Hacker News Reader

Comment by Faaak | Hacker News Reader

Among other interesting things: "for the exchange of DNA profile information [...]: Data are exchanged by Simple Mail Transfer Protocol (SMTP) and other state-of-the-art technologies, using a central relay mail server provided by the network provider. The XML file is transported as mail body"

Well, this is not good

View on HN

Why? XML in S/MIME over SMTP might not be cutting edge, but it's still state-of-the-art. I would be hard pressed to come up with something better that's equally based on open, established standards. XML is the only thing I would like to replace, but that's probably not worth it given the number of existing legacy systems

> for the exchange of DNA profile information

So you're fine that your DNA information is transmitted in clear in an email?

Of course it's encrypted, the deal reads "The open standard s/MIME as extension to de facto e-mail standard SMTP will be deployed to encrypt messages containing DNA profile information" (highlight mine). Then it goes on with technical details (that could be updated a bit), then the mention that common email software already supports this (including those from the headline, which is how we got this headline).

https://assets.publishing.service.gov.uk/government/uploads/... page 921

Except...not. HTTP is also cleartext, but it is usually tunelled through TLS. The entire stack matters, not that this one part is insecure when considered in isolation.

It’s not “in clear” though, is it? It’s encrypted.

That’s all open source standardized. That’s a million times better than a dependency on GitHub, AWS, or some Google Drive link.

A really puzzling part: "SMTP is a ‘push’ protocol that does not allow one to ‘pull’ messages from a remote server on demand. To do this a mail client shall use POP3 or IMAP. Within the framework of implementing DNA data exchange it is decided to use the protocol POP3."

What’s puzzling about that? It’s true, and seems a reasonable choice

Unless they invented a creative way to use pop3, it is not 'pull' in any reasonable sense, because you can only pull what has already been pushed. You can't even even select what to pull once more than one request is outstanding, because pop3 does not convey information beyond message size.

Also, you have to poll continuously, destroying the benefit of having something pushed over smtp.

You prefer Snapchat or tik tok??

Reply on news.ycombinator.com