Let's talk about privacy [telecom]

This morning, I transitioned to a new desktop computer - the first new machine I've had in several years. I started up the Thunderbird email program, and got ready to enter the long list of arcana that makes my little part of the Internet work: a tricky task for me, since my email address (bill at horne dot net) isn't hosted by my ISP, which is Speakeasy.

However, as Thunderbird started up, it suggested some email server names based on the email address I gave it, such as "snail.horne.net" and I clicked "Next" just to see what would happen. The machine hummed, contacted the IMAP server at horne dot net, and then started to download the first of 19,587 emails which dated back to September of 2008.

They were all mine. They were all valid. There was some spam, of course, but not that much, maybe 500 in all. It figures out to roughly 23 emails per day for the past 2 1/2 years.

Now, of course that's not interesting by itself: I had obviously checked the box that told the server to keep copies of emails, and (bless it's little electronic heart) it had done as I'd asked. What _is_ important is what I saw.

There were the usual appeals for funds from various charities, but there were also reminders to renew my membership in NORML. I had a fair percentage of posts to Usenet, on topics ranging from gun control, to abortion, to the need for Ham operators to stop crying about how the FCC doesn't require knowledge of Morse Code to become a Ham Radio operator any more.

There were desperate pleas for help in educating my son, who has Tourette Syndrome, sent to various public servants, school officials, media outlets, and "experts". There were follow-ups to various job applications, complaints to ISPs about spammers, and even an email answering a request that I participate in a study on depression.

All there, duplicated on my brand-new SATA disk drive, managed by a brand-new 64-bit multicore processor. All there, but most no longer applicable to me, no longer important to the people that wrote or received them.

My son made it to Eagle Scout rank, and is looking for a job as a plumber. He won't be a techie like me, but he'll be able to make a living and raise a family.

I got (but recently left) a job near to my home, and was able to rehone some old skills that had been rusty. I don't do much spam-fighting anymore, and although I sometimes use Morse Code on my Ham Radio station, I don't think its demise would spell the end of Amateur Radio.

In other words, that collection of electronic bits no longer represents

*me*. Looking at them now, I get the feeling that they never did, that there was always something else I probably wanted to say, some other point I should have made, another argument to be considered - but of course, those opinions come from an older, and hopefully wiser, man who has a couple more years under his belt.

And yet ...

They were out there, available for inspection by anyone at the ISP, any federal agent, and probably by any PI with a glib tongue. They're out there *now*. They don't reflect my views anymore, but I'm the only person who could know that, n'est ce pas? I wonder how many other emails are "out there", floating in the electronic cloud, just waiting for inspection by the next McCarthy, the previous Bush, or the current Department of Homeland Security.

I get the feeling I should be worried about that. Those emails aren't me anymore - to the extent they ever were - and they could be taken out of context and used to construct any view of my past or of my politics that anyone might want.

Oh, and OBTelecom: I was thinking about the persistence of data that my email archive indicates, and I realized that Ma Bell has, to this day, tapes stored at Iron Mountain (or wherever) with billing details of every phone call I ever made or received.

It's out there. Should we start wiping our slates clean?

Bill Horne (Filter QRM for direct replies)

Reply to
Bill Horne
Loading thread data ...

There's a reason I receive my personal email on my home mail server. It's a pity operating a mail server is so complicated an operation these days that most people aren't able to do that. (In an alternate reality that never happened, every home would come with a mail server, which could be accessed securely from anywhere, bringing one's mail spool squarely into the domain of the Fourth Amendment.)

What I haven't done, and should, is configure opportunistic encryption on the mail server -- as it stands, the bad cops will just tap my ISP.

-GAWollman

Reply to
Garrett Wollman

On Tue, 01 Feb 2011 05:07:07 +0000, Garrett Wollman wrote: .........

Whatever happened to the push to have everyone using PGP keys and having their e-mail encrypted?

That seemed to be pushing along quite nicely about a dozen years ago and once you get it sorted out it is quite easy to use with most e-mail clients these days.

It would certainly add in a massive increase in protection of any e-mail contents as it would still take anyone a *lot* of processing power to decode messages encrypted with the currently available methods.

-- Regards, David.

David Clayton Melbourne, Victoria, Australia. Knowledge is a measure of how many answers you have, intelligence is a measure of how many questions you have.

***** Moderator's Note *****

Yes, encryption - i.e., Public Key Infrastructure, or "PKI"-based encryption, was going well around Y2K. I was a Thawte Notary, and would certify applicants' ID's for personal email certificates.

It all sort of died, and I don't know why. Perhaps users were so leary of the "black magic" of PKI, or of disclosing their identity details to an unfamiliar company in order to use PKI, that they felt it was better to have an unsecure email (which they could deny sending), rather than a secure email (which a recipient could prove they had sent).

PKI will come back eventually, although it will almost certainly be via X.509 certificates managed through the existing commercial companies such as Verisign. I predict the public will trust bankers as "neutral third parties" to verify identities - after all, they already have all the information - and that the need to secure electronic commerce will be the driving force. The only question is when: either there will be a major meltdown of the electronic banking system, with attendent loses, or various governments will demand that all electronic communication be traceable to a person at its origin.

