Email tapping by ISPs, forwarder addresses, and crypto proxies

[Declan McCullagh]

On Wed, Jul 07, 2004 at 01:11:58AM -0700, Bill Stewart wrote:
> Google's Gmail is an interesting case.
> Unlike Councilman's ISP, who were sneaky greedy wiretapping bums,
> Google tells you that they'll grep your mail for advertising material,
> and tells you how much of that they'll leak to the advertisers
> and makes you some promises not to leak more.
> The data's just sitting there waiting for a subpoena,
> and there's not much point in having it all encrypted because
> the cool features of Gmail aren't much use on cyphertext.

FYI here's something I wrote in April... --Declan



http://news.com.com/Is+Google+the+future+of+e-mail%3F/2010-1032_3-5187543.html

If Google wanted to veer in a more privacy-protective direction, it
could look to the intriguing model of Vancouver, Canada-based Hush
Communications, which runs the Hushmail Web mail system. Unlike
rivals, Hush encrypts mail sent between Hush users. It uses a
Java-based technique that allows for only its intended recipient--and
not Hush employees--to decrypt a scrambled e-mail message. If a
subpoena arrives, or if a security breach ever happens, disclosure
would be limited.

Hush offers 2-megabyte-limit free accounts and pay accounts, and it
said 900,000 accounts have been created since its May 1999 launch. The
company also lets users store files in an encrypted volume and this
week plans to announce a feature that permits encrypted volumes to be
shared among multiple users.

Hush's patent No. 6,154,543 covers some aspects of encrypted
e-mail. The company said it'd happy to license it to
Google. Originally, Hush Chief Technology Officer Brian Smith said,
the patent was quite broad, but "we have narrowed the patent to apply
only to e-mail and messaging systems. The modifications were accepted
but don't yet appear" on the U.S. Patent and Trademark Office's Web
site.

True, if the archived e-mail is encrypted, Gmail won't be able to
search message bodies very efficiently, but users might be willing to
give up that feature and even pay a monthly charge in exchange for
additional security.

"We'll think about it," said Google's Rosing. "We don't have any
explicit plans right now...If someone really needs to encrypt a lot of
e-mail, maybe they should be putting that on their laptop. We're
trying to provide a service that offers some utility to our users. If
you change the service to take away all the value of the service,
you're back where you started."

Maybe. But until that happens, would-be users of Gmail or any similar
service should recognize that their so-called free e-mail comes at a
price.