161
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
this post was submitted on 27 Sep 2023
161 points (100.0% liked)
Technology
34917 readers
93 users here now
This is the official technology community of Lemmy.ml for all news related to creation and use of technology, and to facilitate civil, meaningful discussion around it.
Ask in DM before posting product reviews or ads. All such posts otherwise are subject to removal.
Rules:
1: All Lemmy rules apply
2: Do not post low effort posts
3: NEVER post naziped*gore stuff
4: Always post article URLs or their archived version URLs as sources, NOT screenshots. Help the blind users.
5: personal rants of Big Tech CEOs like Elon Musk are unwelcome (does not include posts about their companies affecting wide range of people)
6: no advertisement posts unless verified as legitimate and non-exploitative/non-consumerist
7: crypto related posts, unless essential, are disallowed
founded 5 years ago
MODERATORS
The email protocol, SMTP, was originally not designed with encrypting content in mind. Encryption was added years later, but as an option that is negotiated between mail servers.
While large email providers like Gmail, outlook, etc. likely all support encryption as best as they can, all it takes is one misconfigured server, etc. to cause emails to be sent in clear text at least part of the way from location to another.
It’s largely for that reason why a lot of people & organizations don’t trust email to be secure unless you use mail clients that encrypt and decrypt mail at both ends. But that’s a PITA to set up properly and manage.
If your email is sent entirely within an ecosystem like Gmail then it’s likely encrypted the entire time. But as soon as it passes outside of Gmail to another organization there’s no guarantee it’s still secure. These days it probably is, as virtually every reputable internet provider & company is going to take the issue seriously, but there’s still the history of SMTP not being encrypted that haunts those in the security fields.
SMS has the same problem though. It's only marginally safer because the tools to hijack a cellular session are a bit more complicated to use, but they are widely available and you can find plenty of instructions online on how to use maybe $3k worth of equipment to spoof a GSM base station and force a target device onto it. Hell, in some cases you don't even have to force the target device onto your rogue ENB - you can just jam the phone and hijack the number through your own SIP gateway if you get the timing right.