<html><body><div style="color:#000; background-color:#fff; font-family:times new roman, new york, times, serif;font-size:14pt"><div class="" style="">(Note: I, Jim Bell, am cross posting this article from Yahoo, not because I believe it to be 'accurate' (I have no opinion on that), but because I believe that we need to not merely hear 'The Truth', but also 'The Story', specifically the story (stories) that the Internet-based news media is telling the public.)</div><div class="" style=""><br></div><div style="color: rgb(0, 0, 0); font-size: 19px; font-family: 'times new roman', 'new york', times, serif; font-style: normal; background-color: transparent;" class=""><br class="" style=""></div><div style="background-color: transparent;" class=""><a href="https://www.yahoo.com/tech/explained-how-tls-keeps-your-email-secure-88310223169.html" class=""
style="">https://www.yahoo.com/tech/explained-how-tls-keeps-your-email-secure-88310223169.html</a><br class="" style=""></div><div style="margin-top: 1.5em; margin-bottom: 1.5em; color: rgb(34, 34, 34); font-family: Arial, 'Helvetica Neue', Helvetica, sans-serif; font-size: 16px; line-height: 26px;" class=""><span class="" style="">From <a href="http://openmap.bbn.com/~tomlinso/ray/firstemailframe.html" data-ylk="elm:itm;elmt:link;t1:a2;t2:article;t3:body;t8:5a9fb8cb-7daa-39bd-b58c-e0ae6a674ff1;t9:18;itc:0;" target="_blank" data-rapid_p="22" style="text-decoration: none; color: rgb(148, 0, 80);" class="">its start in 1971</a>, Internet-based email has not been known for its high security. </span>As security researcher Bruce Schneier <a href="https://www.schneier.com/essay-365.html" data-ylk="elm:itm;elmt:link;t1:a2;t2:article;t3:body;t8:5a9fb8cb-7daa-39bd-b58c-e0ae6a674ff1;t9:18;itc:0;" target="_blank" data-rapid_p="23"
style="text-decoration: none; color: rgb(148, 0, 80);" class="">wrote in a 1995 essay for Macworld</a> on the privacy perils of email: “It’s like a postcard that anyone can read along the way.” </div><div style="margin-top: 1.5em; margin-bottom: 1.5em; color: rgb(34, 34, 34); font-family: Arial, 'Helvetica Neue', Helvetica, sans-serif; font-size: 16px; line-height: 26px;" class="">That unfortunate fact is finally fracturing. Email is getting safer for you — provided that your mail service and your correspondent’s both use a standard called “TLS,” short for <a href="http://www.ietf.org/rfc/rfc2246.txt" data-ylk="elm:itm;elmt:link;t1:a2;t2:article;t3:body;t8:5a9fb8cb-7daa-39bd-b58c-e0ae6a674ff1;t9:18;itc:0;" target="_blank" data-rapid_p="24" style="text-decoration: none; color: rgb(148, 0, 80);" class="">Transport Layer Security</a>. Finally, Google and other providers are starting to <a
href="https://gigaom.com/2014/06/04/comcast-says-its-beta-testing-email-encryption-after-google-calls-it-out/" data-ylk="elm:itm;elmt:link;t1:a2;t2:article;t3:body;t8:5a9fb8cb-7daa-39bd-b58c-e0ae6a674ff1;t9:18;itc:0;" target="_blank" data-rapid_p="25" style="text-decoration: none; color: rgb(148, 0, 80);" class="">turn on TLS for the public</a>.</div><div style="margin-top: 1.5em; margin-bottom: 1.5em; color: rgb(34, 34, 34); font-family: Arial, 'Helvetica Neue', Helvetica, sans-serif; font-size: 16px; line-height: 26px;" class=""><strong class="" style=""><em class="" style="">Read more: <a href="https://www.yahoo.com/tech/four-ways-your-email-provider-can-encrypt-your-messages-88313279174.html" data-ylk="elm:itm;elmt:link;t1:a2;t2:article;t3:body;t8:5a9fb8cb-7daa-39bd-b58c-e0ae6a674ff1;t9:18;itc:0;" target="_blank" data-rapid_p="26" style="text-decoration: none; color: rgb(148, 0, 80);" class="">4 Ways Your Email Provider Can Encrypt Your
