Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

> SMS and e-mail are sent unauthenticated and unencrypted and can be intercepted in many different ways

My SMS are encrypted with A5, and my email (gmail's inbound smtpd) is (usually) encrypted with TLS.

Of course, I always check with TLS as well.

It's not quite as bad as you seem to make it out.



I think people put way too much faith in inbound TLS. My mail server has some bozo self signed cert and nobody has ever failed to send me an email. Meaning: either nobody is using TLS to deliver mail or they use TLS and ignore all cert failures. Either way, about 99% less secure than you think it is.


Yeah; internal SMTP to SMTP traffic gives no guarantees at all. The only way is to use S-MIME or PGP.


Which A5? Is it vulnerable to one of these attacks? https://en.wikipedia.org/wiki/A5/1#Security (This is besides the more simple exploit, which is either cloning the handset or making a fake GSM base station which your phone will automatically hop to, pass traffic transparently, and sniff control channels)

There is no such thing as secure transport-level e-mail because eventually it may [read: will] hop through a relay which does not use transport-level security.

It's not secure, period.


I don't think there is any working attack vector (i.e. not taking 100 years to do it) against pure TLS as of today. (using it along with compression is another thing)

Edit: looks like I missed the point here

Sent from mobile




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: