How to Require TLS for Outbound SMTP Connections with MDaemon
-
@BRRABill said in How to Require TLS for Outbound SMTP Connections with MDaemon:
Are you saying you trust e-mailing something more than using a web service such as ShareFile or even ODfB?
I can't state this enough.... yes. I trust email the most for getting sensitive data from one organization to another. (Within reason, encrypted drives, carried by armed military carriers on submarines, notwithstanding.)
-
So if you had something personal you wanted to send...Not business related, just personal but highly sensitive...
You'd be OK just e-mailing?
-
@BRRABill said in How to Require TLS for Outbound SMTP Connections with MDaemon:
I am NOT talking about my business responsibility. I'm talking about keeping my sensitive info out of the hands of people who should not have it.
Well stop. As an IT person you should never think that way. That's going to lead you down some terrible roads. If your goal is to have a super private conversation on a personal level that the government can't see, use Telegram with all the security cranked up. If we are talking IT in legal businesses, stick to email.
-
@BRRABill said in How to Require TLS for Outbound SMTP Connections with MDaemon:
So if you had something personal you wanted to send...Not business related, just personal but highly sensitive...
You'd be OK just e-mailing?
Personally, yes. Because I don't deal in drugs, state secrets or anything that I need to bother hiding from the government I would absolutely email anything that I am okay having be caught by legal discovery warrants.
-
Well, I can't say I agree with you, but I understand your side.
Be curious to hear what others have to say. Though I seem to recall much of this same sort of discussion in @Dashrender's thread.
-
@BRRABill said in How to Require TLS for Outbound SMTP Connections with MDaemon:
I agree with you that for HIPAA purposes, say, sending an e-mail over TLS, once the connection is made and the e-mail delivered, you are free of concern. That is unless you sent it to the wrong person by mistake. Oooops. Though you could say if I inadvertently sent the ShareFile login to the wrong person, the same thing would happen. But really, what are the risk numbers for both of those things happening?
Risks are about the same - the risk of sending to wrong people is always there. With email, though, I suspect you could more easily automate some kinds of checks around that. In reality, that risk is decently high and people do it constantly regardless of the technology involved.
-
@BRRABill said in How to Require TLS for Outbound SMTP Connections with MDaemon:
Well, I can't say I agree with you, but I understand your side.
Be curious to hear what others have to say. Though I seem to recall much of this same sort of discussion in @Dashrender's thread.
The bigger question is really - what actual concerns do you have? What risk do you think you are trying to avoid?
-
@scottalanmiller said in How to Require TLS for Outbound SMTP Connections with MDaemon:
@BRRABill said in How to Require TLS for Outbound SMTP Connections with MDaemon:
But what if I don't trust the person at the other end?
So what? There is no reason to care. Trust them, don't trust them. Doesn't matter. That's why encrypted email is important.
And that right there makes me question the use of encrypted email.
Turning on TLS only outbound messaging does not in anyway encrypt the email itself. It only creates an encrypted tunnel through which email flows to another email server.
Therefore the email would be completely visible to anyone on the receiving side's email server.
-
@scottalanmiller said in How to Require TLS for Outbound SMTP Connections with MDaemon:
@BRRABill said in How to Require TLS for Outbound SMTP Connections with MDaemon:
So if you had something personal you wanted to send...Not business related, just personal but highly sensitive...
You'd be OK just e-mailing?
Personally, yes. Because I don't deal in drugs, state secrets or anything that I need to bother hiding from the government I would absolutely email anything that I am okay having be caught by legal discovery warrants.
He's not even worried about that - he's worried about his nuke selfies getting in the hands of hackers when they hack O365 because he emailed his nude selfies to his wife.
And if you are really worried about that - then you MUST use something like GPG. But things that are less sensitive and just go between two email server using TLS.
-
@scottalanmiller said in How to Require TLS for Outbound SMTP Connections with MDaemon:
@BRRABill said in How to Require TLS for Outbound SMTP Connections with MDaemon:
Well, I can't say I agree with you, but I understand your side.
Be curious to hear what others have to say. Though I seem to recall much of this same sort of discussion in @Dashrender's thread.
The bigger question is really - what actual concerns do you have? What risk do you think you are trying to avoid?
@Dashrender said in How to Require TLS for Outbound SMTP Connections with MDaemon:
@scottalanmiller said in How to Require TLS for Outbound SMTP Connections with MDaemon:
@BRRABill said in How to Require TLS for Outbound SMTP Connections with MDaemon:
So if you had something personal you wanted to send...Not business related, just personal but highly sensitive...
You'd be OK just e-mailing?
Personally, yes. Because I don't deal in drugs, state secrets or anything that I need to bother hiding from the government I would absolutely email anything that I am okay having be caught by legal discovery warrants.
He's not even worried about that - he's worried about his nuke selfies getting in the hands of hackers when they hack O365 because he emailed his nude selfies to his wife.
And if you are really worried about that - then you MUST use something like GPG. But things that are less sensitive and just go between two email server using TLS.
-
@Dashrender said
Therefore the email would be completely visible to anyone on the receiving side's email server.
I believe @scottalanmiller will say that doesn't matter and you shouldn't think about it.
-
@BRRABill said in How to Require TLS for Outbound SMTP Connections with MDaemon:
@Dashrender said
Therefore the email would be completely visible to anyone on the receiving side's email server.
I believe @scottalanmiller will say that doesn't matter and you shouldn't think about it.