Messages</a><br class="" style=""></em></strong></div><div style="margin-top: 1.5em; margin-bottom: 1.5em; color: rgb(34, 34, 34); font-family: Arial, 'Helvetica Neue', Helvetica, sans-serif; font-size: 16px; line-height: 26px;" class=""><strong class="" style="">TLS, then and now<br class="" style=""></strong>The move to the use of TLS could have happened more than five years ago: A <a href="http://www.ietf.org/rfc/rfc2246.txt" data-ylk="elm:itm;elmt:link;t1:a2;t2:article;t3:body;t8:5a9fb8cb-7daa-39bd-b58c-e0ae6a674ff1;t9:18;itc:0;" target="_blank" data-rapid_p="27" style="text-decoration: none; color: rgb(148, 0, 80);" class="">1.0 version of the TLS specification</a> emerged only four years after Schneier’s essay, and <a href="http://tools.ietf.org/html/rfc5246" data-ylk="elm:itm;elmt:link;t1:a2;t2:article;t3:body;t8:5a9fb8cb-7daa-39bd-b58c-e0ae6a674ff1;t9:18;itc:0;" target="_blank" data-rapid_p="28" style="text-decoration: none;
color: rgb(148, 0, 80);" class="">the current 1.2 version dates to 2008</a>. But even as mail services secured people’s log-ins, they did not take the extra step of scrambling their messages while in transit.</div><div style="margin-top: 1.5em; margin-bottom: 1.5em; color: rgb(34, 34, 34); font-family: Arial, 'Helvetica Neue', Helvetica, sans-serif; font-size: 16px; line-height: 26px;" class="">Those who knew this would commonly comfort themselves with the lost-in-the-crowd theory of security: With <a href="http://www.radicati.com/wp/wp-content/uploads/2013/04/Email-Statistics-Report-2013-2017-Executive-Summary.pdf" data-ylk="elm:itm;elmt:link;t1:a2;t2:article;t3:body;t8:5a9fb8cb-7daa-39bd-b58c-e0ae6a674ff1;t9:18;itc:0;" target="_blank" data-rapid_p="29" style="text-decoration: none; color: rgb(148, 0, 80);" class="">some 183 billion messages a day</a>sent back and forth, who would possibly have the time to look for one in
particular? </div><div style="margin-top: 1.5em; margin-bottom: 1.5em; color: rgb(34, 34, 34); font-family: Arial, 'Helvetica Neue', Helvetica, sans-serif; font-size: 16px; line-height: 26px;" class="">Then <a href="http://news.yahoo.com/snowden-letter-aclu-131600361.html" data-ylk="elm:itm;elmt:link;t1:a2;t2:article;t3:body;t8:5a9fb8cb-7daa-39bd-b58c-e0ae6a674ff1;t9:18;itc:0;" target="_blank" data-rapid_p="30" style="text-decoration: none; color: rgb(148, 0, 80);" class="">one year ago</a>, Edward Snowden began giving a crash course in National Security Agency surveillance, which had the policy and, for the first time in history, the technology to collect everything first and index it later. </div><div style="margin-top: 1.5em; margin-bottom: 1.5em; color: rgb(34, 34, 34); font-family: Arial, 'Helvetica Neue', Helvetica, sans-serif; font-size: 16px; line-height: 26px;" class="">After a few weeks of Snowden’s revelations, <a
href="http://www.cnet.com/news/how-web-mail-providers-leave-door-open-for-nsa-surveillance/" data-ylk="elm:itm;elmt:link;t1:a2;t2:article;t3:body;t8:5a9fb8cb-7daa-39bd-b58c-e0ae6a674ff1;t9:18;itc:0;" target="_blank" data-rapid_p="31" style="text-decoration: none; color: rgb(148, 0, 80);" class="">CNET’s Declan McCullagh made a simple observation</a>: Gmail supported TLS, but other major email services did not, meaning that a huge chunk of the world’s email could be inspected by the NSA and its ilk, because for TLS to work, both sides of an email conversation have to support it.</div><div style="margin-top: 1.5em; margin-bottom: 1.5em; color: rgb(34, 34, 34); font-family: Arial, 'Helvetica Neue', Helvetica, sans-serif; font-size: 16px; line-height: 26px;" class="">To make it more difficult for the NSA to simply absorb the world’s email, more tech companies took an active interest in TLS, including Yahoo Tech’s publisher, Yahoo, which
had <a href="http://www.washingtonpost.com/blogs/the-switch/wp/2013/10/14/yahoo-to-make-ssl-encryption-the-default-for-webmail-users-finally/" data-ylk="elm:itm;elmt:link;t1:a2;t2:article;t3:body;t8:5a9fb8cb-7daa-39bd-b58c-e0ae6a674ff1;t9:18;itc:0;" target="_blank" data-rapid_p="32" style="text-decoration: none; color: rgb(148, 0, 80);" class="">lagged in its support for encryption</a>, according to the Washington Post.</div><div style="margin-top: 1.5em; margin-bottom: 1.5em; color: rgb(34, 34, 34); font-family: Arial, 'Helvetica Neue', Helvetica, sans-serif; font-size: 16px; line-height: 26px;" class=""><strong class="" style="">Progress and confusion<br class="" style=""></strong>With the growing use of TLS, the odds are now lower that your email is going out on a postcard. In mid-May, a study by Facebook found that <a href="https://www.facebook.com/notes/protect-the-graph/the-current-state-of-smtp-starttls-deployment/1453015901605223"
