The much maligned Google GMail service, while not even released to the general public has come under intense scrutiny. What appears to be lost in this whole debate is recognition of the fact that every single e-mail that we send and receive (there are always caveats here so bear with me) must traverse a series of points and pass through many different scans along its journey.
First, you have the outgoing (or senders) mail server. These days the most common type of outgoing mail server is SMTP (or SENDMAIL). While sendmail has received much work over the years to tighten it up, it is inherently insecure (hence one reason for the proliferation of spam). In a perfect world, your e-mail goes directly from the SMTP server to the receivers mail relay and POP3 server. We know that there are lots of routers and switches along the way, all owned and operated by different carriers and ISPs.
Once it gets to the recipients ISP, depending on the ISP's scanning protocols your message will likely traverse a number of relays which scan for viruses, spam, etc… before reaching the POP3 server where it waits patiently for you to retrieve it. As we know, e-mail is most often retrieved in two ways, through a web based client (such as Hotmail, Yahoo Mail or GMail, although Google says they will offer some other sort of retrieval mechanism, likely POP3) or a thick client (such as MS Outlook, Outlook Express, or PINE for you *nix geeks out there).
Now here's the catch for those of you who may have missed it. At each and every one of these points, your e-mail must pass through a system (normally unencrypted unless you encrypt it) that you do not have control over. In the case of GMail, Google or someone that they contract out to will own them. In the case of Yahoo Mail, Yahoo's servers, regardless, you don't own or have control over these servers or their security. So what do you do? Without even realizing it, you have placed your faith in the operator (Yahoo or Google) that they will be trustworthy and not actually snoop your e-mail. Is this a fair trade for free e-mail? Thats up to you to decide. I say that it's arguable depending on what level of paranoia you are comfortable living with, but I digress.
What bothers me the most, is that it's only when someone steps up and says, this is what I'm giving you, and this is what I'm getting from you, that people start standing up and yelling PRIVACY CONCERNS PRIVACY CONCERNS. As I have laid out for you, the possibilities are there everyday if you care to educate yourself about them and consider their implications. I'm not telling you that you should or should not place your trust in Yahoo or Google or MSN or whomever. What I am telling you is that before we start stirring up the pot and calling the cavalry, we need to open our eyes and be fully informed.
The bottom line is that we all have to recognize the implicit trust that we place in the system as it currently exists. Any one of the points along the way represents a potential weak link in the chain and opens the possibility for "inspection" for "other" purposes. Look at what the FBI and CIA would like to do (and in some cases are doing). So, if you want your e-mail to be truly secure (except from the FEDs…come on…you don't really think they can't crack that stuff do ya?), use encryption, otherwise stop complaining because you're getting something for nothing and nothing ever comes without a price.
Looking forward to a spirited debate.
1. I've been waiting for someone to come out with this argument.
I think people need a better understanding of how a computer operates before they shoot their mouths off, drafting legislation, etc.
Posted at 4:49AM on Dec 19th 2005 by Beredon