Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Sorry if this is a stupid question, I'm curious what the difference between the two is if any. Is there any point in running SSL and encryption for email? Or, is one method of security good enough?

share|improve this question
add comment

5 Answers

up vote 11 down vote accepted

Using SSL lets the users talk to the mail server securely, so they don't, for example, compromise their password.

Encrypted email allows the message to be safe from prying eyes as it transits various mail servers on the way to its destination. It also makes it so that the owner of the recipient's mail server can't read the message.

So yes, both server their purposes.

share|improve this answer
    
Thanks, that makes much better sense to me. –  gnucom Sep 19 '10 at 7:22
    
Also, encryption signs the message so the recipient knows it came from the person who sent the message (if they trust the signature), whereas SSL only enables trust between the user and the mail server. –  dunxd Sep 22 '10 at 12:30
    
lets be clear about the limits of this tech. even if you employ PKI to encrypt a message between two parties, the recipient eventually has plaintext in their possession (or else how could they read it). there is still a trust relationship here. –  brad clawsie Dec 3 '10 at 23:06
add comment

SSL protects the message and the protocols (e.g. the password used for auth) on the wire. SSL also protects against spoofing. I.e. makes sure that when you hink you are connected to mail.somedomain.com, you really are conected to mail.somedmomain.com. Encryption protects the message (but not the protocol) on the wire, as well as protecting the message on storage. E.g. in your mail box so someone with acess to your server or desktop can't read it without the key.

So they are complementary technologies, IMO

share|improve this answer
    
ssl does NOT protect the content of the message "on the wire". once the mail goes to another relay toward its destination on the WAN, it goes as plain text. ssl protects your LOCAL connection to the mail server only. –  brad clawsie Dec 3 '10 at 23:04
    
That's true. My badly worded response. SSL does protect the wire between the client and the local SMTP server, but it does not protect the contents of the message accross the entire internet. I.e. SSL won't protect between your local smtp server and the MX of the remote domain. Still it's worth doing as you can't really trust your local network. –  Jason Tan Dec 9 '10 at 13:25
add comment

In addition to the points already covered, there are also different usability aspects that may be possible considerations too.

SSL at the transport porotcol is mostly user transparent, so there is typically less administrative burden as the configuration is typically at the server(s).

Email encryption requires the configuration of the email clients, so it can run into compatibility issues when different email clients are in use across the end-points. It may also be inhibitive when it comes to different webmail systems in use as a majority of webmail systems have no support for email encryption.

share|improve this answer
add comment

if your mail is being sent to users on other domains, then your mail is going out on the internet unencrypted. there is no concept of a global default standard encryption scheme for mail. you may be able to encrypt the connection to your local relay, but you can't make assumptions past that.

and remember, even if you and your friends are all fully-PKI aware, mail always ends up somewhere unencrypted if someone is going to read it, and that plaintext can go wherever someone wants. secrets and email don't mix.

share|improve this answer
add comment

Essentially Jedberg is correct. If everybody is on the same server and using SSL to connect then the only people who can read your emails are the intended recipients and people with admin access to the mail server (whether gained correctly or not).

Encrypting the emails on the client removes having to trust the mail servers, but generally it leaves subject lines unencrypted and mail servers can still see who you are emailing - just not the contents of those emails. Plus you need to be careful to ensure you are encrypting attachments.

At the minimum you should really be implementing SSL on mail servers as standard, with encryption of the email contents available for people who want it. If it's corporate policy to encrypt everything then you should be helping people use encryption.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.