this post was submitted on 28 Nov 2023
0 points (NaN% liked)

memes

9680 readers
2840 users here now

Community rules

1. Be civilNo trolling, bigotry or other insulting / annoying behaviour

2. No politicsThis is non-politics community. For political memes please go to !politicalmemes@lemmy.world

3. No recent repostsCheck for reposts when posting a meme, you can only repost after 1 month

4. No botsNo bots without the express approval of the mods or the admins

5. No Spam/AdsNo advertisements or spam. This is an instance rule and the only way to live.

Sister communities

founded 1 year ago
MODERATORS
 
you are viewing a single comment's thread
view the rest of the comments
[โ€“] Chobbes@lemmy.world 0 points 9 months ago (1 children)

No, they are not. They are not end-to-end encrypted but they are encrypted between your PC and your service provider, between service providers and between service providers and receivers. End-to-end encryption is needed to defend against your service provider or entities that can order your provider around but not against random hackers snooping around in your network.

This is true AND untrue at the same time! It's true that most e-mail providers will talk to other e-mail providers with TLS, but it's trivial to downgrade the connection in most circumstances. If you can man-in-the-middle e-mail servers you can just say "hey, I'm the e-mail provider you're trying to talk to, I don't support TLS, talk to me in plain text!" and the senders will probably oblige. There's a few standards to try to address this problem, like DANE (which actually solves the problem, but is unsupported by all large e-mail providers), and mta-sts which is a much weaker standard (but supported by gmail and outlook). In practice there's a good chance that your e-mail is reasonably well secured, but it's absolutely not a guarantee.

[โ€“] friendlymessage@feddit.de 0 points 9 months ago

That depends on the specific TLS setup. Badly configured TLS 1.2 would allow downgrade attacks, TLS 1.3 would not. I highly doubt the "in most circumstances" line, my guess would be that at least the big ones like gmail don't allow unsecured communication with their servers at all. If not for their users's privacy, then at least to combat spam.