Hacker News Reader

Comment by izzydata | Hacker News Reader

I'm confused as to why anything isn't 100%. I guess I could maybe understand 0%, but how can it be 50%? I would imagine you either encrypt all email or you don't encrypt any email. What is the in-between?

View on HN

Large installations with heterogeneous clusters, accreted during many internal reigns and rounds of partially-integrated M&A.

Take Cisco.com for example. There are a lot of systems there that are sending out emails. Employees and newsletters are probably encrypted but only make up a small portion of their outbound mail. Things like ticket updates are going to result in a huge volume of email. Cisco may have (wrongly) decided that because the ticketing system is a trusted source it doesn't need to be encrypted. So some of their email is going directly out from the tool and some is going through a smart host. This is probably why it's <50%.

With my small personal domain I was just using a self-signed cert until a few weeks ago, and I could see that some sending servers quit and sent in plain text after encountering a self signed cert, others delivered regardless.

Probably because it allows connections that aren't perfectly secure, such as supporting anything less than 256 bits.

That wouldn't explain why Google would have difficulty.

It implies some kind of inconsistency in configuration or something on the servers Google's sending email to?

Transit encryption requires that both sides are game. Google always supports it, but the server on the other side may not.

Reply on news.ycombinator.com