3

Regarding to the second point of 15 reasons not to start using PGP:

Thanks to its easily detectable OpenPGP Message Format it is an easy exercise for any manufacturer of Deep Packet Inspection hardware to offer a detection capability for PGP-encrypted messages anywhere in the flow of Internet communications, not only within SMTP. So by using PGP you are making yourself visible. Stf has been suggesting to use a non-detectable wrapping format.

As far as I know, its not possible to detect the content of a mail, even just only if it is OpenPGP encrypted when the ways sender - mail server - mail server - receiver are TLS encrypted. Am I wrong? Of course it can be detected by the mail servers and if one of the ways is not TLS encrypted. But it is also possible to detect OpenPGP mails in TLS ways?

|improve this question
  • 1
    What's the fuss about "being noticed". It's not like plain text emails wouldn't be searched. Some use it to track wrongdoers. Other use it to create personalized ads. Either way: the message content is not protected unless encrypted – BlueWizard Jun 25 '17 at 21:50
2

Being able to recognize OpenPGP messages is especially an issue as the recipient is included in the OpenPGP message's meta data by default (it can be hidden though, using the "hidden recipient" feature; which trades reduced meta data for more effort on the recipient's side, as he has to try all his secret keys instead being able to select the proper one from the beginning).

As far as I know, its not possible to detect the content of a mail, even just only if it is OpenPGP encrypted when the ways sender - mail server - mail server - receiver are TLS encrypted. Am I wrong?

You're right, as long as there is no flaw in TLS and proper algorithms/parameters are chosen, contents transmitted through an encrypted channel cannot be recognized.

Statistical methods on the message size might be applied to guess the contents might be OpenPGP messages -- but then again, OpenPGP messages are generally hardly distinguishable from "normal" messages with respect to their size.

Of course it can be detected by the mail servers and if one of the ways is not TLS encrypted.

You are also right about the mail servers being able to analyze whether a message is OpenPGP-encrypted, as they terminate the transport encryption through TLS. If you trust all servers in between (and there are often more than two), also be aware that you cannot make sure all mail servers on your message's route always communicate encrypted -- there is a rather larger portion of mail servers not encrypting connections between SMTP servers at all! This is especially valid for network-internal communication, which is rarely encrypted at all; but also an issue for cross-server-connections through the internet. Finally, even if servers have certificates, lots of them do not have a proper certificate, or do not bother to verify the other side at all.

|improve this answer
  • thx, can you explain why there can be more servers in between when I send email from example posteo.de to mailbox.org? Posteo bei the way makes it possible to activate TLS-sending guarantee that only sends to server tls-encrypted. But I thought it would always connect to the server after the @ in an email directly. – Klimbim Jun 24 '17 at 14:31
  • Generally you can say "the larger the organization, the more mail servers in-between". Often, there are dedicated servers for mail submission by users (usually port 587) and mail delivery by servers (usually port 25). Then, mail goes through some anti spam servers, might get queued somewhere else, and mails to be stored locally get passed to another server hosting the mailboxes. There might even be some kind of hierarchical system relaying mails to several internal mail stores. You can usually have a look at the list of servers that your mail passed -- look at "Received:" lines in the headers. – Jens Erat Jun 24 '17 at 14:54
1

It depends. If this is your company and they've installed trusted certs on your system and the deep packet inspection appliance also has those certs, then yes it can be done via MiTM.

See https://www.us-cert.gov/ncas/alerts/TA17-075A

|improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.