Comment

Comment by agwa

This is a bad move that will give users a false sense of security. Server-to-server SMTP is unauthenticated. Just because an email arrived at Gmail over an encrypted connection doesn't mean that the connection wasn't intercepted by a MitM that read the message and then relayed it to Gmail over an encrypted connection.

Opportunistic encryption is nice to have because it stymies passive surveillance, but it's not something that can be relied upon to provide security or privacy. Thus, its presence or absence should never be communicated to users, to avoid suckering them into a false sense of security.

parent agwa 11 years ago

Discussion

Live from the official Hacker News API

A modern reader for Hacker News · SvelteKit + Skeleton