-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - --On Wednesday, June 03, 2015 15:14 -0400 Hector Santos <hector.santos45@xxxxxxxxx> wrote: > On 6/2/2015 11:24 AM, Måns Nilsson wrote: >> The above benefits of signing apply roughly equally well to >> both methods. /Måns, signing all outgoing e-mail. If e-mail >> from me is not signed, something is fishy. > > But if you are not signing the mail yourself, its already > "fishy." Or do you mean sign by some trusted 3rd party and > wish for others to trust as well? Hector, I assume he meant "signed by some mechanism, including key certification, that most recipients would have reason to trust". Now that raises a lot of issues, some of which interact with claims that HTTPS provides significant data integrity protection. I wish that, at least as a demonstration matter, more MUAs made it easy to create a security-based whitelist for incoming mail to particular mailbox or folders, e.g., to reject anything that was not signed in a key that was either stored and certified locally or that was certified by a CA that the user had chosen to trust. In addition to allowing some noise-free (as well as merely spam-free) folders, it would help the broader community understand the limitations of such approaches. For example, we could not use it for the IETF list and preserve the position that anyone could post and that pseudononymous postings were ok. I also note that "PGP key signing parties" used to be a regular feature at almost every IETF meeting. If we were serious about secure communications (not just email) within the IETF community, we would reinstitute those, review signing criteria and create some guidelines, and make sure we could get X.509 certs issued/signed too, if necessary in an IETF or ISOC tree. If we were trying to make good demonstrations for the wider community, we would move in those sorts of directions. We might also pick up on Måns's "if it isn't signed, it isn't from me" assertion and modify our various protocols for domain-based assertions about mail to allow "if something claims to come from this domail and its content isn't digitally signed using method X, it is bogus" assertions. Lots of things we could be doing. Or we can contribute to the repertoire of security theater and make our lives harder in the process. regards, john -----BEGIN PGP SIGNATURE----- Version: Encryption Desktop 10.3.0 (Build 8741) Charset: utf-8 wj8DBQFVcAHo5pJ/EbOJ8NoRAoJyAKCERi9i+hicycOBc+Mc5zgxKEGh8QCfZJWx V6JIsVatL3bA/LnpUv9xNbA= =VMXb -----END PGP SIGNATURE-----