Slashdot Mirror
Google, Microsoft, Yahoo Join Forces To Create New Encrypted Email Protocol
An anonymous reader writes: A group of independent security researchers and major Silicon Valley tech giants have submitted a proposal for a new email protocol called SMTP STS (Strict Transport Security). In theory, this new extension looks like the HSTS (HTTP Strict Transport Security) extension to HTTPS. Much like HSTS, SMTP STS brings message confidentiality and server authenticity to the process of starting an encrypted email communications channel. HSTS works alongside HTTPS to avoid SSL/TLS downgrades and MitM attacks. to avoid SSL/TLS downgrades and MitM attacks. The biggest names on the contributors list include Microsoft, Google, Yahoo, LinkedIn, and Comcast. Last year, Oracle also submitted a similar proposal called DEEP (Deployable Enhanced Email Privacy).
If the messages are not stored encrypted, what's the point? Private email sitting on Google/Yahoo servers is a much larger attack surface than email in transit.
Yahoo Mail needs to have encrypted email. I haven't changed my password in 20+ years and probably won't for the next 20+ years..
The emails are still in plain text inside the email servers en route, unless the email sender and recipient use end-to-end encryption.
Email is the backbone of most businesses and it is a horrible insecure mess. Maybe people will finally be able to email secure information easily. Email is easily one of the biggest compliance issues because of how insecure it is.
Time makes more converts than reason
Generating fake email that's good enough to pass most humans' scrutiny is ridiculously easy; I used to do it as a prank, to prove a point about why we need to use GnuPG signatures all the time.
Finding God in a Dog
A back door for the email providers and easy access for FBI/CIA?
"Imagination is more important than knowledge" - Einstein
What does this give over the existing protocols, other than using TLS? It looks like once the E-mail is received by the client side, it is stored decrypted, so it only solved a part of the problem.
What is so wrong with getting people to use a standard like S/MIME or OpenPGP, which truly secure messages, regardless if it is in-flight, sitting on a hard disk, or sitting on a spool file on a relay? The advantage of OpenPGP is that it functions independently of the messaging protocol, so security is assured, even if there is no other encryption in any part of the chain, other than the endpoints.
I like that mods actually took their time to edit a description for once, but there's a mistake.
"The new protocol also works with HTTPS" should be "works like HSTS".
The original text from the recent submissions page was technically accurate.
But yeah, since Microsoft, Yahoo and Google joined forces, this almost guarantees the standard will be approved. Once you get the three major email providers to agree on something, it's almost as done.
I have the contrary opinion that the threat of your emails being hacked or exposed does at least one good thing:
It forces people to think a bit more carefully about the things they say/write (and read) over email, and makes people communicate a bit more formally in that medium. When someone starts relying (or incorrectly believing) that email contents are totally secure and private, you get in trouble and start writing/saying things you really shouldn't.
I get really tired of this, because it's completely backward and wrong. Email is fine, and it does exactly what it was intended to do. Route messages from source to destination. People like you want email to be something different, but always arbitrary because there is no solution which works to encrypt out of the box which can not be tampered with. You want secure, that's fine but don't make an insecure protocol for mail routing the answer.
Use email for email. Attach encrypted files using what ever format you want, and you have control of the encryption. Stop demanding that generic "email" does it all for you, because if you trust any of the companies listed in TFA to give you bullet proof security, you are a tool.
-The wise argue that there are few absolutes, the fool argues that there are no probabilities.
The new protocol also works with HTTPS to avoid SSL/TLS downgrades and MitM attacks.
The article says:
HSTS works alongside HTTPS to avoid SSL/TLS downgrades and MitM attacks.
HSTS != SMTP STS, though they are similar.
XML is like violence. If it doesn't solve the problem, use more.
http://www.slate.com/blogs/fut...
http://arstechnica.com/tech-po...
big tech corps are interested in creating appearance of secure and private communication to all, that it also usable without effort on our part. but this is impossible to achieve.
if we want to be secure and private, we have to do it ourselves and spend some time and effort to get a solution that will suit us. for most email we probably don't need that, but when we need it, we have to spend resources to achieve it.
don't expect, or trust, big tech corps to provide it.
Was disappointed to see AOL absent from this list of email provider collaboration. But not surprised.
$5 / month hosted VPS on linux = awesome!
