Slashdot Mirror
Google, Microsoft, Yahoo Join Forces To Create New Encrypted Email Protocol
An anonymous reader writes: A group of independent security researchers and major Silicon Valley tech giants have submitted a proposal for a new email protocol called SMTP STS (Strict Transport Security). In theory, this new extension looks like the HSTS (HTTP Strict Transport Security) extension to HTTPS. Much like HSTS, SMTP STS brings message confidentiality and server authenticity to the process of starting an encrypted email communications channel. HSTS works alongside HTTPS to avoid SSL/TLS downgrades and MitM attacks. to avoid SSL/TLS downgrades and MitM attacks. The biggest names on the contributors list include Microsoft, Google, Yahoo, LinkedIn, and Comcast. Last year, Oracle also submitted a similar proposal called DEEP (Deployable Enhanced Email Privacy).
If the messages are not stored encrypted, what's the point? Private email sitting on Google/Yahoo servers is a much larger attack surface than email in transit.
Yahoo Mail needs to have encrypted email. I haven't changed my password in 20+ years and probably won't for the next 20+ years..
The emails are still in plain text inside the email servers en route, unless the email sender and recipient use end-to-end encryption.
Email is the backbone of most businesses and it is a horrible insecure mess. Maybe people will finally be able to email secure information easily. Email is easily one of the biggest compliance issues because of how insecure it is.
Time makes more converts than reason
I like that mods actually took their time to edit a description for once, but there's a mistake.
"The new protocol also works with HTTPS" should be "works like HSTS".
The original text from the recent submissions page was technically accurate.
But yeah, since Microsoft, Yahoo and Google joined forces, this almost guarantees the standard will be approved. Once you get the three major email providers to agree on something, it's almost as done.
I get really tired of this, because it's completely backward and wrong. Email is fine, and it does exactly what it was intended to do. Route messages from source to destination. People like you want email to be something different, but always arbitrary because there is no solution which works to encrypt out of the box which can not be tampered with. You want secure, that's fine but don't make an insecure protocol for mail routing the answer.
Use email for email. Attach encrypted files using what ever format you want, and you have control of the encryption. Stop demanding that generic "email" does it all for you, because if you trust any of the companies listed in TFA to give you bullet proof security, you are a tool.
-The wise argue that there are few absolutes, the fool argues that there are no probabilities.
The new protocol also works with HTTPS to avoid SSL/TLS downgrades and MitM attacks.
The article says:
HSTS works alongside HTTPS to avoid SSL/TLS downgrades and MitM attacks.
HSTS != SMTP STS, though they are similar.
XML is like violence. If it doesn't solve the problem, use more.
It could be considered a protocol to negotiate use of TLS more securely.
S/MIME and OpenPGP would be more thorough solution to the problem.
XML is like violence. If it doesn't solve the problem, use more.
GPG and/or S/MIME would address your concern, but this proposal would not.
This is basically using TLS more properly in SMTP, which in and of itself is good, but far from adequate.
Here is the tricky thing about TLS: it works well in theory for user-service interactions (e.g. I care I'm talking to 'onlinebanking.bigbank.com'), but not as well for messaging (I'm not conversing with a server, whose identity is hidden away in the headers, I'm conversing with whatever is in the 'From/To/CC/BCC' fields, and those are the folks I care about authenticating)
XML is like violence. If it doesn't solve the problem, use more.
I feel bad for you.
e-mail marketing is barely 1 step above straight spam.
If I had it my way, e-mail would be text only or implement some form of markdown
If you want to have fancy formatting, throw up a web page and go nuts, then send a non-shortened link by e-mail if you absolutely must.
My eyes reflect the stars and a smile lights up my face.
> How do you send email to random people encrypted?
> Your solutions work for internal email, but not external.
This problem was solved in 1991, in terms of the technical implementation and protocol. The "problem" is that few people care about receiving encrypted email, so they don't publish a key to use for sending them email. Maybe if email clients made it super-easy more people would do it.
Here's a brief description of how PGP/GPG works. Wherever I publish my email address, I also publish my public key, which I generated. To send me an email, you can either use my address and my public key, or you can let your email client retrieve the key for you, from a key server. Since the email is encrypted with my public key, it can only be decrypted by my private key.
Personally, I publish my public key on the "Contact Us" page of my web site and on the public key servers.
The protocol works fine. The problems are that email clients don't make it super-easy for you to generate and publish a key, or to send PGP email using the recipient's key. That's a UI problem, not a protocol problem.
So now I'll have to decrypt my spam in order to read it? I feel safer already!
Just cruising through this digital world at 33 1/3 rpm...