Slashdot Mirror
Google, Microsoft, Yahoo Join Forces To Create New Encrypted Email Protocol
An anonymous reader writes: A group of independent security researchers and major Silicon Valley tech giants have submitted a proposal for a new email protocol called SMTP STS (Strict Transport Security). In theory, this new extension looks like the HSTS (HTTP Strict Transport Security) extension to HTTPS. Much like HSTS, SMTP STS brings message confidentiality and server authenticity to the process of starting an encrypted email communications channel. HSTS works alongside HTTPS to avoid SSL/TLS downgrades and MitM attacks. to avoid SSL/TLS downgrades and MitM attacks. The biggest names on the contributors list include Microsoft, Google, Yahoo, LinkedIn, and Comcast. Last year, Oracle also submitted a similar proposal called DEEP (Deployable Enhanced Email Privacy).
If the messages are not stored encrypted, what's the point? Private email sitting on Google/Yahoo servers is a much larger attack surface than email in transit.
Yahoo Mail needs to have encrypted email. I haven't changed my password in 20+ years and probably won't for the next 20+ years..
The emails are still in plain text inside the email servers en route, unless the email sender and recipient use end-to-end encryption.
Email is the backbone of most businesses and it is a horrible insecure mess. Maybe people will finally be able to email secure information easily. Email is easily one of the biggest compliance issues because of how insecure it is.
Time makes more converts than reason
The competing standards one.
Generating fake email that's good enough to pass most humans' scrutiny is ridiculously easy; I used to do it as a prank, to prove a point about why we need to use GnuPG signatures all the time.
Finding God in a Dog
A back door for the email providers and easy access for FBI/CIA?
"Imagination is more important than knowledge" - Einstein
What does this give over the existing protocols, other than using TLS? It looks like once the E-mail is received by the client side, it is stored decrypted, so it only solved a part of the problem.
What is so wrong with getting people to use a standard like S/MIME or OpenPGP, which truly secure messages, regardless if it is in-flight, sitting on a hard disk, or sitting on a spool file on a relay? The advantage of OpenPGP is that it functions independently of the messaging protocol, so security is assured, even if there is no other encryption in any part of the chain, other than the endpoints.
I like that mods actually took their time to edit a description for once, but there's a mistake.
"The new protocol also works with HTTPS" should be "works like HSTS".
The original text from the recent submissions page was technically accurate.
But yeah, since Microsoft, Yahoo and Google joined forces, this almost guarantees the standard will be approved. Once you get the three major email providers to agree on something, it's almost as done.
I have the contrary opinion that the threat of your emails being hacked or exposed does at least one good thing:
It forces people to think a bit more carefully about the things they say/write (and read) over email, and makes people communicate a bit more formally in that medium. When someone starts relying (or incorrectly believing) that email contents are totally secure and private, you get in trouble and start writing/saying things you really shouldn't.
I get really tired of this, because it's completely backward and wrong. Email is fine, and it does exactly what it was intended to do. Route messages from source to destination. People like you want email to be something different, but always arbitrary because there is no solution which works to encrypt out of the box which can not be tampered with. You want secure, that's fine but don't make an insecure protocol for mail routing the answer.
Use email for email. Attach encrypted files using what ever format you want, and you have control of the encryption. Stop demanding that generic "email" does it all for you, because if you trust any of the companies listed in TFA to give you bullet proof security, you are a tool.
-The wise argue that there are few absolutes, the fool argues that there are no probabilities.
The new protocol also works with HTTPS to avoid SSL/TLS downgrades and MitM attacks.
The article says:
HSTS works alongside HTTPS to avoid SSL/TLS downgrades and MitM attacks.
HSTS != SMTP STS, though they are similar.
XML is like violence. If it doesn't solve the problem, use more.
Please, PLEASE PLEASE PLEASE!
Make the whole email (outside of the headers) encrypted!
This time really do the requirement so that no one else can read than receiver....
Oh, Google/Microsoft/Yahoo and their reason to read every email and build complex profile of the account by using "anti-spam/phishing/malware" filtering as excuse, at least Google says directly that they use that build profile as well to show ads to you!
http://www.slate.com/blogs/fut...
http://arstechnica.com/tech-po...
big tech corps are interested in creating appearance of secure and private communication to all, that it also usable without effort on our part. but this is impossible to achieve.
if we want to be secure and private, we have to do it ourselves and spend some time and effort to get a solution that will suit us. for most email we probably don't need that, but when we need it, we have to spend resources to achieve it.
don't expect, or trust, big tech corps to provide it.
Was disappointed to see AOL absent from this list of email provider collaboration. But not surprised.
$5 / month hosted VPS on linux = awesome!
As someone who has to code a few email newsletters a week, how about we create a new email standard with attached assets like stylesheets and images, and that conforms to HTML5 and CSS3?
Stellar reputations in security and in always doing what is best for the end-user. Every. Last. One. Of. Them.
Will this standard allow me to setup my own e-mail server and Google/Microsoft not silently drop all my messages? Because that's the biggest problem with e-mail right now. I wrote a post on it a while ago:
http://penguindreams.org/blog/how-google-and-microsoft-made-email-unreliable/
What? That makes no sense at all. Let's read the article!
Oh, that makes sense. They're comparing SMTP strict transport security to HTTP transport security and saying that it prevents downgrade attacks, not that it works with HTTPS to prevent downgrade attacks.
I feel bad for you.
e-mail marketing is barely 1 step above straight spam.
If I had it my way, e-mail would be text only or implement some form of markdown
If you want to have fancy formatting, throw up a web page and go nuts, then send a non-shortened link by e-mail if you absolutely must.
