Slashdot Mirror

← Back to Stories (view on slashdot.org)

Chaos Computer Club, Others Scoff At German Email Security Move As "Marketing"

Posted by timothy on from the es-klingt-aber-so-gut dept.

The move on the part of three large German ISPs to provide more secure email, marketed as "Email made in Germany" (Deutsche Telekom's part specifically was mentioned here yesterday), has drawn sharp criticism from security experts, according to a report at Ars. Among those experts are members of the Chaos Computing Club, and GPGMail lead Lukas Pitschl, who responded to the move from Deutsche Telekom, GMX, and Web.de to encrypt all email in transmission with SMTP TLS : "'If you really want to protect your e-mails from prying eyes, use OpenPGP or S/MIME on your own desktop and don't let a third-party provider have your data,' he told Ars. 'No one of the "E-Mail made in Germany" initiative would say if they encrypt the data on their servers so they don't have access to it, which they probably don't and thus the government could force them to let them access it.'"

28 of 135 comments (clear)

  1. Re:pgp by MichaelSmith · · Score: 2

    What then?

    --
    http://michaelsmith.id.au
  2. Its a start by maas15 · · Score: 3, Interesting

    It's a start, at least the passwords are safe... there's a tendency for security communities to scoff at nearly any half improvement

    1. Re:Its a start by Anonymous Coward · · Score: 2, Insightful

      No, it's not a start, it's a backwards step. This gives people a false sense of security, when in reality they have none.

    2. Re:Its a start by Dan541 · · Score: 4, Insightful

      It's a recurring problem in the IT industry. Anything that isn't 100% secure gets dismissed.

      SMTP TLS goes a long way towards making email more secure. So long as the providers aren't pretending they are unable to hand it over to law enforcement (encrypted on the server) then it isn't a problem. User education is the key.

      --
      An SQL query goes to a bar, walks up to a table and asks, "Mind if I join you?"
    3. Re:Its a start by Opportunist · · Score: 3, Insightful

      A start, yes. Whether it is in the right direction is debatable.

      The problem is that things today are marketed as absolutes. Just like in this case. IT IS SECURE is bull. And the ones providing it know it. It's a better choice than many alternatives, yes, but you know how people will react to it. Just like they did to antivirus and firewalls. I have antivirus, so I needn't be wary of infections anymore, the antivirus will take care of that!

      Sadly, that's not the case. And people will react in similar ways here. Because they don't want to deal with security, they want someone else to do it for them. If there is not somebody like this, they will, at least maybe, be vigilant. If there's someone promising them privacy and security, they'll rely on it.

      --
      We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
    4. Re:Its a start by gmuslera · · Score: 2

      In fact, the start is that is hosted in Germany, the host don't have to blindly give everything to the US government (what must do if the users are german for US based internet services). That the content, going to another server outside Europe could be intercepted and decrypted or not (or done on target as the mail comes from a non US citizen), is a different problem.

    5. Re:Its a start by Dan541 · · Score: 4, Insightful

      SMTP TLS does absolutely nothing for security if even one provider in the chain doesn't use it.

      Nobody has claimed otherwise.

      SMTP TLS is for securing traffic between servers, no one has said that it will prevent your provider from being complicit in handing over your personal data or that it will protect you if NOT used. Not sure why you felt the need to point out the obvious, BTW did you know an empty Fire Extinguisher won't help you to fight fires?

      SMTP TLS does protect email the fact that it doesn't provide 100% anti-james-bond security doesn't make it useless. Is the lock on my front door useless, since it won't stop a sledgehammer, crowbar, chainsaw or law enforcement?

      Of course it does become a problem if someone touts it as offering more secure than it really does, but this is also a problem that exists with physical security. Yet we don't so readily dismiss our wooden doors, glass windows and cheap residential locks.

      --
      An SQL query goes to a bar, walks up to a table and asks, "Mind if I join you?"
    6. Re:Its a start by ogdenk · · Score: 3, Interesting

      1.) SMTP TLS has been around for a while.

