assuming we have a good chain of trust between us, all communications are secure.
That is not correct - an SMTP server will deliver email to another SMTP server in the clear [1]. Your ISP or the ISP that the remote SMTP server is using can read it. Even then - running an email server from home has certain issues such as port 25 inbound blocked, or most email servers will drop email from residential IPs.
The only way to make sure communication is secure is to use an email certificate with encryption or GPG. These would have 2 benefits: the email would verify who it came from (email can be easily forged) and the contents would be encrypted.
I agree. Not sure what's new here. However, I still think the general public has no sense of how email works and possibly assumes all of their email is private?
I know, I did this too recently, but you can build trust.
and I was mentioning my friend to friend example.
Additionally, if someone on gmail had sent me an email, it would go through my spam filters and I would see it.. if I were to reply, gmail remembers that he solicited the conversation and thus I am not blocked..
so it still works, just not so much for initiating conversations, but even then, it'll work after some time.
Comments
email is still federated, I can start my own email system.. my friends can start their own.
assuming we have a good chain of trust between us, all communications are secure.
You know what you're signing up for with google, the services they provide are not the product.. you are..
everyone on hackernews knows this, surely?
That is not correct - an SMTP server will deliver email to another SMTP server in the clear [1]. Your ISP or the ISP that the remote SMTP server is using can read it. Even then - running an email server from home has certain issues such as port 25 inbound blocked, or most email servers will drop email from residential IPs.
The only way to make sure communication is secure is to use an email certificate with encryption or GPG. These would have 2 benefits: the email would verify who it came from (email can be easily forged) and the contents would be encrypted.
[1] http://security.stackexchange.com/questions/12087/if-i-send-...
Well, I'm actually a big advocate of PGP and encryption.
however, I know that SMTPd's (notably: postfix) will negotiate TLS where available, and you can configure it to fail if speaking plaintext.
I agree. Not sure what's new here. However, I still think the general public has no sense of how email works and possibly assumes all of their email is private?
I did that with a server on ovh. Every mail I send to a gmail/outlook/yahoo account goes to the spam folder.
It became very difficult to run your own mail server in the last few years (if you want your mail to go to the inbox of the person you send it to).
And yes, I set up spf and dkim records correctly.
I know, I did this too recently, but you can build trust.
and I was mentioning my friend to friend example.
Additionally, if someone on gmail had sent me an email, it would go through my spam filters and I would see it.. if I were to reply, gmail remembers that he solicited the conversation and thus I am not blocked..
so it still works, just not so much for initiating conversations, but even then, it'll work after some time.
Yes, maybe you and your friends. But that's about all. The vast majority of people can't do this.