🚀 go-pugleaf

####



Article 1720 of pa.general:
Path: usenet.ins.cwru.edu!news.ysu.edu!hudson.lm.com!godot.cc.duq.edu!newsfeed.pitt.edu!ddj
From: ddj+@pitt.edu (Doug DeJulio)
>Newsgroups: pa.general
Subject: Re: Are there e-mail spies lurking along the e-mail route?
Date: 3 Apr 1995 00:14:12 GMT
Organization: University of Pittsburgh
Lines: 58
Message-ID: <3lnekk$t3f@usenet.srv.cis.pitt.edu>
References: <3ln3bv$ksf@usenet.INS.CWRU.Edu>
NNTP-Posting-Host: unixs2.cis.pitt.edu

In article <3ln3bv$ksf@usenet.INS.CWRU.Edu>,
Don Reynolds <fn979@cleveland.Freenet.Edu> wrote:
>Many users suggested that "E-mail is not secure!"

It's true.

>Some have suggested using "P.G.P" encryption.

If you want security, this would be a good idea.

>My question? How many root operator's handle our secret
>e-mail? Like from New York to L.A.?

The answer depends on a lot of variables, and on what you mean when
you ask the question.

If the e-mail just goes in one port on the computer and out the other,
without ever being stored on a disk, would you consider the root
operator of that computer to be "handling" your secret email?

If your answer is yes, then do a "traceroute" to the machine you're
sending mail to.  Every machine listed in that list gets to touch your
email for a few seconds.  It's usually over a dozen if the mail is
going a long distance.

Now, if you're asking only about machines that actually store the
email for at least a few seconds, the number drops by a lot.  If
you're sending mail *from* one non-firewalled standalone Unix machine
*to* one non-firewalled standalone Unix machine, only the sender's and
recipients machines store the message on disk.

With some mail-sending software (eg. anything that talks directly to
SMTP ports instead of using local mail queues), even the local machine
doesn't put it on disk.  With some mail-receiving software (eg.
configure the system to pipe the mail to a fax-me-this-file command
the moment it's received), even the receiving machine doesn't put it
on disk.

If your local machine is not 100% standalone, mail may bounce between
a few machines before it gets out of your organization.  If your
connection to the internet is via UUCP, you may end up with your mail
sitting on as many machines as the "traceroute" example above.

If the remote machine is not 100% standalone, the same things hold for
it -- it may bounce around a few systems within that organization
before final delivery, and with UUCP it could take a really torturous
route before it finally gets delivered.

If you use PGP, none of the people "in between" sending and delivery
will be able to figure out what's actually *in* your mail, though they
will be able to figure out where it's from and where it's going.  Only
an operator on your machine or on the final destination machine would
have any chance of really snooping, unless the recipient was really
sloppy with his private key.
-- 
Doug DeJulio                    | R$+@$=W  <-- sendmail.cf file
mailto:ddj+@pitt.edu            | {$/{{.+  <-- modem noise
http://www.pitt.edu/~ddj/       | !@#!@@!  <-- Mr. Dithers swearing