Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Given that one can upload emails to gmail via IMAP, via methods such as:

http://email.about.com/od/gmailtips/qt/How_to_Import_Mail_from_Mozilla_Thunderbird_in_Gmail.htm

Is there a method to prove that emails in gmail are legitimate? If one took an email to court, and the other party claimed the email was manipulated via IMAP, how would one marshal a defence?

Obviously in cases where federal agents freeze gmail accounts, the data in it holds value should one not have expected a super-user to be aware of a coming freeze before hand... but that's not what I'm interested in.

I'm interested in means of PROVING that emails are original and legitimate against claims of IMAP upload manipulation.

Thanx.

share|improve this question
    
Open the mail headers? –  Rob Sep 27 '13 at 11:47
    
Why would the mail headers be any different? They should simply contain all the header information submitted to gmail via the manipulated IMAP calls. –  Daniel Sep 27 '13 at 11:50
    
@Ramhound, I acknowledge that this problem exists when running one's own servers... but gmail is ubiquitous, and the assumption is because it is managed by a 3rd party, it is certified by a 3rd party. There is also secret-sauce in gmail storage (labels) that aren't in the email standard. So either there IS a way of validating that gmail provides or there isn't. The question is well defined. If you're still unhappy, please explain why. –  Daniel Sep 27 '13 at 11:53
    
@Ramhound, the email standard doesn't provide means of validating the source of an email per se, only capturing various processing sources in the header. My citation about labels demonstrates that I'm interested in what features GMAIL specifically provides, and this is an example of how they have broken with standards (implemented additional features) in the past. It turns out that the answer I'm looking for might lie in the processing of the DKIM header tag PROVIDED that this is/isn't altered on imap upload. You seem to be interested in a different question. –  Daniel Sep 27 '13 at 12:10
    
@Ramhound Again! That isn't what I was asking. DKIM can be used to verify the sender, but in many cases where DKIM isn't set... there seems to be NO mechanism. So the answer is NO there doesn't appear to be a public mechanism for gmail specifically, but they may keep logs internally, but there is no data to back this up. –  Daniel Sep 27 '13 at 12:23
add comment

2 Answers 2

up vote 2 down vote accepted

I do believe DKIM signing standard would detect spoofing of emails if setup correctly, while also using the strongest signing methods.

That is, DKIM signing would prove that an email was sent from a certain source, and has arrived unmodified since being signed by the sending server (as only the sending server can sign mail for that domain). If the DKIM signing is missing, one could assert that the message was spoofed, thus would require more verification to prove originality.

However, since most domains do not use DKIM signing (to much of a hassle?) this could prove difficult to implement. http://en.wikipedia.org/wiki/DomainKeys_Identified_Mail

The only true way is to use some other form of signing - such as GPG/PGP/OpenGPG. http://en.wikipedia.org/wiki/GNU_Privacy_Guard

share|improve this answer
    
A little late it seems... –  Mark Lopez Sep 27 '13 at 12:16
    
Nope, not too late. Your answer is the best. –  Daniel Sep 27 '13 at 12:21
    
@MarkLopez Doesn't DKIM only verify the source of the sender. If I copy an email with a proper DKIM to my IMAP inbox, wouldn't DKIM still check out (same goes for signing keys)? –  SlightlyCuban Sep 27 '13 at 12:30
    
@SlightlyCuban You could set DKIM to sign everything (date, body, from, to, etc.), although this is almost never done because of the possible incompatibilities with MIME types, the load on the mail server, and the possibility of the high, false negative, verification rate. However, signing the content is still possible. This is what I ment by using the strongest signing methods (although impractical). –  Mark Lopez Sep 27 '13 at 12:36
    
@MarkLopez, it's important to note that a copy of the DKIM seems not to be available in the original copy under your "sent" messages. So you can't publicly validate that you actually did send a message! You should add that to the answer. If gmail validates to fields, then you could set up BCC account to keep DKIMs. Yet to be determined. –  Daniel Sep 27 '13 at 12:40
show 4 more comments

Get the corresponding mail from the recipient/sender and cross-check.

IMAP (and especially POP) are protocols designed to receive email, not make sure you are who you say you are (there are mechanisms such as signing keys which can verify the identity of a sender of an email, but nothing built into IMAP itself).

There is always the option of checking the security/access logs of the IMAP server to make sure the account was accessed in an "appropriate" way, but:

  1. This varies server-to-server, if it is tracked at all
  2. For Gmail specifically, you'd have to go ask Google to hand over their logs
  3. What you've described is an "appropriate" IMAP transaction. Should that be logged?

So, at the end of the day, if you want to be 100% sure an email was sent from/received by an account at a specific date & time, check the other end.

share|improve this answer
    
If the corresponding sender is your opposing party in a law-suit then that would not be possible. What I am asking about is a feature that either gmail implements internally or it does not. It need not stick to the email standards to implement this (like it doesn't stick to standards to implement labels). So basically either they internally sign emails they have processed in order to discriminate them from emails users have uploaded... or they do not. –  Daniel Sep 27 '13 at 12:00
    
@Daniel, this is like asking "how would I know if some company shredded their documents?" Gmail probably keeps access logs, but you'd have to request it from Google. There isn't really a public service they provide to do this. –  SlightlyCuban Sep 27 '13 at 12:13
    
This is exactly what I'm asking! Are proof of these logs in the original email header? Accessible via gmail-labs? Demonstrated via court cases that gmail DOES have means of validating them, or simply doesn't care? This is what makes for a complete answer, and why I can't mark yours as correct. –  Daniel Sep 27 '13 at 12:17
    
@Daniel, according to IMAP, no. Maybe Gmail could do something strange to the timestamps without telling you, but this is not documented. AFAIK, if it is IMAP it really doesn't care. –  SlightlyCuban Sep 27 '13 at 12:28
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.