[ILUG] Q of the moment: does SSL matter? ( for webmail & pop & imap & smtp & ... ? )

[paul at clubi.ie]

On Fri, 1 Aug 2008, Kae Verens wrote:

> not going to even pretend to be an expert on this, but SSL is not 
> just about security. in most uses, the certs are used to identify 
> either the client or the server.

Identity assurance is part of security, as are things like secrecy of 
communications. ;)

> SSL for email is probably useless where security is concerned, as 
> when the emails are in transit between servers, they're mostly 
> un-encrypted, and when stored on the various machines along the 
> route to the mailbox, they're also unencrypted.

Tangent: you could use the public keys from the same X.509 certs used 
for SSL to also encrypt the email.

That said, routine encryption of communication is very useful, even 
if you have no need for security (e.g. Tim's arguments here before) 
or if other parts of your infrastructure (e.g. server storage) are 
not very secure: It increases the costs of the various 
mass-electronic-surveillance programmes in place across the world..

regards,
-- 
Paul Jakma	paul at clubi.ie	paul at jakma.org	Key ID: 64A2FF6A
Fortune:
firewall needs cooling