My eyes reflect the stars and a smile lights up my face.
> How do you send email to random people encrypted?
> Your solutions work for internal email, but not external.
This problem was solved in 1991, in terms of the technical implementation and protocol. The "problem" is that few people care about receiving encrypted email, so they don't publish a key to use for sending them email. Maybe if email clients made it super-easy more people would do it.
Here's a brief description of how PGP/GPG works. Wherever I publish my email address, I also publish my public key, which I generated. To send me an email, you can either use my address and my public key, or you can let your email client retrieve the key for you, from a key server. Since the email is encrypted with my public key, it can only be decrypted by my private key.
Personally, I publish my public key on the "Contact Us" page of my web site and on the public key servers.
The protocol works fine. The problems are that email clients don't make it super-easy for you to generate and publish a key, or to send PGP email using the recipient's key. That's a UI problem, not a protocol problem.
While the various researchers who submitted SMTP-STS may be associated with Google, Yahoo!, LinkedIn, etc., the IETF does not recognize corporations or governments. Each individual speaks for themselves. The draft RFC may imply that the companies employing these folks back this protocol, but it just isn't the case that they actually do.
HTTPS != HTTP so your opening is simply wrong. Assuming you intended HTTP in your first sentence, you are using flawed logic. The purpose of HTTP is not the same as SMTP, so trying to compare apples and orangutans is pretty damn foolish right? Why is your scooter not as secure as an M1A2SEP93 tank? Oh noes!!
-The wise argue that there are few absolutes, the fool argues that there are no probabilities.
How about we don't?
HSTS, etc don't help users. They just entrench corporations and give an incredibly misplaced sense of security.
Tiger stones; I don't see any tigers in Salt Lake City so my tiger stones MUST be working.
Remember, if the FBI can't easily monitor ALL YOUR COMMUNICATIONS, then THE TERRORISTS WIN!!!
I've abandoned my search for truth; now I'm just looking for some useful delusions.
Right now there is "Confidant Mail" but people don't really care
https://www.confidantmail.org/
So now I'll have to decrypt my spam in order to read it? I feel safer already!
Just cruising through this digital world at 33 1/3 rpm...
I still don't understand why don't people just use PGP. It solves the problem pretty well.
Because it doesn't work with SMTP, only really old, no-longer-used protocols.
No one cares because it is useless.
> You completely and totally miss the point. If I have to track down a web site, or Google+ page, or Facebook page, and manually copy or use a key from there, you might as well toss the whole idea in the bin.
I said that, twice. Twice I said if mail clients don't basically do it automatically, people won't do it manually. So I'm not sure how you can say I miss that point.
What I find interesting about that is that everyone WILL find and Sally's email address, sally.krendircksoen9283@hotmail.com. Yet almost -nobody-, not even the most privacy preaching, Rand Paul voting Slashtotters, will click on the key link right next to the email address.
Encryption with public keys basically requires signatures as a precondition. Without validation, you could be encrypting the message with the bad guy's key.
I said that, twice. Twice I said if mail clients don't basically do it automatically, people won't do it manually. So I'm not sure how you can say I miss that point.
Well, then I must have misread you. I apologize.
What I find interesting about that is that everyone WILL find and Sally's email address, sally.krendircksoen9283@hotmail.com. Yet almost -nobody-, not even the most privacy preaching, Rand Paul voting Slashtotters, will click on the key link right next to the email address.
That is what I said, so clearly I was completely misreading your post.
Sorry about that.
Please. I receive and process hundreds of emails a day in my line of work as a manager, and judicious formatting makes emails vastly more readable. The ability to bold, underline and make bullets to emphasize important details for the benefit of the reader is a huge and really basic fundamental time saver.
It's all the developers i work with though who are always stripping html formatting who really piss me off, and i swear half the time I don't read their emails because the visual monotone is just too hard to slog through. Also it fucks up the email threads because it rips out any useful emphasis from other thread participants.
A few of the developers I *cannot avoid* working with, I have successfully appealed to them to set HTML by default on the grounds of readability. Conversation went like this:
Me: "Dude, do you find it comfortable to read emails that are well formatted for readability?"
Him: "Um, yeah sure."
Me: "Then why don't you afford me the same courtesy? Your emails are hard as hell to read, and you screw up the thread history by rudely removing other peoples formatting."
Him: "Hm, never thought about that. Okay, HTML is good, i'll switch."
Drop mic.
And Javascript? Oh, what could possible go wrong there?
We've already got start TLS if the admins want to enable and configure it. What does having yet another type of encryption channel do?
I'll tell you what the problem with the lack of encryption is. It's certificates. They cost way too much which makes a somewhat complicated setup procedure even less desirable.
Let'sEncrypt is a small step in the right direction, but it is not the answer. Their free certificates make it very appealing, but running their funky and highly suspect code on my servers, to dynamically change my certs no less, is a non-starter. Allow me to pull free certs and install them as I see fit and I'll have a valid cert on every singe host. Until then, there's going to be a small few hosts with valid third party certs and a bunch of self-signed.
Markdown would allow for simple formatting like what you describe.
My eyes reflect the stars and a smile lights up my face.
The way I see it, it's much like IP protocol and specifically IP addresses- the protocol, the technology, works well, but IP addresses needed a user-friendly layer on top. Enter DNS. You can google.com and your client software automatically looks up the matching IP and uses it. There's a standard to do the exact same thing with PGP keys.
PGP keys can be served via DNS, so when you email support@clonebox.net it automatically looks up my key and encrypts your email. Just as you, the human user, never see the IP of my mail server, you also never see my PGP key. It just works automatically. Of course that means DNS needs yo be secured. Enter DNSSEC.