Hacker News Reader

Comment by wyldfire | Hacker News Reader

99% of gmail users will never know that the feature exists until they see the warning. That can only have the benefit of encouraging the correspondent to get their provider(s) to enable the encryption.

> stymies passive surveillance... presence or absence should never be communicated ... to avoid suckering them into a false sense of security.

I think you're not giving enough weight to the first point. This really does provide an advantage for individuals who receive their password/reset url or some other credentials via email. At least it wouldn't be intercepted on that hop. Seems like the benefits outweigh the drawbacks.

View on HN

If anything, a spammer or phiser has more motivation to deliver their mail over TLS because of this development, compared to some legitimate host. Whether the mail was delivered via TLS provides no information on its legitimacy. That is why it is problematic that it could give a false sense of security.

Getting the internet as a whole away from plaintext is more important than dealing with MITMs - you may or may not be subject to a MITM attack at any given time, you absolutely are subject to passive surveillance at all times.

Don't let the perfect be the enemy of the better.

Depends on your threat model. Which do you consider more of a threat to you, the NSA or a corporate competitor who hired a black hat for some espionage? Whichever answer you give, there will be people to whom the answer is the opposite. It's not that they're being obtuse - that really is the answer for their situation.

> Don't let the perfect be the enemy of the better.

Think both/and, not either/or.

This isn't a zero sum game. Removing the ability for people to passively spy on you doesn't mean you can't add MITM protection later.

Having everything be encrypted by default is strictly more secure. There's no reason to avoid taking the first step in fear of the second one.

It actually can be zero sum.

Solve the problem with a poor 50% solution which most people can't understand, and you may be stuck with it for another 20 years.

I would encourage anyone to use TLS. However, I take issue with using it as an indicator of the trustworthiness of the sender or its host.

It looks like Gmail is only adding a warning for non-TLS deliveries, not a green padlock (or whatever) for TLS deliveries. I'd be more worried about your point in the latter case. There are other systems in place (SPF, DKIM, DMARC) to identify fake mails.

My guess is that they will simply start using free SSL certs from StartSSL or LetsEncrypt.

Edit: reading the thread more, I guess it depends if they're actually gonna authenticate the certs: https://news.ycombinator.com/item?id=10556544

> At least it wouldn't be intercepted on that hop

It wouldn't be passively intercepted. It could trivially be actively intercepted. Gmail would not display a warning in this case, thus making the user think their password/reset URL was safe when it really wasn't. And trying to inform users about the difference between passive and active interception, and expecting them to make a risk evaluation based on it, is just not realistic for the vast majority of users.

That's not always true, and with more and more hosts supporting key pinning technologies like DANE, it'll be less true with time.

My mail server is set up to know that mail to Google domains (and others, like those hosted by Google or Microsoft) must be encrypted and the certificate must be correct. I occasionally look through my server logs to find more domains I can add to the list.

Reply on news.ycombinator.com