6

I just sent an email to my colleague. Besides his eyes and mine, who can read the body of the message?

Assumptions:

  1. I have a name@mycorp.com address, hosted by Google Apps.

  2. Recipient has a name@hiscorp.com address, hosted by MS Office 365/Exchange Online.

  3. We are both using webmail with HTTPS connections to read/write mail.

  4. Google/MS use SMTP with TLS 1.3 (or some cryptographically secure method) for mail transfer. (This may or may not be really true, but let's assume for this exercise.)

  5. Assume both PC's are not compromised in any way.

  6. Assume hackers, NSA, etc can't crack TLS/HTTPS in a reasonable amount of time.

Bonus points: Are any of these assumptions practically unreasonable? Why?

5

You probably are well-aware that the providers can access the emails.

The 2 providers may or may not transfer emails between them over an encrypted channel. Some providers have agreements with others to only exchange emails between them over an encrypted channel.

About 50% to 60% of the emails Google exchanged with different providers in 2014 were encrypted, the other 40% to 50% weren't. (Source.)

An unencrypted email transported in plain text between email providers can be read by anyone who sits between their servers. Especially by secret services which have access to internet exchange points.

But against secret services, securing anything via HTTPS is flawed anyways. They can easily create certificates you trust and can easily read or manipulate your HTTPS traffic. Even antivirus companies can compromise HTTPS traffic and in fact do this all the time which I got a lot of downvotes for claiming it here until providing proof. So really, your 6th assumption is wrong. And this means your 3rd assumption is worthless.

We can kick out the 5th assumption, too, because either party is probably using a Windows or Mac OSX computer which have universal backdoors and are already compromised before they are shipped to you. If either party has an antivirus software installed ... well, I think I already discussed who can read then, too, in the previous paragraph.

Countries which don't feel like their secret services are powerful enough – like Germany – simply create a law which states that (in the case of Germany) email providers with at least 1 k email accounts and companies which don't provide email to others but only to themselves with at least 10 k email accounts have to buy hardware which delivers inbound as well as outbound email traffic to authorities. In the case of Germany, these emails are automatically checked and each year dozens of millions of emails are found suspicious and are directed to a human to read.

  • Can you link to info about Germany doing that? Thanks – Matija Nalis Sep 1 '16 at 20:14
  • 1
    Well, of course. Germany has laws about everything and in this case it's TKG § 110 and this act. – UTF-8 Sep 1 '16 at 21:07
  • 1
    Unfortunately, German laws are in ... well, German. Translating this paragraph of a German Wikipedia article to English via Google Translator, however, will be much easier. – UTF-8 Sep 1 '16 at 21:11
  • My gut reaction is to leave Germany, but at least it's regulated. At least we have a law on this. Thanks for the detailed answer UTF-8. – user68631 Sep 6 '16 at 11:07
3
  • anybody who knows (or can guess) your or her password, or some other method to gain access to account (for example "I forgot my password" with guessable security questions or email link sent to another address etc)
  • anybody who can take control of your or her computer (via some virus, trojan, exploit, social enineering, bug in browser, XSS, etc.) - yes I know you mention (5), but this is quite real problem.
  • anybody at google with appropriate level of access
  • anybody at microsoft with appropriate level of access
  • anybody at hiscorp.com (and maybe mycorp.com) with appropriate level of access (as mentioned in comments by @drewbenn)
  • any government or other organization that could order, coerce or bribe someone at google or microsoft (or your friend or you)
  • any party in the path you -- google -- microsoft -- her who is capable enough to pull SSL stripping man-in-the-middle attack. "STARTTLS" is optional even when supported.

In short, if you are really interested in any chance of secure email communication, you should be using end-to-end crypto, like PGP/GPG or S/MIME. It is by no means bulletproof, but it gives you some fighting chance at least.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.