0

I'm part of a company that has at least 1000 PC's distributed in different buildings over a radius of 25 miles.

I've been asked to make a program to survey technical information on each PC.

Since not all of them share a LAN connection but all of them have internet access, my solution was to use a gmail account to share the encrypted data.

I've created client/server like services to send the data and retrieve it to the data base through emails, all of them using the same gmail account (to send and receive).

I know that this look a lot like a botnet...actually I think it is, since each client would be able to receive configuration mails from the server to request certain registry entries.

All external IP's are dynamic, the server is internal, the resolution to establish a trusted unattended connection would demand publishing the IP's somewhere, Dynamic DNS has been suggested but in terms of reliability it's just as safe as gmail.

Anyway my question is: will gmail detect all this traffic made on the same account as a botnet and close it? if so, should I use several accounts?

For those who voted to put this on hold, and for the ones who'll review it, I think this is a policy question (as stated in what topics can I ask about) specifically about gmail security policies. I think I couldn't be clearer about it.

closed as off-topic by schroeder, ThoriumBR, Xander, Mark, Jens Erat Mar 25 '15 at 21:21

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "This question does not appear to be about Information security within the scope defined in the help center." – schroeder, ThoriumBR, Mark, Jens Erat
If this question can be reworded to fit the rules in the help center, please edit the question.

5

Using email as a configuration distribution service is terrible. Using an external and uncontrolled server is even worse. As people already stated, you could trip the spam filters and get messages silently dropped, anybody could send emails to the account, the latency between a message being sent and received can be very high (and unpredictable), and other complications.

If your clients have internet connection, you could set up a free server running PHP/Python/Ruby/Node and create a webservice with authentication in place. The clients would connect to it, and send statistics or receive configuration changes.

  • I appreciate your insight on the matter of "why not use gmail as a botnet", yet the answer provided does not cover the question. I've taken into account the validation of messages. And, for obvious reasons, it's not a real time system so latency wont be an issue. – Typo Mar 26 '15 at 1:08
4

It's unlikely that your account would be closed, however repetitive messages to and from the same address would likely trip their spam filters. This could make your system unreliable.

There are some serious threats to the confidentiality, availability, and integrity with this model as you are using a public email service. You will need to make sure you are encrypting and signing the message content independently of gmail's API. Truthfully you'd be better off using a client/server based model using tls.

  • Thank you for your answer, I'm not encrypting with gmail's API, It's not vital information either, basically statistics. Since all external IP's are dynamic (the server is internal) the resolution for TLS would be a problem. – Typo Mar 25 '15 at 12:29
  • 8
    @Typo small cheap server in the cloud should solve your problem and is a cleaner solution than abusing email for such a thing. – kutschkem Mar 25 '15 at 12:40
  • 10
    @Typo If you manage 1000 PCs, having your boss approve an additional $10/month server is a problem? – kutschkem Mar 25 '15 at 12:48
  • 1
    @Typo Ask and ye shall receive. – Joseph Mar 25 '15 at 20:33
  • 1
    @Typo: I would stress that increased reliability and maintainability (and reduced time to deployment) is by far worth the expense. Just think about checking the logs between GMail (where you cannot) and doing the same on an Amazon EC2 you own. No contest. And you will very probably have to do this every time one of those 1000 PC's hiccups and you need to investigate what happened. Saving time now at the expense of more time down the road, when "now" is 1% of total, is illogical. – LSerni Mar 30 '15 at 11:58

Not the answer you're looking for? Browse other questions tagged or ask your own question.