3

Scenario:

  1. email is hosted third party (think Outlook, Gmail etc.)

  2. I am sending email to another person with an email account on the same domain (think from [email protected] to [email protected])

Is this more secure and "private" than sending en email to the same person, but with his/her email account on a different domain (as in above example, but now from [email protected] to [email protected])?

Assumption for this scenario (to reduce scope):

  • separate domains are not owned by related entities (going by above example, the relationship between the owners of example.com and anotherexample.com is as disparate as Microsoft and Google).

  • both domains' email servers support STARTTLS, and implement typical security practices (IMAP, SMTP connections from clients use only TLS, both accounts use strong passwords and servers store passwords properly hashed, salted and iterated, patching and configuration is done properly etc.)

Improve this question
2
  • You obviously reduce your exposure to bad actors, but the only way to prevent email snooping is to encrypt at the client, e.g. with PGP/GPG, using a key you have generated.
    – Bob Brown
    Dec 22, 2014 at 18:41
  • @BobBrown: Indeed that is true. I am referring to the (somewhat regrettable, but typical) case where most users send email without PGP (or for that matter, any form of end-to-end) encryption.
    – Nasrus
    Dec 24, 2014 at 5:35

2 Answers 2

Reset to default
5

Your have about 50% less violation of your privacy in this case.

When you send an unencrypted email to another domain, both your mailserver and the mailserver of the receiver can read it.

When you send an unencrypted email to the same domain, only the mailserver of that domain can read it.

This assumes the ideal case where both sender and receiver connect to their respective mailservers with TLS and the mailservers also communicate with each other also via STARTTLS. When one of these assumptions is wrong, there is an additional attack vector which needs to be considered separately.

In case of GMail, Google will read your email, parse it automatically, and use the information in your emails to add information to your and your communication partners Google profiles which are shared between all Google services for targeting both search results and advertising. Google Inc. itself claims that user should not expect any privacy when using their email service. So when you value your privacy or that of the people you communicate with, do not send or receive email with GMail.

Improve this answer
-2

on the same domain / mail server your mail NEVER enters the Internet (under correctly configured mail systems) so this is inherently safer for YOUR mail than any other solution. however. its only safe for as long as no one can access the mail through other means (hacking the mail server for example). its important to realise that not only you, and your recipient. but also the server administrators and possible the network administrators have clear access to your "mails" (only policies prevent this. which is no technical barrier). And anyone having physical access to the machine where the mail is stored.

the TLS only encrypts the mail between the 2 servers in question. nowhere else is the message protected from others.

If privacy is an issue use encrypted mails.

as a "base defense" against random "snooping" TLS is enough to protect you.

Improve this answer
6
  • 3
    You say "on the same domain the mail never enters the internet". That is not correct. Using Gmail or Hotmail, you use the internet via webmail or POP/SMTP. That is probably encrypted using TLS or some other encryption, so quite safe, but "never" does not apply here at all!
    – SPRBRN
    Dec 22, 2014 at 14:44
  • Sending of email happens between Mail servers... before its on the first server its still a "draft". POP is for communication between Server and Client, and as I say that is not protected.
    – LvB
    Dec 22, 2014 at 15:20
  • When you're typing your email in your browser on gmail.com, you're on the internet! POP and SMTP can be secure using TLS. That's quite common.
    – SPRBRN
    Dec 22, 2014 at 15:56
  • I suspect you misunderstand what I am saying, its not about the communication between server<=>client,its about server<=>server. the questioner is talking about the difference between sending a message to the same domain, versus to a diffrent domain. the client connection between teh server<=>client is there out of scope.
    – LvB
    Dec 23, 2014 at 10:21
  • For certain providers (eg. Outlook.com, Gmail), their mail servers are spread across the Internet. That means that they do enter the Internet, but with properly configured STARTTLS/inter-server VPNs it should not be that much of an issue.
    – Nasrus
    Dec 24, 2014 at 5:41

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .