Hacker News Reader

I think that the (theoretical) MITM attack is played out not between the user and google, but google and the other email provider. For example, a person on gmail sending mail to a yahoo account could be comprimised when google talks to yahoo.

EDIT: Yahoo does NOT use TLS SMTP[1]. Also, Gmail fails Cert verification...[1]

[1]http://www.checktls.com/perl/TestReceiver.pl

View on HN

Google uses TLS SMTP.

Later

Nice catch. I based the Yahoo thing off message board posts with people getting TLS SMTP working, but from their mail clients, not server-to-server.

The Google Mail certificates don't validate because their hostname doesn't exactly match the host for which the certificate was issued ("mx.google.com"). I don't think that's a huge problem in practice.

Reply on news.ycombinator.com