Hacker News Reader

Comment by zbjornson | Hacker News Reader

I was similarly unsurprised to find out that Stanford monitors all emails, including ones not sent via Stanford servers. I noticed my emails sent via SMTP to an outside server (edit: while connected to campus network) were getting softfail header flags because they were being relayed by Stanford. I'm sure all network traffic is monitored as well -- the network usage policy explicitly allows them to.

View on HN

This is more likely an abuse mitigation than intentional surveillance. I helped out in the dorms and student machines were constantly infected with malware, some of which sent tons of spam.

I'd be very surprised if correctly configured SMTP using TLS is intercepted.

Abuse mitigation may have been the (original) intent. However, it prevents sender verification because stanford.edu is not a designated sender for the external domains, and thus has no SPF records.

If I use SMTP to send via gmail with SSL/TLS over port 587, the headers show it hopping through 5 stanford.edu servers, and finally `spf=softfail (google.com: domain of transitioning xxx@gmail.com does not designate (a stanford IP) as permitted sender)`.

For this to work, either your mail client is not enforcing TLS be used, is not validating the certificates presented to it, or trusts Stanford's MITM certificate. Perhaps you should try port 465 with forced SSL.

Stripping TLS is unforgivable. Shame on them.

The problem with SMTP is the broken-by-design STARTTLS mechanism that allows a hostile network like here to trivially strip the encryption.

Been some time since I used a desktop email client, so I'm unsure if clients have now been upgraded to reject sending mails to/through servers that don't do STARTTLS. But I'm guessing no.

Thunderbird changed years ago to not allow soft-fallback for STARTTLS (i.e., if you request to use STARTTLS, and it's not available, it aborts the connection). I'm pretty sure that the account config also doesn't let you set up connections without STARTTLS or SSL without clicking through scary red this-is-not-safe dialogs, although I don't know if that's only for incoming or if it's for outgoing as well.

It's probably not (currently) checking the cert validity because the huge majority of STARTTLS certs, unlike HTTPS certs, are self-signed, so a slightly brave but maybe not that brave attacker could allow STARTTLS but MITM the connection with its own self-signed cert.

Sure it checks that and it alerts the user properly - you then can have it remembered as trusted once and the next connection goes through fine.

That behavior is pretty nice and is probably yielding a lot of real-world security benefit!

Thunderbird checks cert validity. Actually, it's gotten more difficult to use an invalid cert, since the core Gecko code changed the invalid cert dialog to remove the ability to easily import the certificate into the NSS database.

It's sometimes quite helpful to built on the codebase that invented SSL.

The validity of TLS certificates on message submission servers is much better than for MX servers.

Stanford students have to get software installed on their laptops to access the Stanford network. Supposedly this is to force us to have anti-virus installed and the latest security updates, but I doubt any student has actually looked into what the software does / could do.

I've actually dug pretty deeply into it. Briefly, it's IBM BigFix (previously Tivoli Endpoint) and allows university IT to remotely run any script with administrator privileges on your machine. I hate it and remove it after registration. It's one thing to use that on company/university-owned computers. I think it's unacceptable to run it on personally owned machines like Stanford does. Students who live on campus have no alternative ISP.

Stanford gets attacked - a lot. The biggest threat to the network is personally owned machines that need legitimate access to the network. The only way for them to protect the rest of the network is to have some kind of monitoring on those personal machines. The only other alternative would be to run personal machines on a separate network entirely, which they may or may not do already. I'm not sure. And BigFix doesn't cover only students, but also all faculty and staff as well.

Honestly, if you think that's bad, try getting a server online (in the datacenter!). The network admins take their firewall rules very seriously (as well they should).

For me, the biggest pain is the two (yes, two) backup services that must be installed for my department.

A simple hack, if you register your computer as non Windows/ OSX device you're not forced to run it.

That used to work but they've at least made it harder. They started using your browser UA string to detect OS, and somehow (forget details) they've made it more difficult to spoof that.

Install it in a VM?

I block port 25 out because of spam / bot problems with student computers, but I would be curious any reason to do a relay. That doesn't make a heck of sense.

>> I noticed my emails sent via SMTP to an outside server were getting softfail header flags because they were being relayed by Stanford.

This doesn't make any sense - either you were sending them via Stanford or you weren't. If you weren't, how can they be relayed via Stanford?

Because Stanford has a silent proxy picking up SMTP traffic, and running it through their security system.

http://serverfault.com/questions/382329/routing-smtp-and-pop...

Presumably zbjornson was sending messages from a network within Stanford, using vanilla SMTP. In that sort of topology, Stanford's network could easily intercept, monitor and modify SMTP traffic.

What the posters below said. If you use SMTP to send to an external server, and you are on Stanford's network, they intercept it. "Relay" might have been the wrong word.

He could have been sending them to a third party SMTP server from inside the Stanford network.

Reply on news.ycombinator.com