
There is no expectation of privacy in email
There may be NO privacy in email, but that doesn't mean there is no expectation of privacy.
Want privacy? Encrypt the actual message itself.
So in order to view an email you must:
1 Log into a computer
2 pull up an email program
3 authenticate with the server
4 download a copy from the server
5 read the email.
I can certainly see how adding one extra step
4.5 Open the email (decrypt or de-envelope)
Is the BIG step that you think is necessary to imply an expectation of privacy. So, why is it that 4 distinct steps is not sufficient to be considered no expectation of privacy, but 1 extra step is?
And what if the encryption is ROT13? is that sufficient? Or if someone is good enough to have memorized it and can read such a message rote do you no longer have any expectation of privacy?
The simple fact of the matter, is that the concept of an expectation of privacy is based upon the concept of what a person may observe with their own senses and not going out of their way to acquire that information. It is EXACTLY why it is NOT legal to use IR cameras to spy into buildings even though all that juicy IR information is beaming right out of the homes.
You can not read an email without technical assistance. That's all the envelope that is necessary.
[a-z0-9]{8} Yields 36^8, or 2821109907456.
Must contain at least 1 number means you subtract all those that don't (26^8). Must contain at least 1 non-number (I'm assuming this is also a restriction) means you subtract all those that don't (10^8).
You're down to 2612182842880.
Other specific restrictions (can't be the user name, can't be last password, can't be 1234abcd) will have very little effect. Let's call it 2500000000000.
At 100000 per second, we have 25000000 seconds, or 9 and a half months to crack a password.
Odds are you'll crack it in 1/2 that time, so you've got 4-5 months.
Simply require users to change their password every 6 months and you're safe enough.
An attacker would have to:
- Know when a user changes his password.
- Get the hash immediately.
- Know the encryption scheme used.
- Crack non stop without the video card melting.
- Have about a 60% chance of getting it before the user is required to change their password again.
It's doable, but anyone who would be the target of such an attack would likely have:
- A better bank
- FDIC-insured investments
- Lawyers with very expensive suits
But why are we talking about cracking passwords when we should be discussing the root of the problem? Someone done accessed ur shit and got ur password file, foo!
Why not just develop a design to swap out batteries through an automated crane? Pull in, the robot arm removes your empty battery and replaces it with a full one. The empty battery charges at whatever pace the 'gas' station deems necessary (maybe overnight when prices are lower) and the driver has a full charge within seconds. I'm almost certain I saw this idea put forth on
Ocean: A body of water occupying about two-thirds of a world made for man -- who has no gills. -- Ambrose Bierce