Slashdot Mirror
Google, Microsoft, Yahoo Join Forces To Create New Encrypted Email Protocol
An anonymous reader writes: A group of independent security researchers and major Silicon Valley tech giants have submitted a proposal for a new email protocol called SMTP STS (Strict Transport Security). In theory, this new extension looks like the HSTS (HTTP Strict Transport Security) extension to HTTPS. Much like HSTS, SMTP STS brings message confidentiality and server authenticity to the process of starting an encrypted email communications channel. HSTS works alongside HTTPS to avoid SSL/TLS downgrades and MitM attacks. to avoid SSL/TLS downgrades and MitM attacks. The biggest names on the contributors list include Microsoft, Google, Yahoo, LinkedIn, and Comcast. Last year, Oracle also submitted a similar proposal called DEEP (Deployable Enhanced Email Privacy).
If the messages are not stored encrypted, what's the point? Private email sitting on Google/Yahoo servers is a much larger attack surface than email in transit.
A back door for the email providers and easy access for FBI/CIA?
"Imagination is more important than knowledge" - Einstein
I get really tired of this, because it's completely backward and wrong. Email is fine, and it does exactly what it was intended to do. Route messages from source to destination. People like you want email to be something different, but always arbitrary because there is no solution which works to encrypt out of the box which can not be tampered with. You want secure, that's fine but don't make an insecure protocol for mail routing the answer.
Use email for email. Attach encrypted files using what ever format you want, and you have control of the encryption. Stop demanding that generic "email" does it all for you, because if you trust any of the companies listed in TFA to give you bullet proof security, you are a tool.
-The wise argue that there are few absolutes, the fool argues that there are no probabilities.
It could be considered a protocol to negotiate use of TLS more securely.
S/MIME and OpenPGP would be more thorough solution to the problem.
XML is like violence. If it doesn't solve the problem, use more.
GPG and/or S/MIME would address your concern, but this proposal would not.
This is basically using TLS more properly in SMTP, which in and of itself is good, but far from adequate.
Here is the tricky thing about TLS: it works well in theory for user-service interactions (e.g. I care I'm talking to 'onlinebanking.bigbank.com'), but not as well for messaging (I'm not conversing with a server, whose identity is hidden away in the headers, I'm conversing with whatever is in the 'From/To/CC/BCC' fields, and those are the folks I care about authenticating)
XML is like violence. If it doesn't solve the problem, use more.
I feel bad for you.
e-mail marketing is barely 1 step above straight spam.
If I had it my way, e-mail would be text only or implement some form of markdown
If you want to have fancy formatting, throw up a web page and go nuts, then send a non-shortened link by e-mail if you absolutely must.
My eyes reflect the stars and a smile lights up my face.
This problem was solved in 1991, in terms of the technical implementation and protocol.
You are confusing the technical solution with the practical end-user solution.
The "problem" is that few people care about receiving encrypted email, so they don't publish a key to use for sending them email. Maybe if email clients made it super-easy more people would do it.
That will never, EVER happen. If people have to "publish" a key manually, then you can just forget it.
Personally, I publish my public key on the "Contact Us" page of my web site and on the public key servers.
See above. You completely and totally miss the point. If I have to track down a web site, or Google+ page, or Facebook page, and manually copy or use a key from there, you might as well toss the whole idea in the bin.
If it isn't automatic, then it doesn't exist for 95%+ of computer users.