Hacker News Reader

Comment by perl4ever | Hacker News Reader

The thing is, when I'm asked to send sensitive documents over unencrypted email or something, then I'd rather use the fax option. And I don't trust any internet gateway, I go to some local store with actual fax machines. I kinda sorta think of it as more secure than the internet, still?

View on HN

IIRC, automated character recognition / word alerts in FAX transmissions has been built-in in Echelon since the 1970ies. FAX is as insecure as emails are, under certain threat models. Pretty sure this is mentioned in this nice crypto history overview: https://alternativlos.org/30/

I am not concerned if the NSA knows my SSN.

Nothing to hide, I see. :)

I'd normally agree with you, but in the case of dealing with a mortgage broker who asks for stuff to be emailed/faxed and your entire concern is avoiding having your SSN end up where it shouldn't, I do believe this is rational.

It’s more secure in one specific way, a warrant is required to wiretap a phone line, but not the internet.

Then again most phone lines run over the internet these days. No idea how that works out with snooping laws.

My home phone is VOIP [I'm one of those early-adopter Ooma people]. I accept that when power goes out my phone dies with it just as I accept the warrant issue. Perhaps this is an unintended "transparency issue" so I won't be fooled thinking that my phone conversations are legally sacred, but at origin it was simply a "I'm not paying for that" deal.

Side Note: Yes I am just old enough to want, and actively go out to have, a home phone albeit with current technology. I'll take retro-futurism when I can get it.

And, to bring this back around to the topic, you can send a fax with Ooma. :)

What I mean is that even if you have an old school POTS landline (if these are still offered) most of your calls are going to be at least partly routed over the internet, just because it is so much cheaper than maintaining the analog infrastructure.

As far as I know, most modern fax machines keep a record of things received and transmitted on them. At least the ones at my old work did. We could bring up a week's worth of faxes or something and reprint them.

So your threat vector is still like maybe a few dozen people who have access to the fax machine vs. the entire world?

And all those fax machines have a "private" mode where the images don't get saved. On the machines I used. And most only save the cover sheet for sent faxes.

I suppose, I was just more referring to the parent's usage of public fax machines at local stores as being safe for sensitive information. The attack vector might be smaller, but if he's choosing public locations to make sensitive faxes believing it's totally safe, that's not entirely true. The owner of the fax machine, employees in the store and possibly other customers may have access to this info.

I don't use fax machines very often these days.

I would love to see a "Privacy Button" on more than just browsers and fax machines. Perhaps there's some market there, be it free or money or otherwise.

During my time working in the [US] DoD industry, I recall exactly one "training" video informing us that multifunction printers have a storage capacity. Think "You scan something, you save something" type of awareness theatre.

It doesn't surprise me that a "modern day fax machine" [why am I even viably capable of saying such a phrase] would have a similar capability.

What type of threat model is this?

Even standard unencrypted email is largely opportunisticly encrypted these days. Security properties of that is "debatable", but a fax isn't encrypted at all...

> Even standard unencrypted email is largely opportunisticly encrypted these days

I hadn't looked at Google's email encryption report probably since it came out, was very happily surprised to see it's over 90% now[0]. Still doesn't say anything about the issues with accepting self-signed certificates etc though.

[0] https://transparencyreport.google.com/safer-email/overview

I think it's about the difference between being able to expect a certain level of service or not; regardless of what the actual average is.

And about the worst-case scenario and the perception for me of a point-to-point architecture.

If I email something, then if it's "largely" encrypted, that is no consolation if that doesn't hold. I'd feel it was on me for doing it.

On the other hand, if I fax something, and someone who shouldn't sees it, it's likely an insider at the destination location, and in any case, it's not my fault as long as faxing is regarded as reasonably secure.

I still dont think that makes sense. Every attack you can do against email you can do against fax.

MITM the connection - even ignoring opportunistic encryption, almost certainly easier to physically witetap some random office than it is to wiretap the internet connection between google's data center and microsoft's data center (picked as two random big email providers)

Insider at destination: your email account has a password and audit logs. Fax machines sit in the middle of a room. Usually anyone can just walk over

Insider at source: most people have their own computer/email account set up. Going to some sketchy shop with a public fax machine that any malicious party could have secretly modified is much worse.

Reply on news.ycombinator.com