> On May 25, 2017, at 5:23 AM, li...@lazygranch.com wrote:
>
> "Neither Snow Nor Rain Nor MITM . . .
> An Empirical Analysis of Email Delivery Security"
> https://jhalderm.com/pub/papers/mail-imc15.pdf
> Video by one of the authors.
> https://www.youtube.com/watch?v=_aogXeTbERs
It is a good academic study, but like many such efforts, it implicitly
compares SMTP with HTTPS, but the proper comparison is with the
combination of HTTP and HTTPS. Take a look at:
https://www.google.com/transparencyreport/saferemail/
By now ~85-88% email inbound to Gmail is TLS encrypted in transit. The
fraction of Web traffic that uses HTTPS is in recent reports only ~50%.
If we're talking SMTP security (and not end-to-end encryption which remains
deeply impractical for most use-cases), then implement DANE, but make sure
you understand the operational responsibilities, DANE is not deploy and
forget, key rotation must be handled correctly and consistently:
https://dane.sys4.de/common_mistakes
http://postfix.1071664.n5.nabble.com/WoSign-StartCom-CA-in-the-news-td86436.html#a86444
https://community.letsencrypt.org/t/new-certbot-client-and-csr-option/15766
https://www.internetsociety.org/deploy360/blog/2016/03/lets-encrypt-certificates-for-mail-servers-and-dane-part-2-of-2/
https://community.letsencrypt.org/t/please-avoid-3-0-1-and-3-0-2-dane-tlsa-records-with-le-certificates/7022
http://tools.ietf.org/html/rfc7671#section-8.1
http://tools.ietf.org/html/rfc7671#section-8.4
Ideally via robust hooks that automatically update the relevant DNS entries
(as required) as part of the key rotation process.
--
Viktor.
