NSA admits listening to U.S. phone calls without warrants

Re:NSA admits listening to U.S. phone calls without warrants by tptacek on Saturday June 15, 2013 @09:18PM (#5886964)

We've† already verified this downthread; I'm wrong about Yahoo (they do TLS for their retail SMTP servers but not for MX's), but Google does indeed do TLS on their servers.

† Where by "we" I mean "the guy who isn't me that found the app that gives you the SSL connection details for arbitrary SMTP addresses"

[ Parent | on HN ]

Re:NSA admits listening to U.S. phone calls without warrants by gojomo on Saturday June 15, 2013 @09:40PM (#5887034)

Thanks, so it seems likely that Gmail->Yahoo email is in plaintext.

That Google will "do TLS" is ambiguous. Are we sure Yahoo attempts TLS on their SMTP-connect to Google's MX? It seems unlikely if they don't support it on their own receives, and also unlikely that Gmail would reject all non-TLS SMTP.

If so, NSA wouldn't need Google or Yahoo's private key to record the plaintext of all email between them. And if the Google<->Yahoo interchange is representative, plenty of other email to or from Gmail will be similarly transparent.

[ Parent | on HN ]

Re:NSA admits listening to U.S. phone calls without warrants by tptacek on Saturday June 15, 2013 @09:43PM (#5887051)

From the 'dhess comment downthread it looks like it's possible that Yahoo does TLS outbound but not inbound. Google, it seems, does both.

[ Parent | on HN ]