Re:The sad state of SMTP encryption
by pjc50 on Wednesday November 11, 2015 @06:27AM
(#10546059)
What is the 99% use case? Most people's email has one endpoint at either a big cloud provider or an employer, both of which are examining it at rest.
[ Parent
| on HN ]
Re:The sad state of SMTP encryption
by capt_hotpants on Wednesday November 11, 2015 @06:41AM
(#10546121)
Good question!
For me personally, I'm not too worried about the NSA. But I do think it is quite silly that Gmail and Outlook has a little lock icon to indicate that security is ON, while the first thing that happens when you click Send is that your email is whizzed over half the internet in plaintext.
For organizations and corporations, I imagine they would very much like to be able to verify the identity of the receiving organization before delivering possibly sensitive email.
(The sender identity is already authenticated via DKIM.)
Re:The sad state of SMTP encryption
by thrownaway2424 on Wednesday November 11, 2015 @07:53AM
(#10546396)
For organizations that subscribe to these cloud services (like Google Apps, or hosted Exchange) there are settings to enforce the use of TLS on both inbound and outbound. For example https://support.google.com/a/answer/2520500
Re:The sad state of SMTP encryption
by capt_hotpants on Monday November 23, 2015 @06:45PM
(#10618171)
If you read the fine print in bullet #8, you'll discover that there is, per default, no validation of the presented certificate at all.
Without proper certificate validation, the encryption step is cryptographically worthless. Anyone can MITM the traffic just by presenting a random certificate to the sender.