5 ms·

Email, still not dead. My work has gradually moved from Web -> Email. I learned about email while working as a sys admin for a website sending 100k mailouts an

Email, still not dead. My work has gradually moved from Web -> Email. I learned about email while working as a sys admin for a website sending 100k mailouts and now I've become a bit of a specialist writing email apps. Postfix is my weapon of choice, you can extend it externally via its unix pipe & socket routing. Currently I'm building an outgoing SMTP service for people network hopping - Wifi, 3g etc. It has been interesting to see the rise in inter-SMTP server communications going SSL. Google & Hotmail, for instance, both use TLS to send their email, even when there's no requirement to do so, TLS is chosen first. So people often trumptet BBM as end-to-end secure but if you use Google Mail with your mobile email and set it to TLS only and only send to other Google & Hotmail users then the same is true. I've also had a report of a German ISP that deep packets SMTP traffic and changes STARTTLS to XXX "for security reasons". I suspect that they have a tap in front of their closed source MTA to log the traffic to satisfy the European Data Retention Directive.

icebraining 15y ago
>So people often trumptet BBM as end-to-end secure but if you use Google Mail with your mobile email and set it to TLS only and only send to other Google & Hotmail users then the same is true. I actually thought they had end-to-end encryption with different keys for every device (PGP-like). That would make them much more secure than that, since the servers wouldn't be able to access the contents. But I've been reading about it before replying and apparently they use a single key per server, not to mention that if you're not on a private BES, you're using a global key (they call it 'scrambled', not encrypted). What a joke.
- DougRathbone 15y ago
  interesting you've found that about BES - link?
  - icebraining 15y ago
    EDIT: It's mostly about BIS; BES servers can actually implement end-to-end, if they're IT department enables the S/MIME module and create, distribute and teach users how to use PKI certificates. But if you're not doing that, you're not really protected. This[1] document from the Communications Security Establishment of Canada explains it well. Citing: PIN-to-PIN transmission security: PIN-to-PIN is not suitable for exchanging sensitive messages. Although PIN-to-PIN messages are encrypted using Triple-DES, the key used is a global cryptographic “key” that is common to every BlackBerry device all over the world. This means any BlackBerry device can potentially decrypt all PIN-to-PIN messages sent by any other BlackBerry device, if the messages can be intercepted and the destination PIN spoofed. Further, unfriendly third parties who know the key could potentially use it to decrypt messages captured over the air. Note that the “BlackBerry Solution Security Technical Overview” document published by RIM specifically advises users to “consider PIN messages as scrambled, not encrypted”. [1]: http://www.cse-cst.gc.ca/its-sti/publications/itsb-bsti/itsb57b-eng.html http://www.cse-cst.gc.ca/its-sti/publications/itsb-bsti/itsb...
JonLim 15y ago
I'd love to hear more about the outgoing SMTP service for people network hopping - I'm not sure I completely understand it and my curiosity is just getting the best of me. :) Tell us more!
- dramaticus3 15y ago
  Buy a Data sim, what to do as outgoing SMTP ? Vodafone for instance : http://www.google.co.uk/search?q=vodafone+smtp http://www.google.co.uk/search?q=vodafone+smtp Our service, one of a few, offers SMTP Auth'd or just relying on MAIL FROM: envelope header for outgoing email, utilising TLS, especially useful when on free-wifi. Set your SPF settings to allow our sending IP in order to improve one's SPAM score. The TLS route means that if one is sending to a GMAIL account then it is the recipient who can break the chain of trust. If you have an SMTP receiver you can send from an open wi-fi access point in Karachi and know that only in server was the plain text processed. I guess that's not saying much but you can easily set it up for yourself.
  - JonLim 15y ago
    Hopefully I'm understanding this correctly: you're creating a service that lets you send emails securely using your hosted SMTP, from anywhere in the world? Useful for traveling on business, I would assume!
    - dramaticus3 15y ago
      Yes, that's the one. There are more than one available. I'm not going to spam the name of mine. It's a service I wanted myself as an early adopter of handheld computers, outgoing SMTP is one of those things where the ISP does everything it can to make you use user@mobileisp.com and even when it is plain, remembering the settings if your phone gets wiped, is it mail.example.isp.com or smtp.example.isp.com. Hopefully it is a bit easier to remember the smtp service one uses.
dramaticus3 15y ago
What am I saying: end to end encryption isn't there, just in-flight encryption. Encrypting the payload before it leaves your network is the only way to do that, not relying on intermediaries. It's a shame we can't sign it for you as it leaves our network, but that would defeat the point.