      2.) It can be used to encrypt traffic between client and server and serverserver assuming one end isn't using some 15 year old MTA or is too lazy to set up TLS.

      So no, it's not a backwards step. It helps prevent sniffing e-mail traffic on the local LAN from client->server at least and most of the time serverserver. It's more like they are 15 years late doing something that should have already been done. It does NOT help with mail stored on the server so if it's hacked/siezed you're still screwed.

      The biggest problem is the NSA is basically trying to render SSL/TLS useless by bullying CA's into handing over keys.

      The NSA has shown us the most basic weakness with TLS/SSL recently. Really, until everyone starts using GPG or SMTP is replaced with something more modern, there is no such thing as comfortable end-to-end e-mail security.

      But you're right, they shouldn't try to instill a sense of false security but that's not the same as NO security. SSL/TLS does really help and any mail provider that doesn't support it by now should be considered insane and possibly blacklisted.

      Think about it though, if they came out and told the public "we're spending a bunch of money and resources to help e-mail security out a little bit so people can have a slightly smaller chance of reading your mail" they would get screamed at.

  3. So what ever became of public key escrows? by goombah99 · · Score: 5, Interesting

    When public key encryption first came out in the late 70s, the promise was we would all have escrowed public keys. A public key would be linked to an e-mail address in the same way a DNS server connects a URL to an IP. I woul dnot need to know your public key ahead of time, my e-mail client would quietly fetch it for me using your e-mail address, and then encrypt the message.

    So basically by now all e-mail should be encrypted by default if the future had panned out the way everyone thought in 1976.

    All that's missing is ubiquitious public key servers and a universal protocol for binding a key to an e-mail. We do this a zillion times a day for DNS, so it's not technologically difficult.

    Why didn't it happen?

    --
    Some drink at the fountain of knowledge. Others just gargle.
    1. Re:So what ever became of public key escrows? by icebike · · Score: 2

      So you haven't found key servers yet?

      Why not try on line at http://pgp.mit.edu/

      --
      Sig Battery depleted. Reverting to safe mode.
    2. Re:So what ever became of public key escrows? by goombah99 · · Score: 2

      All that's missing is ubiquitious public key servers

      We have that now. The reason I haven't set it up for my mother is that she uses gmail and her email is stored by google in plain text anyway.

      No we don't. Or if I'm wrong then please point me to the information I need to configure this transparently on an e-mail imap client. To be useful it needs to be invisible so no matter who I'm sending an e-mail too it doesn't matter if they have a public key or not. Likewise if someone is sending me an e-mail my client needs to be able to handle it regardless of being encrypted or not without my intervention.

      SO what clients do that? and what public escrow do they use?

      --
      Some drink at the fountain of knowledge. Others just gargle.
    3. Re:So what ever became of public key escrows? by MichaelSmith · · Score: 5, Interesting

      I use the enigmail extension for thunderbird. It transparently handles the encryption and decryption of messages. It looks up PGP keys on key servers for recipients of the messages I send. I store my key on pool.sks-keyservers.net

      The choice of key server is entirely up to me. It is not built into enigmail.

      --
      http://michaelsmith.id.au
    4. Re:So what ever became of public key escrows? by MichaelSmith · · Score: 3, Insightful

      Stop using a web browser for a mail interface.

      Well yeah but web mail is used by many people for its convenience. People rely on it for cloud storage. Telling people to stop using it won't make them stop, not easily.

      --
      http://michaelsmith.id.au
    5. Re:So what ever became of public key escrows? by goombah99 · · Score: 4, Interesting

      I use the enigmail extension for thunderbird. It transparently handles the encryption and decryption of messages. It looks up PGP keys on key servers for recipients of the messages I send. I store my key on pool.sks-keyservers.net

      The choice of key server is entirely up to me. It is not built into enigmail.

