Re:Bill Gates: I assume my phone's not being tapped
by jlgaddis on Thursday January 23, 2014 @06:51PM
(#7112364)
Google's (outgoing) servers will use STARTTLS if it is advertised by the destination mail server.
Re:Bill Gates: I assume my phone's not being tapped
by ams6110 on Thursday January 23, 2014 @10:05PM
(#7113128)
You still have to assume that an ordinary email is a clear-text communication, no matter who you are sending it to, unless you are using PGP or S/MIME.
Re:Bill Gates: I assume my phone's not being tapped
by psc on Thursday January 23, 2014 @07:58PM
(#7112696)
Never knew, do you a have a source on this? Not that I don't believe you, I just want to read more about it. A Chrome extension that shows you if STARTTLS is being used would be really neat.
Re:Bill Gates: I assume my phone's not being tapped
by jlgaddis on Thursday January 23, 2014 @10:58PM
(#7113266)
Source: Me, who runs (among other things) mail servers for an ISP.
ETA:
Received: from mail-pd0-f169.google.com (mail-pd0-f169.google.com [209.85.192.169])
(using TLSv1 with cipher RC4-SHA (128/128 bits))
(No client certificate requested)
by MAIL.MYDOMAIN.COM (Postfix) with ESMTPS id 1BBFA2909
for <[email protected]>; Thu, 23 Jan 2014 23:00:32 -0500 (EST)
Re:Bill Gates: I assume my phone's not being tapped
by iso-8859-1 on Thursday January 23, 2014 @08:38PM
(#7112853)
How does Chrome have anything to do with this?
SMTP is the protocol that is used for basically all email, and it does not provide encryption. There are versions of the protocol that DO, however they cannot be used in isolation. Emails hop from source to destination via a bunch of SMTP relay servers, and since nearly all SMTP servers support the legacy protocol and do not support key exchange, encrypted SMTP traffic will bounce.
When you use gmail, your connection to Google is secure. But if the recipient of your message is not @gmail.com, the message leaves Google's servers in plain text over SMTP. If the recipient is @gmail.com, the message stays inside the Google network.
The point is, all of our emails traverse the internet in plain text unless we use custom solutions (eg. PGP at both endpoints) or send emails within a network (eg. Gmail to Gmail).