icebraining 15y ago

>So people often trumptet BBM as end-to-end secure but if you use Google Mail with your mobile email and set it to TLS only and only send to other Google & Hotmail users then the same is true. I actually thought they had end-to-end encryption with different keys for every device (PGP-like). That would make them much more secure than that, since the servers wouldn't be able to access the contents. But I've been reading about it before replying and apparently they use a single key per server, not to mention that if you're not on a private BES, you're using a global key (they call it 'scrambled', not encrypted). What a joke.

DougRathbone 15y ago
interesting you've found that about BES - link?
- icebraining 15y ago
  EDIT: It's mostly about BIS; BES servers can actually implement end-to-end, if they're IT department enables the S/MIME module and create, distribute and teach users how to use PKI certificates. But if you're not doing that, you're not really protected. This[1] document from the Communications Security Establishment of Canada explains it well. Citing: PIN-to-PIN transmission security: PIN-to-PIN is not suitable for exchanging sensitive messages. Although PIN-to-PIN messages are encrypted using Triple-DES, the key used is a global cryptographic “key” that is common to every BlackBerry device all over the world. This means any BlackBerry device can potentially decrypt all PIN-to-PIN messages sent by any other BlackBerry device, if the messages can be intercepted and the destination PIN spoofed. Further, unfriendly third parties who know the key could potentially use it to decrypt messages captured over the air. Note that the “BlackBerry Solution Security Technical Overview” document published by RIM specifically advises users to “consider PIN messages as scrambled, not encrypted”. [1]: http://www.cse-cst.gc.ca/its-sti/publications/itsb-bsti/itsb57b-eng.html http://www.cse-cst.gc.ca/its-sti/publications/itsb-bsti/itsb...

JonLim 15y ago

I'd love to hear more about the outgoing SMTP service for people network hopping - I'm not sure I completely understand it and my curiosity is just getting the best of me. :) Tell us more!

dramaticus3 15y ago
Buy a Data sim, what to do as outgoing SMTP ? Vodafone for instance : http://www.google.co.uk/search?q=vodafone+smtp http://www.google.co.uk/search?q=vodafone+smtp Our service, one of a few, offers SMTP Auth'd or just relying on MAIL FROM: envelope header for outgoing email, utilising TLS, especially useful when on free-wifi. Set your SPF settings to allow our sending IP in order to improve one's SPAM score. The TLS route means that if one is sending to a GMAIL account then it is the recipient who can break the chain of trust. If you have an SMTP receiver you can send from an open wi-fi access point in Karachi and know that only in server was the plain text processed. I guess that's not saying much but you can easily set it up for yourself.
- JonLim 15y ago
  Hopefully I'm understanding this correctly: you're creating a service that lets you send emails securely using your hosted SMTP, from anywhere in the world? Useful for traveling on business, I would assume!
  - dramaticus3 15y ago
    Yes, that's the one. There are more than one available. I'm not going to spam the name of mine. It's a service I wanted myself as an early adopter of handheld computers, outgoing SMTP is one of those things where the ISP does everything it can to make you use user@mobileisp.com and even when it is plain, remembering the settings if your phone gets wiped, is it mail.example.isp.com or smtp.example.isp.com. Hopefully it is a bit easier to remember the smtp service one uses.

dramaticus3 15y ago

What am I saying: end to end encryption isn't there, just in-flight encryption. Encrypting the payload before it leaves your network is the only way to do that, not relying on intermediaries. It's a shame we can't sign it for you as it leaves our network, but that would defeat the point.