BLOG

Gmail showing authentication info

Yesterday Gmail announced on their blog they would be pushing out some new UI to users to show the authentication and encryption status of email. They are trying to make email safer.

There are a number of blog posts on WttW for background and more information.

The short version is that TLS is encryption of the email between the sending server and the receiving server.  It means mail can’t be intercepted or changed while between one server and another.

Gmail is now showing users whether a mail was sent using TLS.

If a message is sent without using TLS, there is an open red lock shown.

Open red lock = unencrypted

If you hover over the open red lock, Gmail tells you the “message was not encrypted”

Hover showing "message not encrypted"

Using TLS removes the open red lock.

Mail sent over TLS

These messages went to spam because, well, do you know how hard it is to find a mail server that’s not authenticated? I ended up sending using SWAKS from one of our VMs so I could control a whole bunch of things, including whether or not mail used TLS. Interestingly enough, Gmail was happy to accept the mail over IPv6 but temp failed anything I sent over IPv4.

Gmail is, apparently, also notifying if mail being sent is going to a recipient on a server not using TLS. I don’t have an easy way to test that.

2 comments

  1. Anthony Chiulli says

    Hi Laura – for your last comment about not having an easy way to test whether mail being sent is going to a recipient on a server not using TLS, I have found by hitting “reply to” some of my inbound promo emails in Gmail, it will also show a red broken padlock, indicating the mail’s destination email service is not using TLS. I have a couple examples of both if you need them.

    1. laura says

      Yeah, that doesn’t seem to have been rolled out to my account, yet. I tried doing that and got nothing – although it’s possible most of the mail into my google address supports TLS.

Comment:

Your email address will not be published. Required fields are marked *

  • OTA joins the ISOC

    The Online Trust Alliance (OTA) announced today they were joining forces with the Internet Society (ISOC). Starting in May, they will operate as an initiative under the ISOC umbrella. “The Internet Society and OTA share the belief that trust is the key issue in defining the future value of the Internet,” said Internet Society President and CEO, Kathryn Brown. “Now is the right time for these two organizations to come together to help build user trust in the Internet. At a time when cyber-attacks and identity theft are on the rise, this partnership will help improve security and data privacy for users,” added Brown.No Comments


  • Friday blogging... or lack of it

    It seems the last few Friday's I've been lax on posting. Some of that is just by Friday I'm frantically trying to complete all my client deliverables before the weekend. The rest of it is by Friday I'm just tired. Today had the added complication of watching the Trumpcare debate and following how (and how soon) it would affect my company if it passed. That's been a bit distracting, along with the other stuff I posted about yesterday. I wish everyone a great weekend.1 Comment


  • Indictments in Yahoo data breach

    Today the US government unsealed an indictment against 2 Russian agents and 2 hackers for breaking into Yahoo's servers and stealing personal information. The information gathered during the hack was used to target government officials, security employees and private individuals. Email is so central to our online identity. Compromise an email account and you can get access to social media, and other accounts. Email is the key to the kingdom.No Comments


Archives