27
Add a comment
|
3 Answers
They can't.
Encryption is encryption. Email services won't spend time and energy trying to brute force your password, nor do I believe they would create backdoors for the sake of email. If they let you send encrypted archives then they simply don't check the contents.
I tested. GMAIL blocks all encrypted archives.
I attempted to send a password protected zip containing a txt file, and got the following reply: host gmail-smtp-in.l.google.com[2a00:1450:4010:c05::1a] said: 552-5.7.0 This message was blocked because its content presents a potential 552-5.7.0 security issue. Please visit 552-5.7.0 http://support.google.com/mail/bin/answer.py?answer=6590 to review our 552 5.7.0 message content and attachment content guidelines. w6si5949161lad.65 - gsmtp (in reply to end of DATA command)
So this is a blanket block. It does not matter if the content is safe or not. If they for some reason cannot scan the file, they will regard it as "corrupted" and reject it. Corrupted archives are prohibited. Thus you are protected, but that also means you need other methods for sending confidental data over GMAIL. One good example is to use PGP to encrypt files Before sending. Google wont reject these since they require a manual process to open.
answered Oct 18, 2014 at 11:59
-
1I also tested on gmail, yahoo, and hotmail. They sent it as a piece of cake, and there was no security warnings. To your surprise, I usually send my personal files by a winrar protection with a 20-character-length password incl. all form of symbols! Commented Oct 18, 2014 at 12:12
-
aaah you mean the other direction, sending FROM a gmail account. I only tested TO a gmail account from my own server. Tested now. Sending a email using ZipCrypto successfully Scans the password protected file and blocks any virus. However AES-256 goes straight through, even if its a live virus. Commented Oct 18, 2014 at 12:17
-
1I also tested sending FROM my own website's e-mail, e.g. [email protected], TO Gmail and Yahoo. It also worked! Commented Oct 18, 2014 at 12:23
-
But PGP only encrypts the message not the attachments correct?– HugoCommented Oct 18, 2014 at 12:23
-
Hugo: No, Im not talking about PGP-encrypting the message. You PGP-encrypt the FILE while its on PC, and then you attach the PGP-encrypted file to the message. The receiver wont get it automatically decrypted, he has to download the encrypted PGP file and then use PGP to decrypt it. Moh_NA_X: I tested as "uncompressed, Protected with zipcrypto". Tested now with AES-256 does let the file through. So it seems it blocks any zipcrypto files but allowing AES-256 through. Commented Oct 18, 2014 at 12:24
They do not do it.
Attempting to decrypt a message can be illegal depending on the country.
They either send it through as a binary blob or block altogether.
-
No, its NOT illegal to decrypt any file. For example BlueCoat Proxy does decrypt SSL traffic, but that does not make it illegal. Legality does depend on intent. If your intent for decrypting a file is to access and/or misuse any content, then its illegal depending on country. If your intent for accessing a encrypted file is to virus scan it, which is a thing you do to please/protect the receiver from bad content. Thus its legal. Also it also depends on how you originally did get the file, as a employer, it might be okay to access employee's protected files on work computers. Commented Oct 18, 2014 at 12:31
-
I do not know what your experience with international law applied to information security is but it would be worthwhile getting in touch with your legal dept.– WoJCommented Oct 18, 2014 at 13:08
-
I pressed send to fast. It is illegal to access encrypted files when they are personal files or data streams in the EU– WoJCommented Oct 18, 2014 at 13:09
-
(damn mobile app). Then the company seeing an SSL proxy may be liable in case of problems with your transaction (say with your bank). You will find that there is no one size fits all in international legal constraints.– WoJCommented Oct 18, 2014 at 13:11
-
1in EU theres no prohibition on accessing encrypted files. Data intrusion according to EU, is when you access ANY file, without permission from the file owner. It does not matter if it encrypted or not. You simply cant define encryption according to law because then legal problems would appear: Is Base64 an "encryption"? and so on. File owner is the legal owner, which depends on multiple factors. For example, if I lend out MY computer to you, you create a encrypted file, I get back my computer, I may legally crack it since its my computer. You may not hack my computer to get your file. Commented Oct 18, 2014 at 13:39