Bill Horne Moderator

Reply to
David Clayton

I used to be very paranoid about this. I downloaded all email to my computer, deleted the copies from the server, and even created encrypted backups.

I finally rationalized this fear away. Just because I'm doing this doesn't mean the friend I correspond with all the time is. Email is easily intercepted and for all I know there's a folder on an FBI hard drive with my name on it full of email. And lastly, while this logic makes privacy advocates cringe: I'm not doing anything wrong. I don't do anything online that I wouldn't want my wife, kids, or parents knowing about.

I live pretty openly in cyberspace. You can find all about me at

formatting link

Reply to
John Mayson

In the mid-90s I discovered PGP. I started using it. Wow. First problem was it was like playing volleyball by myself. When no one else uses it, it's sort of pointless. But secondly all it did was raise eyebrows. This was the era of the first WTC bombing, Waco, Ruby Ridge, and Oklahoma City. "Why is John suddenly so interested in encrypting his email?".

I dropped it, but started using GnuPG around the turn of the century, just in time for the next WTC disaster. And I had the same problem. No one play encryption with and it was just raising eyebrows.

The final nail in the coffin was when I switched to Gmail. I can use an email client and use GnuPG that way. And there are browser plug-ins that support it with webmail. But since few do it I figure why bother.

IMHO, all email should be signed and encrypted, but I'm sort of weird that way.

John

Reply to
John Mayson

PGP has always been much more popular than X.509-based systems (which isn't saying much).

Almost certainly not. People might use X.509 certificates, but they will be self-signed (from X.509's perspective) with the actual authentication taking place through the DNS. DNSsec is here today for many top-level domains, and will be universal soon; it solves most of the problems that X.509 creates, including the VeriSlime (near-)monopoly.

-GAWollman

Reply to
Garrett Wollman

I don't understand why.

After I completed my graduate studies at Hopkins (in my Network Security course, I wrote a paper about the use of PGP), I put together a PGP course for the CPCUG (Capital PC Users Group) in Washington, DC some years back. I was getting excellent ratings on it from my students. One of them wrote a blurb in the CPCUG Monitor about how easy it was to use PGP after completing my course.

The first turnout for it had engineering people, LAN people, mathematicians, and someone from Amnesty International.

The attendance at the subsequent seminars were much lower.

Finally, there was no more demand for it. So the course died a natural death although I've used the slides I developed for the course when I've done presentations on PGP.

It was disappointing.

Fred

***** Moderator's Note *****

I'm tempted to say that PGP/GPG is too difficult for non-techies to use, but X.509 PKI didn't fare any better, and _that_ capability is already built-in to every common email client.

We need a Psychologist: there must be some subtle problem with users' perceptions of encryption that scares them away from it. Perhaps users are scared of admitting that they don't understand their expensive computers as well as they like to think, or maybe they're reluctant to ask those at the other end of the link to educate themselves in order to decrypt the emails.

Come to think of it, I'm amazed that the U.S. Government didn't make digital signatures mandatory after 9/11: it would have made all emails traceable to at least some level of "identity" verification, and could have eliminated spam in the bargain. Of course, digital signatures use the same process as digital encryption, and maybe Uncle Sam was afraid of repeating the "Clipper chip" debacle.

Bill Horne Moderator

Reply to
fatkinson.remove-this

That's why:

  1. I always delete emails from my email server as soon as I download them.

  1. I would never get an email account through Google, Yahoo, or any other web search company. Google's Gmail admits that they scan emails for keywords so that they can target advertising; who knows what else they do with the info.

That's why I have my own domain (richbonnie.com) with it's own mail server, hosted by

formatting link
. I can have up to 2500 email addresses (my wife and I currently use about 25). I regularly make up throw-away addresses for special purposes, and then delete them when no longer needded.

As a side benefit, I can change my ISP without changing my email address and the hassle of telling everyone about the change. Yes, Gmail has that advantage also, but see #2 above.

Dick

Reply to
Richard

That's why:

  1. I always delete emails from my email server as soon as I download them.

  1. I would never get an email account through Google, Yahoo, or any other web search company. Google's Gmail admits that they scan emails for keywords so that they can target advertising; who knows what else they do with the info.

I have my own domain (richbonnie.com) with it's own mail server, hosted by

formatting link
. I can have up to 2500 email addresses (my wife and I currently use about 25). I regularly make up throw-away addresses for special purposes, and then delete them when no longer needded.

As a side benefit, I can change my ISP without changing my email address and the hassle of telling everyone about the change. Yes, Gmail has that advantage also, but see #2 above.

Dick

***** Moderator's Note *****

I had a Debian GNU/Linux server running for years, but I didn't keep on on security patches and it was owned, so I've had it off since then.

The point is that I used to have ~20 email addresses at any one time, but I found it to be too difficult to keep track of all of them, and which company I had used them for. To make matters worse, I was always turning them off two days before the company sent out something I _did_ want.

Bill Horne Moderator

Reply to
Richard

Cabling-Design.com Forums website is not affiliated with any of the manufacturers or service providers discussed here. All logos and trade names are the property of their respective owners.