Hacker News new | ask | show | jobs
by judge2020 2516 days ago
The "domain by % encryption" table[0] is really cool - effectively a "name and shame" for still having old or misconfigured software.

0: https://transparencyreport.google.com/safer-email/overview?h...

3 comments

And for email that's only looking for Opportunistic Encryption.

On the deliver-to-Google side that's only checking if they bothered doing TLS, and doesn't try to guess whether they'd fall back to insecure delivery if it was blocked, whether they check certificates, whether they allow archaic old ciphersuites and other configuration that's unsafe or anything like that.

On the accept-mail-from-Google side that's not penalising them if they don't have plausibly trustworthy certificates, or they don't speak any modern ciphersuites or protocol versions, only if they literally can't accept TLS.

Google offers an envelope versus postcard analogy, and that's exactly appropriate. Opportunistic encryption, like the envelope, means probably a postal delivery worker didn't bother reading your letter, it'd be a hassle. But anyone who is in the snooping business, like an intelligence agency or a direct adversary, OE doesn't stop them.

Also, if you enable "green" email, you seem to get Google's top 10 email exchangers overall. You can even drill down by region.
It seems very poorly written to me and more likely to confuse the lay audience it appears to be aimed at. If you read it carefully, you can see where it neatly checks off the things a technical person might complain about but the overall impression it gives is that encryption is something like forest fires or vaccinations, requiring a universal effort. The actual privacy implications are not really explained.