9

Can my ISP read my gmail or other email even when using HTTPS?

I guess they can do that since they are the "man-in-the-middle".

Is there a way to prevent that?

This is related to the news that in my country (Uruguay) the government ordered the ISPs to add a software that can read all emails. (http://www.elobservador.com.uy/noticia/289757/el-guardian-espiara-desde-enero-mails-y-celulares/)

1
  • You'll want to VPN OUT of Uruguay to a trusted nearby nation. Download some reputable VPN software and see which ones can take you out of Uruguay before deciding which one to use. Oct 13 '14 at 17:41
12

No, they can only see the encrypted traffic flowing from yourself to Google's servers. They cannot see the actual content of the traffic (your emails).

However, if your ISP forces you through a web proxy and makes you use their certificate, they could then see the content of your traffic. I would be cautious if you see untrusted certs when going to gmail.com. You may consider even using a VPN to prevent your ISP from trying to do things like this.

3
  • 4
    They wouldn't necessarily have to present untrusted certificates. Suborning an existing Root CA is trivial; as they are businesses like any other. Some countries like Spain, France, China, Japan, Taiwan and Turkey already have their government root ca installed on your computer. A regime could easy require all computers sold or maintained in their country to install their government's root ca. Oct 13 '14 at 23:49
  • Carefully edit your systems' list of root CA's. Verify the offered SSL certificates' fingerprints with an independent trusted third party, over a separate channel of your choice. Oct 14 '14 at 21:26
  • You can use Convergence or Perspectives to be sure that the certificate that is being served to you for gmail.com is authentic. These services work as a peer-to-peer network, of sorts, to compare the certificate that you are receiving to the certificate that others are receiving for the same site, to ascertain whether the certificate that you are receiving is legitimate.
    – mti2935
    Aug 19 '15 at 1:38
1

In a Nutshell

Yes, your ISP and government can read your emails, even when using encryption because of a number of vulnerabilities, and the fact that most emails are not encrypted on email provider's servers.

Definitely Not in a Nutshell

Your ISP can employ a number of tactics to read encrypted email: firstly email does not use HTTPS, instead it uses the SMTP protocol which can use StartTLS for encryption, I say can, because many times StartTLS is not used. This is because STARTTLS is opportunistic, so it will encrypt when you, your email provider, and your recipient meet certain criteria. This makes it fairly easy for your communications to become insecure by forcing certain conditions that disable StartTLS.

This is why many emails are not encrypted in transit. Although, some email providers are good about this, like Google, so Gmail to Gmail communication is encrypted in transit by default, many others are not.

But for the purpose of discussion let's say that all your emails are encrypted, and that your ISP isn't doing anything that is making them travel in clear text, even then your emails can be read if the government wants to read them because nearly all emails are not encrypted end-to-end. Meaning that even if they are traveling encrypted they are not encrypted on the servers of your email provider.

So if your government really wants to know what emails you are sending, with a search warrant, they can know. The mantra of the security/privacy community has been that emails are consistently insecure, even when using encryption.

What You Can Do / Extras

With a fair amount of work you could make your emails secure, but that requires the recipient of your email to cooperate, a luxury you may not have. I recommend avoiding email if you are concerned about your privacy, and if email is an absolute necessity I would recommend reading about STARTTLS, PGP, and this post on stackexchange if you are interested.

Email Alternatives:

  1. K-9 Mail ( Open Source Email Client With End-To-End PGP Encryption )
  2. Mailvelope ( For Encrypting Emails through web mail )
  3. Cryptocat ( Encrypted Private Chats in your Browser )

(Sorry, I can only post two links on here )

3
  • I'm confused: you are talking about STARTTLS but is the OP using a client or the web interface? Aug 18 '15 at 21:43
  • @DeerHunter The actual email would be encrypted with STARTTLS, but you would probably be accessing your email client through HTTPS ( if it is a webmail client. ) Aug 20 '15 at 0:27
  • StartSSL itself is broken in case of active "downgrade" attack. The last stats I read about the subject was that nearly 80% of all SMTP exchanges between the large public servers (google, yahoo, etc.) are unencrypted because of that (either bad config, or active attacks, or bad HW, etc.). SMTP is broken by design, there is nothing you can do.
    – JPatta
    Mar 2 '16 at 9:52
0

Yes they can by replicating a certificate and your browser will not warning you about it:

Answer from another question:

Yes it is possible.

With another valid TLS leaf certificate the CA flag can be bypassed and that certificate used to sign a certificate for any site:

https://community.rapid7.com/community/infosec/blog/2015/07/09/cve-2015-1793-openssl-certificate-authority-impersonation

Chrome and Firefox are certainly vulnerable to this on unpatched systems (which is likely a lot of systems today).

1
  • so, possible but unlikely?
    – schroeder
    Jul 27 '15 at 4:43

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.