data-ylk="elm:itm;elmt:link;t1:a2;t2:article;t3:body;t8:5a9fb8cb-7daa-39bd-b58c-e0ae6a674ff1;t9:18;itc:0;" target="_blank" data-rapid_p="33" style="text-decoration: none; color: rgb(148, 0, 80);" class="">58 percent of the social network’s email notifications to members were going out encrypted</a>. And last week, Google <a href="http://googleblog.blogspot.com/2014/06/transparency-report-protecting-emails.html" data-ylk="elm:itm;elmt:link;t1:a2;t2:article;t3:body;t8:5a9fb8cb-7daa-39bd-b58c-e0ae6a674ff1;t9:18;itc:0;" target="_blank" data-rapid_p="34" style="text-decoration: none; color: rgb(148, 0, 80);" class="">posted similar numbers</a>: 71 percent of messages from Gmail to elsewhere went out encrypted, while 50 percent of those received by Gmail also arrived locked.</div><div style="margin-top: 1.5em; margin-bottom: 1.5em; color: rgb(34, 34, 34); font-family: Arial, 'Helvetica Neue', Helvetica, sans-serif; font-size: 16px; line-height: 26px;"
class="">There’s your good news: We’ve fixed a core defect in email and reduced the capability of well-meaning friends, family, and business partners to inadvertently risk your privacy by sending sensitive data about you in their own email. And with TLS, you don’t have to install any software or change any settings to get its advantage.</div><div style="margin-top: 1.5em; margin-bottom: 1.5em; color: rgb(34, 34, 34); font-family: Arial, 'Helvetica Neue', Helvetica, sans-serif; font-size: 16px; line-height: 26px;" class="">The bad news: It’s hard to figure out if your own provider has done its part. </div><div style="margin-top: 1.5em; margin-bottom: 1.5em; color: rgb(34, 34, 34); font-family: Arial, 'Helvetica Neue', Helvetica, sans-serif; font-size: 16px; line-height: 26px;" class="">Google’s regularly updated transparency report now includes <a href="http://www.google.com/transparencyreport/saferemail/"
data-ylk="elm:itm;elmt:link;t1:a2;t2:article;t3:body;t8:5a9fb8cb-7daa-39bd-b58c-e0ae6a674ff1;t9:18;itc:0;" target="_blank" data-rapid_p="35" style="text-decoration: none; color: rgb(148, 0, 80);" class="">a section on “encryption in transit”</a> that lets you check to see if other large mail services do TLS. But it can yield confusing results, and smaller systems (say, your employer’s) don’t show up. </div><div style="margin-top: 1.5em; margin-bottom: 1.5em; color: rgb(34, 34, 34); font-family: Arial, 'Helvetica Neue', Helvetica, sans-serif; font-size: 16px; line-height: 26px;" class="">You can also check for TLS use on any site at <a href="https://starttls.info/" data-ylk="elm:itm;elmt:link;t1:a2;t2:article;t3:body;t8:5a9fb8cb-7daa-39bd-b58c-e0ae6a674ff1;t9:18;itc:0;" target="_blank" data-rapid_p="36" style="text-decoration: none; color: rgb(148, 0, 80);" class="">STARTTLS.info</a>.</div><div style="margin-top: 1.5em;
margin-bottom: 1.5em; color: rgb(34, 34, 34); font-family: Arial, 'Helvetica Neue', Helvetica, sans-serif; font-size: 16px; line-height: 26px;" class=""><strong class="" style="">Should you switch?<br class="" style=""></strong>If you spend any time experimenting with STARTTLS.info, you’ll quickly see how badly many consumer Internet providers’ mail services lag behind webmail. Comcast is turning on TLS one provider at a time, and CenturyLink already supports it. But Time Warner Cable, Verizon, and Cox have not announced plans to enable TLS.</div><div style="margin-top: 1.5em; margin-bottom: 1.5em; color: rgb(34, 34, 34); font-family: Arial, 'Helvetica Neue', Helvetica, sans-serif; font-size: 16px; line-height: 26px;" class="">Among webmail companies, Yahoo followed Gmail by turning on TLS in the first quarter of this year, AOL has done the same, and Microsoft is “currently rolling out TLS,” a spokesperson said. </div><div
