New Research: Encouraging trends and emerging threats in email security
https://googleonlinesecurity.blogspot.com/2015/11/new-research-encouraging-trends-and.html
To that end, in partnership with the University of
Michigan and the University of Illinois, we're publishing the
results of a multi-year study that measured how email security
has evolved since 2013. While Gmail was the foundation of this
research, the study's insights apply to email more broadly, not
unlike our Safer Email Transparency report. It's our hope that
these findings not only help make Gmail more secure, but will
also be used to help protect email users everywhere as well.
- - -
The irony of course is that TLS (STARTTLS) is basically clown-grade
email encryption. It is -- generally -- easy for midpoints to defeat or
disable (cracking the crypto is not necessary), and due to
incompatibilities results in significant amounts of email not being
delivered at all (that's why many popular mailing list systems are
configured to not use it -- they've actually disabled it after trying to
make it work and ending up with angry respondents who didn't get their
mail, and it's difficult to blame them). And of course, hack attacks
virtually never relate to third-party snooping of email -- rather,
endpoint vulnerabilities are key to the big attacks. My gut feeling is
that Google warning people about receiving unencrypted email will
trigger much angst and panic without doing much good at all. But this is
all part of the Internet's own version of airport "security theater":
"Falling Into the Encryption Trap" -
http://lauren.vortex.com/archive/001108.html
--Lauren--
Lauren Weinstein ([email protected]): http://www.vortex.com/lauren
Founder:
- Network Neutrality Squad: http://www.nnsquad.org
- PRIVACY Forum: http://www.vortex.com/privacy-info
Co-Founder: People For Internet Responsibility: http://www.pfir.org/pfir-info
Member: ACM Committee on Computers and Public Policy
Lauren's Blog: http://lauren.vortex.com
Google+: http://google.com/+LaurenWeinstein
Twitter: http://twitter.com/laurenweinstein
Tel: +1 (818) 225-2800 / Skype: vortex.com
I have consulted to Google, but I am not currently doing so.
My opinions expressed here are mine alone.
_______________________________________________
pfir mailing list
http://lists.pfir.org/mailman/listinfo/pfir