S/MIME is your answer.
If builders built buildings the way programmers wrote programs, then the first woodpecker would destroy civilization.
Will this standard allow me to setup my own e-mail server and Google/Microsoft not silently drop all my messages? Because that's the biggest problem with e-mail right now. I wrote a post on it a while ago:
http://penguindreams.org/blog/how-google-and-microsoft-made-email-unreliable/
I feel bad for you.
e-mail marketing is barely 1 step above straight spam.
If I had it my way, e-mail would be text only or implement some form of markdown
If you want to have fancy formatting, throw up a web page and go nuts, then send a non-shortened link by e-mail if you absolutely must.
My eyes reflect the stars and a smile lights up my face.
> How do you send email to random people encrypted?
> Your solutions work for internal email, but not external.
This problem was solved in 1991, in terms of the technical implementation and protocol. The "problem" is that few people care about receiving encrypted email, so they don't publish a key to use for sending them email. Maybe if email clients made it super-easy more people would do it.
Here's a brief description of how PGP/GPG works. Wherever I publish my email address, I also publish my public key, which I generated. To send me an email, you can either use my address and my public key, or you can let your email client retrieve the key for you, from a key server. Since the email is encrypted with my public key, it can only be decrypted by my private key.
Personally, I publish my public key on the "Contact Us" page of my web site and on the public key servers.
The protocol works fine. The problems are that email clients don't make it super-easy for you to generate and publish a key, or to send PGP email using the recipient's key. That's a UI problem, not a protocol problem.
While the various researchers who submitted SMTP-STS may be associated with Google, Yahoo!, LinkedIn, etc., the IETF does not recognize corporations or governments. Each individual speaks for themselves. The draft RFC may imply that the companies employing these folks back this protocol, but it just isn't the case that they actually do.
HTTPS != HTTP so your opening is simply wrong. Assuming you intended HTTP in your first sentence, you are using flawed logic. The purpose of HTTP is not the same as SMTP, so trying to compare apples and orangutans is pretty damn foolish right? Why is your scooter not as secure as an M1A2SEP93 tank? Oh noes!!
-The wise argue that there are few absolutes, the fool argues that there are no probabilities.
Remember, if the FBI can't easily monitor ALL YOUR COMMUNICATIONS, then THE TERRORISTS WIN!!!
I've abandoned my search for truth; now I'm just looking for some useful delusions.
So now I'll have to decrypt my spam in order to read it? I feel safer already!
Just cruising through this digital world at 33 1/3 rpm...
> You completely and totally miss the point. If I have to track down a web site, or Google+ page, or Facebook page, and manually copy or use a key from there, you might as well toss the whole idea in the bin.
I said that, twice. Twice I said if mail clients don't basically do it automatically, people won't do it manually. So I'm not sure how you can say I miss that point.
What I find interesting about that is that everyone WILL find and Sally's email address, sally.krendircksoen9283@hotmail.com. Yet almost -nobody-, not even the most privacy preaching, Rand Paul voting Slashtotters, will click on the key link right next to the email address.
Encryption with public keys basically requires signatures as a precondition. Without validation, you could be encrypting the message with the bad guy's key.
I said that, twice. Twice I said if mail clients don't basically do it automatically, people won't do it manually. So I'm not sure how you can say I miss that point.
Well, then I must have misread you. I apologize.
What I find interesting about that is that everyone WILL find and Sally's email address, sally.krendircksoen9283@hotmail.com. Yet almost -nobody-, not even the most privacy preaching, Rand Paul voting Slashtotters, will click on the key link right next to the email address.
That is what I said, so clearly I was completely misreading your post.
Sorry about that.
Markdown would allow for simple formatting like what you describe.
My eyes reflect the stars and a smile lights up my face.
The way I see it, it's much like IP protocol and specifically IP addresses- the protocol, the technology, works well, but IP addresses needed a user-friendly layer on top. Enter DNS. You can google.com and your client software automatically looks up the matching IP and uses it. There's a standard to do the exact same thing with PGP keys.
PGP keys can be served via DNS, so when you email support@clonebox.net it automatically looks up my key and encrypts your email. Just as you, the human user, never see the IP of my mail server, you also never see my PGP key. It just works automatically. Of course that means DNS needs yo be secured. Enter DNSSEC.