email privacy

[stas]

The federal government will continue to access Americans’ emails without a warrant, after the U.S. Senate dropped a key amendment to legislation now headed to the White House for approval. Currently, the government can collect emails and other cloud data without a warrant as long as the content has been stored on a third-party server for 180 days or more. Federal agents need only demonstrate that they have “reasonable grounds to believe” the information would be useful in an investigation.

Печальная картина. А виноват, конечно, как всегда, Буш.

Comments

[glocka.livejournal.com]

Все гораздо печальнее: ни одного из родни не уговорить шифровать почту. Аргумент, что конверты вот когда-то заклеивали, не действует.

[yankel.livejournal.com]

Для 99% шифровка почты - слишком сложно для понимания.
Если бы все это шло автоматически встроенным в системы....

[glocka.livejournal.com]

"автоматически встроенное" не годится из-за "автоматически встроенных" back doors. Странно, что это "автоматически встроенное" не рекламируют по всем каналам...

[stas]

Потому что, опять же, слишком сложно.

[yankel.livejournal.com]

У меня большие сумления, что back doors будут вставлять. Найдут-с

[eta-ta.livejournal.com]

а как это делается?

[glocka.livejournal.com]

Зачем искать? Никто не скрывает:

But I thought the data was always encrypted

When one Hushmail user sends an email to another Hushmail user, the body and attachments of that email are kept on our server in encrypted form, and under normal circumstances, we would have no access to that data. We can’t just pick an arbitrary encrypted email message off the server and read it. However, since Hushmail is a web-based service, the software that performs the encryption either resides on or is delivered by our servers. That means that there is no guarantee that we will not be compelled, under an order enforceable under the laws of British Columbia, Canada, to treat a user named in an order differently, and compromise that user’s privacy. (https://www.hushmail.com/about/technology/security/)

[glocka.livejournal.com]

Overview is here (http://en.wikipedia.org/wiki/Pretty_Good_Privacy)

Theoretically, one would need to download and verify source code, then compile it.
Practically, one downloads signed setup file, and verifies digital signature.

[eta-ta.livejournal.com]

and how the recipient can read it? doesn't he need to de-encrypt it , so to speak?
in any case, they are right: it sounds too complicated for a layman (me, f.i.)

[glocka.livejournal.com]

Аfter initial setup encryption/decryption happens on the fly, no effort needed. But yes, software has to be installed on computers of all participants.
Less convenient way but requiring no special software is to send encrypted attachments, say zip or Word documents. In anticipation, some free email providers already prohibit this.