      Cool. But this isn't really fixing the core problem of universality. If everyone uses a different key server, then I have to know what key server someone used to send them an e-mail (and vica versa). We don't have that problem with DNS. every URL gets resolved. the DNS servers push out best guess routing tables. The whole internet is transparent to the user just given the DNS and a URL. It should be that way for e-mail.

      Ideally you could imagine that the DNS resolver would also resolve translation of the e-mail address to a public key. It could cache the keys itself, or know what key server to query. The problem with that idea perhaps is that there are more e-mail addresses than URLs. So what you want to do instead us have the url in the e-mail address proivide the service.

      THat is, if I want to send an e-mail to foo@hotmail.com then my client query's hotmail for the public key for foo. If hotmail decided not to particiapte the DNS could provide an alternative address for a catch-all server of keys.

      But I just don't see how this works if everyone is using a different service provided for their key. How can my client know what to do??

      --
      Some drink at the fountain of knowledge. Others just gargle.
    6. Re:So what ever became of public key escrows? by MichaelSmith · · Score: 4, Informative

      There is an online pool of key servers with a limited number of entry points so that each client knows which servers to search for keys. It is very reliable and I have never had to manually search for a key to exchange messages with a person. Finding the keys isn't the problem. Complacency is. I recently worked with a group of security conscious people who had PGP set up. I encrypted all the messages I sent to them initially but they sent their replies in plain text so I gave up.

      Enigmail here searches pool.sks-keyservers.net, subkeys.pgp.net, sks.mit.edu, ldap://certserver.pgp.com

      --
      http://michaelsmith.id.au
    7. Re:So what ever became of public key escrows? by MichaelSmith · · Score: 2

      The enigmail configuration has a keyserver setup UI with defaults loaded, which makes the upload of keys quite easy. If we are not at the point where my mother could do it, then we are close.

      But this requires I know the keyserver used by every person I might e-mail. How do I know that ahead of time?

      As I said above: there is a limited number of key servers on line and currently it is simple to locate the key for an email address.

      --
      http://michaelsmith.id.au
    8. Re:So what ever became of public key escrows? by icebike · · Score: 3, Informative

      The enigmail configuration has a keyserver setup UI with defaults loaded, which makes the upload of keys quite easy. If we are not at the point where my mother could do it, then we are close.

      But this requires I know the keyserver used by every person I might e-mail. How do I know that ahead of time?

      No, any key server will do.
      And there are hundreds of them, and they all talk to each other.

      Any modern email program will have a pgp plugin which will query the server for you

      --
      Sig Battery depleted. Reverting to safe mode.
    9. Re:So what ever became of public key escrows? by kanweg · · Score: 2

      "Cool. But this isn't really fixing the core problem of universality. If everyone uses a different key server, then I have to know what key server someone used to send them an e-mail (and vica versa). We don't have that problem with DNS. every URL gets resolved. the DNS servers push out best guess routing tables. The whole internet is transparent to the user just given the DNS and a URL. It should be that way for e-mail."

      No need for new Internet protocols. You can start with this right now: Tell everyone on who is into encrypted email to do the following: Make a rule in your email client that automatically replies with the public key when the subject line reads: Public key please.

      All your emails could contain the signature line: To send me a secure email, send a regular email with Public key please in the subject line. You'll receive an automatic reply containing my public key.
      This tells other people that they can set up their email client to do it too for their public key.

      Once this gets traction everybody will know it is part of what you do when you get into encrypting email.

      Bert

    10. Re:So what ever became of public key escrows? by AmiMoJo · · Score: 2

      I think any new system needs to at least match webmail for features and convenience. That means accessible from any browser and with mobile phone apps, and for free. It needs to be easy to set up.

      Some kind of wrapper around IMAP might work, but ideally a browser extension that just secures Gmail and Hotmail could be created. I remember there was a project to do this for Firefox, but it seemed to die as Google re-hashed the early Gmail code so often.