style="margin-top: 1.5em; margin-bottom: 1.5em; color: rgb(34, 34, 34); font-family: Arial, 'Helvetica Neue', Helvetica, sans-serif; font-size: 16px; line-height: 26px;" class="">Checks of Apple’s services show patchy support, and the company did not answer a request for clarification.</div><div style="margin-top: 1.5em; margin-bottom: 1.5em; color: rgb(34, 34, 34); font-family: Arial, 'Helvetica Neue', Helvetica, sans-serif; font-size: 16px; line-height: 26px;" class="">There are good reasons to separate your email from your ISP — starting with not having to worry about running out of online storage or having to send hundreds of change-of-address notices if you switch providers. But webmail has its own privacy issue: Most of these services are paid for by ads that target the words in your messages. </div><div style="color: rgb(34, 34, 34); font-family: Arial, 'Helvetica Neue', Helvetica, sans-serif; font-size: 16px; line-height: 26px;"
class="">The price to evade the NSA’s eyes doesn’t have to include subjecting your email to your provider’s advertising robots. Among the four big webmail services that now use TLS, <a href="http://www.usatoday.com/story/tech/2013/10/13/email-ads/2967869/" target="_blank" data-ylk="elm:itm;elmt:link;t1:a2;t2:article;t3:body;t8:5a9fb8cb-7daa-39bd-b58c-e0ae6a674ff1;t9:18;itc:0;" data-rapid_p="37" style="text-decoration: none; color: rgb(148, 0, 80);" class="">Microsoft and Yahoo let you pay to clean the ads from your account</a> ( <a href="http://windows.microsoft.com/en-us/outlook/ad-free-outlook" target="_blank" data-ylk="elm:itm;elmt:link;t1:a2;t2:article;t3:body;t8:5a9fb8cb-7daa-39bd-b58c-e0ae6a674ff1;t9:18;itc:0;" data-rapid_p="38" style="text-decoration: none; color: rgb(148, 0, 80);" class="">$19.95 a year</a> at Microsoft, <a href="https://help.yahoo.com/kb/overview-yahoo-free-mail-sln15803.html"
target="_blank" data-ylk="elm:itm;elmt:link;t1:a2;t2:article;t3:body;t8:5a9fb8cb-7daa-39bd-b58c-e0ae6a674ff1;t9:18;itc:0;" data-rapid_p="39" style="text-decoration: none; color: rgb(148, 0, 80);" class="">$49.99 a year</a> at Yahoo), while Google will open a new, <a href="http://www.google.com/enterprise/apps/business/" target="_blank" data-ylk="elm:itm;elmt:link;t1:a2;t2:article;t3:body;t8:5a9fb8cb-7daa-39bd-b58c-e0ae6a674ff1;t9:18;itc:0;" data-rapid_p="40" style="text-decoration: none; color: rgb(148, 0, 80);" class="">$50/year ad-free Google Apps account</a> for you at the domain name of your choice.</div><div style="margin-top: 1.5em; margin-bottom: 1.5em; color: rgb(34, 34, 34); font-family: Arial, 'Helvetica Neue', Helvetica, sans-serif; font-size: 16px; line-height: 26px;" class="">But how many of you have exercised any of those ad-free options?</div><div style="margin-top: 1.5em; margin-bottom: 1.5em; color: rgb(34, 34, 34);
font-family: Arial, 'Helvetica Neue', Helvetica, sans-serif; font-size: 16px; line-height: 26px;" class=""><em class="" style="">Email </em><a href="http://robpegoraro.com/" data-ylk="elm:itm;elmt:link;t1:a2;t2:article;t3:body;t8:5a9fb8cb-7daa-39bd-b58c-e0ae6a674ff1;t9:18;itc:0;" target="_blank" data-rapid_p="41" style="text-decoration: none; color: rgb(148, 0, 80);" class=""><em class="" style="">Rob</em></a><em class="" style=""> at </em><a href="mailto:rob@robpegoraro.com" data-ylk="elm:itm;elmt:link;t1:a2;t2:article;t3:body;t8:5a9fb8cb-7daa-39bd-b58c-e0ae6a674ff1;t9:18;itc:0;" target="_blank" data-rapid_p="42" style="text-decoration: none; color: rgb(148, 0, 80);" class=""><em class="" style="">rob@robpegoraro.com</em></a><em class="" style="">; follow him on Twitter at</em><a href="http://twitter.com/robpegoraro" data-ylk="elm:itm;elmt:link;t1:a2;t2:article;t3:body;t8:5a9fb8cb-7daa-39bd-b58c-e0ae6a674ff1;t9:18;itc:0;" target="_blank"
data-rapid_p="43" style="text-decoration: none; color: rgb(148, 0, 80);" class=""><em class="" style="">@robpegoraro</em></a><em class="" style="">.</em></div><div style="color: rgb(0, 0, 0); font-size: 19px; font-family: 'times new roman', 'new york', times, serif; font-style: normal; background-color: transparent;" class=""><br class="" style=""></div></div></body></html>