News for hackers. Stuff that matters.

A comment on NSA admits listening to U.S. phone calls without warrants. Parent comment

Re:NSA admits listening to U.S. phone calls without warrants by chacham15 on Saturday June 15, 2013 @08:39PM (#5886826)
I think that the (theoretical) MITM attack is played out not between the user and google, but google and the other email provider. For example, a person on gmail sending mail to a yahoo account could be comprimised when google talks to yahoo.

EDIT: Yahoo does NOT use TLS SMTP[1]. Also, Gmail fails Cert verification...[1]

[1]http://www.checktls.com/perl/TestReceiver.pl

[ Parent | on HN ]
Re:NSA admits listening to U.S. phone calls without warrants by tptacek on Saturday June 15, 2013 @08:41PM (#5886834)
Google uses TLS SMTP.

Later

Nice catch. I based the Yahoo thing off message board posts with people getting TLS SMTP working, but from their mail clients, not server-to-server.

The Google Mail certificates don't validate because their hostname doesn't exactly match the host for which the certificate was issued ("mx.google.com"). I don't think that's a huge problem in practice.

[ Parent | on HN ]