15

If a webpage is delivered over HTTPS, the browser makes this clear with a padlock symbol. It's something that people look for. My browser also makes it clear that a page is not secure.

Why aren't emails treated similarly? In Gmail, you have to open up a small pop-up to see that an email is signed by DKIM and delivered over TLS. Else there's no obvious indication.

I ask this because someone asked me to put a link to PayPal in an email but it's a bad idea due to the risk of phishing. Except this would be no more insecure than a website if users were on the look out for a secure symbol, as they are with a website.

12
  • 2
    The last I looked, Gmail doesn't intrinsically support encrpted emails. There are addons available. Feb 4 at 4:46
  • 1
    I'm unclear about how links in an email are a factor or how they relate to your question.
    – schroeder
    Feb 4 at 8:20
  • 1
    Sign you email with X.509 certificate and the recipient will see signature mark.
    – i486
    Feb 4 at 10:37
  • 3
    "If a webpage is delivered over HTTPS, the browser makes this clear with a padlock symbol." - It's actually the other direction; padlocks in browsers are likely to go away as well. - "It's something that people look for." - No, it isn't, that's why they're removing them ;) - I'm aware this doesn't answer your question much, and honestly I feel more should be done with e-mail encryption.
    – marcelm
    Feb 4 at 16:56
  • 3
    So, I create a malicious domain, configure my email properly, and now emails are sent encrypted, signed, valid and pass DKIM. Now what? I think you are making assumptions about "safety" when you see "signed and encrypted".
    – schroeder
    Feb 4 at 17:06
38

TL;DR: Mail delivery using TLS and signing using DKIM are weak protections, compared to accessing a web site using HTTPS. They should not be assumed to provide the same security and the indicators better should not suggest such interpretation.

... delivered over TLS?

Mail is delivered hop-by-hop between client and final mail server, i.e. there are multiple servers in between. TLS cares only about protection between these hops, not on these hops. Each of these servers has access to the plain unencrypted mail. The indicator in GMail shows only if the last hop of delivery was done over TLS - and this is all what the final mail server can control.

Because of this hop-by-hop even a TLS indicator does not mean end-to-end protection of the email, i.e. from sender to recipient. Contrary to this HTTPS is end-to-end protection from browser to server. See TLS encryption email for more on this.

... signed by DKIM

DKIM does not provide a cryptographic signature created by the sender - this would be done instead using PGP or S/MIME. DKIM is done instead by a mail server on the way. All it shows that the mail was (mostly) unmodified on the way from this mail server to the final mail server. It does not indicate that the mail was sent by a specific user, nor that it was unmodified between sender and DKIM signing mail server.

Note also that DKIM actually allows modifications of the mail. Depending on the method changes in white space are allowed but there can also be changes which completely change the interpretation of the mail - see Breaking DKIM - on Purpose and by Chance for more on this.

15
  • ok, I've updated the question. I meant signed using DKIM. Feb 4 at 7:40
  • 2
    @IanWarburton: the update of your question says "signed .. using TLS". There is currently nothing about DKIM in your question. Also, if you ask about DKIM then this completely changes the meaning of the question - which is a bad idea if the question was already answered. Please ask a new question then instead. Feb 4 at 7:41
  • No it doesn't. It says "signed and delivered over TLS". Feb 4 at 7:42
  • 1
    @IanWarburton: Yes, TLS - not DKIM is you write in your first comment. Feb 4 at 7:43
  • 3
    "Contrary to this HTTPS is end-to-end protection from browser to server"—yes absolutely, but it's also worth noting that that usually isn't truly "end-to-end" because the server itself is often an intermediary between the two true end users of the logical conversation (eg users who both live chat through HTTPS connections to the same webserver might observe that their respective connections to that server are HTTPS, but that of course does not mean their chat is E2E encrypted).
    – eggyal
    Feb 4 at 12:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.