Even though email has been around for decades, the underlying transport technology used to send it, SMTP, is still surprisingly ancient. The majority of email is sent in plain text, unencrypted around the internet using SMTP – yet we still rely heavily on it for some of our most private conversations.
SMTP STARTTLS was invented to fix that many years ago, but it failed to be widely adopted and was full of flaws, like ultimately failing to ensure messages are truly encrypted.
Currently, with that technology, it’s easy to man-in-the-middle an email before it’s sent and tell the sender that there’s no SSL enabled so the client will send it unencrypted without warning.
The new proposal, which was submitted to the Internet Engineering Task Force on Friday, was worked on by engineers from Google, Yahoo, Comcast, Microsoft, LinkedIn and 1&1 Mail & Media Development.
It proposes protecting against attacker who want to intercept or modify email in transit by either impersonating the destination server or breaking SSL through various existing attacks.
The idea is that when an email is sent to a domain that supports SMTP STS the sender will automatically check if the destination supports encryption and if their certificate is valid before sending, to ensure you’re talking to the right server.
If invalid, the email should fail to deliver and tell the user why. The proposalcontains a wealth of technical detail on how this should work in practice.
Ultimately, if this proposal succeeds it will finally ensure that email communication is properly secured by enforcing rules that have long existed on the Web, but not your inbox.
TLS encryption is already widely supported according to Google, with more than 70 percent of Gmail’s inbound messages received over SSL, but various issues can mean email falls back to plain-text without the user knowing.
Since the standard is only a proposal right now it’s got a way to go before it becomes reality, but with the backing of some of the world’s largest tech companies it’s likely to succeed.
(TheNextWeb)