      --
      const int one = 65536; (Silvermoon, Texture.cs)
      SJW, n: "Someone I don't like, and by the way I'm a fuckwit" - AC
    11. Re:So what ever became of public key escrows? by b4dc0d3r · · Score: 2

      The sort of encryption needed was illegal to export from the USA during most of that time. And USA was driving or pushing adoption of the internet, the web, the browser, email, AOL keywords...

      Business made a concerted effort to make putting credit card info into a website look secure. But no one ever questioned if putting their mails to friends and relatives required the same protection.

      No demand meant early providers of paid services and clients did not put effort into encryption. Then people grew up in that world, and it seems normal.

      Now, encrypted mail is reported with news of terrosts and pedo rings and drug cartels, so it is not just "not normal" - it is "abnormal" to encrypt.

      Assuming your question wasn't rhetoric, I hope that helps.

  4. as simple as ABC by ls671 · · Score: 2

    as simple as ABC, baby you and me.

    Of course encrypt with START TLS but it has nothing to do with gpg/pgp.

    -[PinePGP Sun Aug 11 03:08:56 EDT 2013]-------------------
    gpg: Signature made Sun Aug 11 03:08:37 2013 EDT using DSA key ID 5BA0D409
    gpg: Good signature from ""
    --[PinePGP Sun Aug 11 03:08:56 EDT 2013]------------[end]--

    --
    Everything I write is lies, read between the lines.
  5. Setup your mail by Thor+Ablestar · · Score: 2

    Once upon a time I became paranoidal about my mail security. It took me about 1 hour to install my own mail server with encryption. Then I sent myself a letter via my ISP. And logs had shown that the transmission was really encrypted.

    What does it mean: There are the only paths that can be passively intercepted or subpoenaed (I don't take in account MITM): SMTP link from sender to source SMTP server, SMTP link from sender to backup SMTP server, SMTP link to receiving server, POP link from receiving server to receiver and all the computers involved. Sender side may be controlled by sending person, receiver side controlled by receiving person, backup disabled in DNS, so the 3-letter agency will not see anything without special means.

    Hack methods: 1) Hack a DNS to insert a backup server and see the message there. 2) Extort the message from any side.

    I believe it's enough for 99% of all cases. Other 1% will need something more interesting, and I believe that the "more interesting" cases should not only encrypt the messages, but firstly hide the fact of communications since the messages may be extorted easier than decrypted. In other words, TOR, I2P, VPN and other means for hiding the very fact of communication are absolutely needed.

  6. Is there any decent alternative to Thunderbird? by nashv · · Score: 2

    Maybe a little offtopic, but I for one have found serious dearth of decent email clients. Is Thunderbird the only option that actually does everything and doesn't look like shit ?

    Oh wait, it just upgraded to 17.0 and looks like shit now too.

    --
    Entia non sunt multiplicanda praeter necessitatem.
    1. Re:Is there any decent alternative to Thunderbird? by Arker · · Score: 2

      All email clients suck. Mutt just sucks less.

      --
      =-=-=-=-=-=-=-=-=-=-=-=-=-=-
      Friends don't let friends enable ecmascript.
  7. Re:So What Ever Became...? How About "So What?" by mellyra · · Score: 2

    The problem is that SMTP TLS is marketed as a solution to a problem - intelligence agencies reading your emails - that it simply doesn't solve. Thus it creates a false sense of security.

    In itself and without the misleading marketing its implementation would of course be a very positive development.

  8. Re:Three German Providers Proudly Enable TLS by pizzap · · Score: 2

    Let me just add this: They won't talk TLS to any mail server, just amongst each other. And if you send a mail from Web.de to GMX you get a warm fuzzy icon in the web interface.

  9. Re:pgp by e065c8515d206cb0e190 · · Score: 2

    That's /one/ alternative.

  10. Re:pgp by CronoCloud · · Score: 2

    Part of the problem is he's using Symantec's PGP rather than the OSX build of GnuPG. And considering that the original version that HE created was command line only, he should know that to decrypt something sent to him, all he needs is his own private key. I mean, after all, he's Phil Zimmerman, doesn't he have his key?