Silvano Rebai - Fotolia
How the STARTTLS Everywhere initiative will affect surveillance
The EFF's STARTTLS Everywhere initiative encrypts email during delivery and aims to prevent mass email surveillance. Expert Michael Cobb explains how STARTTLS works.
When the internet was first coming into being, its main function was fault-tolerant communication between academic and military computer networks. The importance of security in that scenario was not high, so the Internet Protocol suite that was developed to provide end-to-end data communication didn't include the type of security and authentication checks that are needed today when enterprises, individuals and billions of devices use the internet to send sensitive data.
One of the first protocols developed for the internet was the Simple Mail Transfer Protocol (SMTP), which is used to send and receive email messages. This too lacks any built-in security, such as encryption and authentication, and messages are sent in plaintext, enabling anyone handling or monitoring traffic between mail servers to read the contents of each message without having to hack or crack any security controls. This also enables any government agency plugged into an internet backbone access point to easily carry out mass surveillance, collecting and reading emails from around the world.
Over the years, additional protocols have been created to provide a security layer for different types of communication. The most well-known is Hypertext Transfer Protocol Secure (HTTPS), originally developed by Netscape Communications in 1994 as an extension of HTTP to provide authentication, privacy and integrity of data while in transit over a computer network.
Pretty Good Privacy, developed in 1991, and Secure/Multipurpose Internet Mail Extensions, developed in 1995, are two popular security protocols that enable senders to sign and encrypt messages that are then decrypted by the recipient while remaining unreadable to mail servers or anyone else while in transit. This is known as end-to-end encryption, and although there are various software and email client plug-ins that allow users to use these protocols, they have never really taken off, as they are perceived as difficult to set up and use. This means the majority of email messages are still sent in plaintext.
STARTTLS Everywhere
The STARTTLS Everywhere initiative aims to promote and improve the use of the email encryption extension STARTTLS. STARTTLS is a service extension for SMTP published in 2002 that is defined in RFC 3207 as "SMTP Service Extension for Secure SMTP over Transport Layer Security." Although not a replacement for secure end-to-end solutions, it does enable email service providers and system administrators to configure mail servers and clients to use TLS (Transport Layer Security) to encrypt messages as they travel across the Internet.
Like many security controls, STARTTLS is often poorly configured or implemented, so the Electronic Frontier Foundation (EFF), which is behind this new initiative, wants to make setting up STARTTLS quick and easy.
As things stand now, plenty of mail servers already use STARTTLS, but they fail to validate the digital certificates presented by other mail servers, opening the way for man-in-the-middle attacks, which negates the security TLS should provide. As few mail servers bother to validate certificates, they are often left unrenewed, as there's little incentive to present a valid certificate.
As part of the STARTTLS Everywhere initiative, the EFF offers software that can automatically obtain a valid certificate from the free certificate authority Let's Encrypt. The software can also then step through the configuration or the email server to ensure it's using STARTTLS properly.
EFF also wants to tackle the problem of STARTTLS downgrade attacks by building a list of email domains that support TLS encryption and present valid certificates -- a STARTTLS Policy List. A downgrade attack occurs when a man-in-the-middle blocks a sender's plaintext STARTTLS message requesting an encrypted communication channel, so it remains unencrypted. A STARTTLS Policy List of STARTTLS-compliant mail servers will make it easier for senders to detect a downgrade attack as recipient domains in the list should provide valid responses and certificates. Email administrators can check the status of their domains and add them to the list via the STARTTLS Everywhere website.
STARTTLS Everywhere does not provide complete security for email, but it can make mass surveillance of emails a lot harder. Another protocol enterprises should consider is domain-based message authentication, reporting and conformance, which allows recipient mail servers to verify that an email has actually been sent from an authorized server or service. For highly sensitive messages, it is still necessary to use end-to-end encryption, as STARTTLS only encrypts the communications channel between mail servers.
