What gives you that belief, and if it's TLS-secured, would you assume it has the same forward-security as (eg) Chrome-to-Gmail? Or might it be something else, because it happens out of sight, that is a little behind-the-times?
What gives you that belief, and if it's TLS-secured, would you assume it has the same forward-security as (eg) Chrome-to-Gmail? Or might it be something else, because it happens out of sight, that is a little behind-the-times?
I run my own email service (Postfix) on 4 different domains. TLS is properly configured on all of my mailhosts, using certificates issued by StartCom. My servers routinely receive mail from Google, Apple, Yahoo, GNU, and other major email providers. Most of the messages are from various mailing lists.
I occasionally peruse the mail logs, and in the last 3 years, at least, I have never seen an unencrypted SMTP connection. I'm not saying it never happens, I've just never seen it. The most common protocol is TLSv1 with a variant of AES (nearly always 256-bit). Apple's listservs use TLSv1 with 128-bit RC4-MD5, but they're the exception.
I am. I sent this message to my personal domain from my Yahoo Mail account just now:
Jun 16 01:46:01 shell postfix/smtpd[29319]: connect from nm4-vm6.bullet.mail.gq1.yahoo.com[98.136.218.165]
Jun 16 01:46:01 shell postfix/smtpd[29319]: Anonymous TLS connection established from nm4-vm6.bullet.mail.gq1.yahoo.com[98.136.218.165]: TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)
However, it appears that Yahoo's MX did not accept TLS for my outbound reply. That's concerning....† Where by "we" I mean "the guy who isn't me that found the app that gives you the SSL connection details for arbitrary SMTP addresses"
That Google will "do TLS" is ambiguous. Are we sure Yahoo attempts TLS on their SMTP-connect to Google's MX? It seems unlikely if they don't support it on their own receives, and also unlikely that Gmail would reject all non-TLS SMTP.
If so, NSA wouldn't need Google or Yahoo's private key to record the plaintext of all email between them. And if the Google<->Yahoo interchange is representative, plenty of other email to or from Gmail will be similarly transparent.