4

Sorry if this is a stupid question, I'm curious what the difference between the two is if any. Is there any point in running SSL and encryption for email? Or, is one method of security good enough?

5 Answers 5

11

Using SSL lets the users talk to the mail server securely, so they don't, for example, compromise their password.

Encrypted email allows the message to be safe from prying eyes as it transits various mail servers on the way to its destination. It also makes it so that the owner of the recipient's mail server can't read the message.

So yes, both server their purposes.

2
  • Also, encryption signs the message so the recipient knows it came from the person who sent the message (if they trust the signature), whereas SSL only enables trust between the user and the mail server.
    – dunxd
    Sep 22, 2010 at 12:30
  • lets be clear about the limits of this tech. even if you employ PKI to encrypt a message between two parties, the recipient eventually has plaintext in their possession (or else how could they read it). there is still a trust relationship here. Dec 3, 2010 at 23:06
4

SSL protects the message and the protocols (e.g. the password used for auth) on the wire. SSL also protects against spoofing. I.e. makes sure that when you hink you are connected to mail.somedomain.com, you really are conected to mail.somedmomain.com. Encryption protects the message (but not the protocol) on the wire, as well as protecting the message on storage. E.g. in your mail box so someone with acess to your server or desktop can't read it without the key.

So they are complementary technologies, IMO

2
  • ssl does NOT protect the content of the message "on the wire". once the mail goes to another relay toward its destination on the WAN, it goes as plain text. ssl protects your LOCAL connection to the mail server only. Dec 3, 2010 at 23:04
  • That's true. My badly worded response. SSL does protect the wire between the client and the local SMTP server, but it does not protect the contents of the message accross the entire internet. I.e. SSL won't protect between your local smtp server and the MX of the remote domain. Still it's worth doing as you can't really trust your local network.
    – Jason Tan
    Dec 9, 2010 at 13:25
2

In addition to the points already covered, there are also different usability aspects that may be possible considerations too.

SSL at the transport porotcol is mostly user transparent, so there is typically less administrative burden as the configuration is typically at the server(s).

Email encryption requires the configuration of the email clients, so it can run into compatibility issues when different email clients are in use across the end-points. It may also be inhibitive when it comes to different webmail systems in use as a majority of webmail systems have no support for email encryption.

1

if your mail is being sent to users on other domains, then your mail is going out on the internet unencrypted. there is no concept of a global default standard encryption scheme for mail. you may be able to encrypt the connection to your local relay, but you can't make assumptions past that.

and remember, even if you and your friends are all fully-PKI aware, mail always ends up somewhere unencrypted if someone is going to read it, and that plaintext can go wherever someone wants. secrets and email don't mix.

0

Essentially Jedberg is correct. If everybody is on the same server and using SSL to connect then the only people who can read your emails are the intended recipients and people with admin access to the mail server (whether gained correctly or not).

Encrypting the emails on the client removes having to trust the mail servers, but generally it leaves subject lines unencrypted and mail servers can still see who you are emailing - just not the contents of those emails. Plus you need to be careful to ensure you are encrypting attachments.

At the minimum you should really be implementing SSL on mail servers as standard, with encryption of the email contents available for people who want it. If it's corporate policy to encrypt everything then you should be helping people use encryption.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .