ISP GMX attempts the nigh impossible: PGP for the masses Internet service provide GMX claims to have overcome the notorious usability problems of PGP with the launch of a new email service that offers end-to-end encryption. The new email security works across all devices and platforms: including laptops, tablets, smartphones and web browsers, according to GMX, which says that the …
...the recent change, last month or so, when they moved their email operation from the US back to Germany (where GMX originally started).
This would stop them from getting hit with a subpoena a la Hushmail, as there is no remotely legal way you can pull that off in Germany.
I've been a GMX user for close to 20 years now and I've been entirely satisfied with them all along the way thus far.
I'm genuinely happy for you if you are. Just let me mention as an anecdotal data point that after years of use, they simply locked me out of my account then when I inquired as to why, using a different account from a different provider, they only replied "yep, it was not an error, the decision was justified". Failing again to offer any clue regarding the reason. And I'd like to note I've never, ever, ever did anything sketchy with that or any other mail account I ever had - to this day it's a complete mystery for me what they were smoking when they did that. So I sincerely hope you have a local copy of your mail and never, ever end up needing to rely on their fucked-up idea of customer support. Oh, and by the way - fuck those uncle-molesting fuckers with a @%$^## &U%^ @#$# &U*&* @#$#$ *)(#$ #$%^^& @$ #$% ^&...!!!
> Just let me mention as an anecdotal data point that after years of use, they simply locked me out of my account
Were you using a gmx.net, gmx.de, or gmx.at account without having German or Austrian residence? I don't know if that's still the case, but those are subject to different conditions than other addresses, and in that case you would not have had a leg to stand on.
In any event, if there were no ongoing legal proceedings or blatant abuse on your part, they should at least have allowed access to your account to retrieve your emails, as I recall from their T&Cs. Failing that you could have sent them a (paper) letter or requested assistance from the relevant consumer organisation.
I agree with always backing up your emails. Personally I have three online (as in, real time) copies, and two off-line ones. Redundancy is key with anything computer related.
Not sure. Seems like crypto is illegal now...
Cops charge Cardiff man with “training, researching” how to use crypto software
Christ alive!
He has additionally been charged with being in possession of a "Universal Serial Bus (USB) cufflink that had an operating system loaded on to it for a purpose connected with the commission, preparation, or instigation of terrorism."
WTF?
They have made possessing an operating system (shock! horror!) on a USB stick (more shock! more horror!) a "terrorist" offence too???? What the hell OS was it? Windows 10?
I suddenly feel compelled to burn anything that might ever have had Qubes, Tails, Whonix, BSD or Linux on it before I get "rendered"
The police state's gone completely stark-staring 100% certifiably MAD. Didn't take long, did it? :(
Well that should have been a red flag right away. If he'd called himself Da'i Ullah he might of got away with it. I guess 'Land of my Fathers' should now be re-titled "Land of my 'alaba" :)
@ Dan 55: 'Cops charge Cardiff man with “training, researching” how to use crypto software' ref.
...you're never going to go mainstream. Encryption is too difficult for the average user to understand, so "going it alone" is not an option. By your standards, if the only way to do it right is too hard for the average person, no wonder encrypted e-mail never takes off. You're basically saying it's a bridge too far. And that's bad for ALL of us.
Besides, what's to say the program you use to create your own keys isn't backdoored in some clever way or is already broken by the TLAs without your knowledge. And you can't code encryption from scratch because doing it right is HARD. Meaning you can't trust YOURSELF to do it, nor can you trust ANYONE ELSE to do it, either. Logically, that means you can't trust ANYONE to do it right. IOW, we're screwed.
"...you're never going to go mainstream."
Even if you have it working turnkey that won't be enough to go mainstream because it's still an add-on. Few people know anyone who uses encrypted email because the people they know don't know anybody who uses encrypted email because...so it's not worth using encrypted email. It needs to be incorporated in email standards as the default mode of operation. As it also makes provision for signing it should have a major part to play in preventing phishing and other email scams.
But then the keys get STOLEN. I recall Realtek's driver signing key (a private key) got stolen and used to make signed malware that couldn't be revoked easily (because so many PCs use Realtek chips on their motherboards for audio).
OK, it's a fair cop, I'll put my hands up to it !
About twenty years ago I had a copy of 'The Anarchist's Cookbook' on a hard drive - briefly - and right at this moment I think I have two memory sticks with different versions of Linux on them on my desk at the moment..
Chris Cosgrove
What if public keys were put in email headers and once you had someone's public key you could send them encrypted email? Otherwise it goes out plain-text.
You still have the problem of email systems without plugins - web-based for example.
What if you also automatically web-hosted all your *sent* email and included an https URL with your correspondent's public key automatically added to your web-server and associated with their identity? With any web client in which they have installed their certificate, they can read the mail you sent them. Maybe after the certificate exchange there could be an automated password exchange so that your mail server can accept passwords for those using non-certificate-capable platforms. You might want that for friends, but disable all encryption for non-sensitive commercial email, circulars etc. Identity management is, er, key.
Since you hold the data, if they lose their key that isn't too bad and there is no reason why a mail client can't decrypt email and store the plain-text if you want. They can generate a new key-pair and send you the new public key. Your mail client can do a three-way handshake to confirm the identity isn't just spam and flag you to check with the person manually that they haven't had their account compromised.
Key distribution, multi-application key management and graceful fallback is the key to success.
The problem is you're supposed to already have the public key, not the message, because you don't know if you can trust the message. You may also want to send a message to them first, but you can't encrypt it because you don't know their public key.
Maybe putting the public key in a header is okay, if they all match from that sender then the mail client can assume it's safe to go ahead. Something like SSH's first connection certificate - it makes things easier and it's probably okay to use.
It's pretty simple to install, or just run, JavaScript malware in the browser. So it shouldn't be too hard to spoof the user into entering the plaintext to the malware. Afterwards, the malware could run the GMX code to send the message as intended.
The browser itself is a security hole.
With that attitude and a Don't Trust Anyone world, ANYTHING could be a security hole, even the CPU used to run your OS and everything on top of it. IOW, you're basically saying NOTHING is safe. At which point, you're left with a choice. Do you take the chance or abandon everything and go live in the mountains somewhere?
The Register 
Biting the hand that feeds IT
Copyright. All rights reserved © 1998–2024