In a business setting he is correct. You have a BAA with the company. It's that company's responsibility to ensure their internal staff is doing the right thing, not yours. You're only responsibiliy in HIPAA here is to not transit the data over a public connection unencrypted.
-
@Dashrender said
In a business setting he is correct. You have a BAA with the company. It's that company's responsibility to ensure their internal staff is doing the right thing, not yours. You're only responsibiliy in HIPAA here is to not transit the data over a public connection unencrypted.
I agree with this now.
Still ain't sending my nudie pics. (HYPOTHETICAL. NO ONE WOULD WANT TO SEE THEM TRUST ME.)
-
@Dashrender said in How to Require TLS for Outbound SMTP Connections with MDaemon:
@scottalanmiller said in How to Require TLS for Outbound SMTP Connections with MDaemon:
@BRRABill said in How to Require TLS for Outbound SMTP Connections with MDaemon:
But what if I don't trust the person at the other end?
So what? There is no reason to care. Trust them, don't trust them. Doesn't matter. That's why encrypted email is important.
And that right there makes me question the use of encrypted email.
Turning on TLS only outbound messaging does not in anyway encrypt the email itself. It only creates an encrypted tunnel through which email flows to another email server.
Therefore the email would be completely visible to anyone on the receiving side's email server.
That's partially true. The email is encrypted in transit, so the email IS encrypted when it matters most. That it is decrypted at the other end is likely, but it might be immediately encrypted there as well. Encryption doesn't mean that someone else can't read it, just that only certain people can. That the email is visible to anyone is not realistically true. And the encryption of something like SendFile is exactly the same - it's only encrypted in transit. It's open once received on the other end. Anyone with access to the receiving computer can see it, or anyone with control of the keyed proxy chain. So you are back to the law being your protection in any business setting.
-
@BRRABill said in How to Require TLS for Outbound SMTP Connections with MDaemon:
@Dashrender said
Therefore the email would be completely visible to anyone on the receiving side's email server.
I believe @scottalanmiller will say that doesn't matter and you shouldn't think about it.
That's correct. Unless you are doing something criminal, why do you care?
-
@Dashrender said in How to Require TLS for Outbound SMTP Connections with MDaemon:
He's not even worried about that - he's worried about his nuke selfies getting in the hands of hackers when they hack O365 because he emailed his nude selfies to his wife.
Which they will get if you used SendFile or email, because they will be saved to someone's desktop in either case.
-
@scottalanmiller said in How to Require TLS for Outbound SMTP Connections with MDaemon:
@Dashrender said in How to Require TLS for Outbound SMTP Connections with MDaemon:
He's not even worried about that - he's worried about his nuke selfies getting in the hands of hackers when they hack O365 because he emailed his nude selfies to his wife.
Which they will get if you used SendFile or email, because they will be saved to someone's desktop in either case.
SendFile would be web-based. Your favorite!
-
@scottalanmiller said in How to Require TLS for Outbound SMTP Connections with MDaemon:
@Dashrender said in How to Require TLS for Outbound SMTP Connections with MDaemon:
He's not even worried about that - he's worried about his nuke selfies getting in the hands of hackers when they hack O365 because he emailed his nude selfies to his wife.
Which they will get if you used SendFile or email, because they will be saved to someone's desktop in either case.
LOL exactly!
Just like the nudes in Apple's iCloud. all those celebs. The transmission from the phone to iCloud was secure via TLS, but hacking (OK really password guessing) allowed hackers to gain access to their account where the photos were stored unencrypted (or even if they were encrypted, they were decrypted by the same apple ID and password) and bam hackers have your nudes.
-
Let's lay out the risks here:
Email: File gets to the receiving organization safely. But once there, we are concerned that the organization may save it unencrypted to a file server (Exchange is a file server too, just a niche one) where "anyone" can access it. A hacker getting access can read it.
Super Cool Expensive Non-Email File Sending Service: File gets sent to the recipient at the organization who decrypts the file and saves it to their desktop and/or to the mapped drive on the central file server. Where, in the end, it is more likely to be exposed to hackers, other employees not restricted by the bounds of IT rules, etc.
Honestly, of the two, they are about equal in getting the email to the recipient. Of the two, I'd argue that both have the same final risk type of you not being able to control how data is stored. But the email type has the highest chance of being maintained in a more secure server rather than forcing an end user to store it somewhere random.
Bottom line, this is an illusion of control panic response. Once you send a file, it is out of your control. If you are talking about a spy sending to another spy where both really, really trust each other and each one goes through training and they both understand the risks and processes, there is something to be said for that. For any normal person, including personal friends... you need to understand that you are not in control of data that you send and you can't magically get that control by paying for some silly web site that runs a nice marketing campaign to make you feel safe.
-
@BRRABill said in How to Require TLS for Outbound SMTP Connections with MDaemon:
@Dashrender said
In a business setting he is correct. You have a BAA with the company. It's that company's responsibility to ensure their internal staff is doing the right thing, not yours. You're only responsibiliy in HIPAA here is to not transit the data over a public connection unencrypted.
I agree with this now.
Still ain't sending my nudie pics. (HYPOTHETICAL. NO ONE WOULD WANT TO SEE THEM TRUST ME.)
The believe that anything short of fully encrypting the files (a la GPG) will prevent your pictures from being hacked is crazy.. it's like thinking snap chat will prevent your nudes from getting out there. Someone can screen capture the screen, or take a picture with another camera... bam again your picture are out there!
