Timeline for New Employer Asking for Sensitive Documents Over Email
Current License: CC BY-SA 4.0
11 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Feb 9 at 12:23 | comment | added | Gray Sheep |
@Donald I would suggest to use a tcpdump in a 5min setup outgoing mail container sending a test mail to the google, and see what are they communicating. I say you the essence: STARTTLS <blah-blah> <various cipher offers> <undecipherable byte stream>. Yes, I know the big corporate ......uhmm...... say, socially well integrated lesser skilled guys, in their white collars, yes they are proposing GPG and other encryptions for the company mails every second day, and yes I can not say them in a corporate environment, where to go. But I can do that, here, to you...
|
|
| Feb 9 at 12:21 | comment | added | Donald | @GraySheep - Ok; I can see we won’t agree. | |
| Feb 9 at 12:20 | comment | added | Gray Sheep | @Donald Yes, it is transferred over an encrypted channel, if the remote side supports it, which is practically sure today. Thus, contrary your statement, that actually transferred data is encrypted. | |
| Feb 9 at 12:19 | comment | added | Donald | @AidaPaul - No, I am not confused. The contents of an email sent over SMTP isn’t encrypted. Authentication might be encrypted. Unless the recipient has your public key used to decrypt the email that was encrypted with a private key. I definitely wouldn’t send my SSN to anyone. Guarantee that they are not asking for this information in a secure way otherwise they wouldn’t be asking for it. | |
| Feb 9 at 12:16 | comment | added | Donald | @GraySheep - email sent by gmail isn’t encrypted. The only way i would send the single piece of information that could never be changed is if the email was encrypted. | |
| Feb 9 at 12:06 | comment | added | Gray Sheep | @Donald That is right, but today practically all mail provider, incl. the big cloud ones, are using some form of SMTP encryption (SSL or TLS). Beside that, spam/virus filters consider with high paranoia any not encrypted communication. It is similar to http, in theory your browser can visit http pages and you can develop http pages, but there are more trouble with it as configuring the https certificates once. Beside that, to eavesdrop unencrypted communication, an attacker would need access to the middle point of the communcating sides, i.e. access to some router or ISP, that is unrealistic. | |
| Feb 9 at 12:02 | comment | added | Aida Paul | @Donald you are confusing client side cryptography with server side. | |
| Feb 9 at 11:33 | comment | added | Donald | @GraySheep - SMTP isn’t encrypted. Unless they are using certificate based encryption, which is impossible, if the author doesn’t have their public key, the email will in fact essentially be in plaintext | |
| Feb 9 at 9:14 | comment | added | Gray Sheep | @BartvanIngenSchenau Everybody is using SMTP with strong cryptography today. I see no real reason of such a leak. Also practically impossible to get into the traffic between the mailservers to eavesdrop or mitm. I think, the most likely way to such a document leak is the compromised laptops of the HR guys or bosses. | |
| Feb 9 at 9:05 | comment | added | Bart van Ingen Schenau | While the mailbox might be considered trusted, the path between two mailboxes, especially from unrelated organizations, is not secure/trusted. | |
| Feb 9 at 8:54 | history | answered | Gray Sheep | CC BY-SA 4.0 |