Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

One of my friends has his own personal email hosting. Let's assume for the sake of argument that it is "secure", meaning that no third party can read the emails in his server either through hacking or a backdoor.

Does this mean that a government email surveillance system really cannot read his emails? Indeed, so long as his email conversations are with correspondents whose email hosting services are compromised, it may be possible to retrace all his emails from the compromised correspondents.

Is a personal (and secure) personal email hosting system really a protection against government snooping?

share|improve this question
add comment

2 Answers

up vote 7 down vote accepted

Nope it will be as secure as you can configure it and like you say the end point might not be secure. If you want to have security you should encrypt your emails with pgp/gpg.

share|improve this answer
    
And… you should secure the (all) endpoints (from any form of spyware or keylogger). –  daniel Azuelos Jun 23 '13 at 22:13
add comment

For the sake of argument even if the endpoints are secure, what is stopping the govt from intercepting the email within transit? PGP/GPG will solve the problem of intercepting the email within the transit. However, then security will depend on the security of the private key stored on the email server itself or in your personal computer.

In case of PRISM (as I assume that is prompting you for such a concern) not only the data itself but the meta data is also very important and can leak a lot of information. PGP/GPG can protect the contents of the email but not the header so the sender and receiver will be in clear. You can't encrypt those because otherwise SMTP servers will not be able to route the email. Also, your IP addresses will be leaked in the email header as well if you have an email server hosted personally.

It always comes down to the capability of your adversary. If you are talking about government, that is a tough adversary to beat. You need to protect the email server itself, you need to protect the server where the PGP/GPG keys are stored, you need to protect not only your own servers but the servers of the recipients as well. And it is not just installing the latest patches on the servers, you have to deal with zero day attacks if your data (the emails) are worth this much to the government.

In short, always do your risk assessment first before deciding whether personal hosting is better or not. "Risk involves threats, assets, impacts, and controls. If you're not talking about all 4, you're talking about something but it ain't risk"

share|improve this answer
    
If you want to defend from government surveillance, hiding and masquerading traffic is a must. E-mail simply does not fit the bill - it stands out too much. –  Deer Hunter Jun 22 '13 at 18:02
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.