9:14 p.m.
Hey guys, this is somewhat offtopic, but I can't think of a better place to
ask . . .
Could someone briefly fill me in on the if, why and how of email signing (I
do not mean signatures). I am sure I can google the how, but I would like
opions and experiences.
Thank you.
--
As a boy I jumped through Windows, as a man I play with Penguins.
10:35 p.m.
Arthur Pemberton wrote:
Could someone briefly fill me in on the if, why and how of email
signing (I do not mean signatures). I am sure I can google the how,
but I would like opions and experiences.
OK, I presume that you mean cryptographic signing. Message signing can
be done with either SMIME or PGP. Both accomplish the same thing, and
operate in virtually the same way.
Why sign? It's all about trust. If you reliably sign your messages,
the people with whom you exchange messages can configure their mail
client to trust the fingerprint of your certificate (or, they may trust
someone who signed your certificate). They can trust that a message
with your name on it, which has a valid signature, was written by you
and has not been tampered with. They should also learn not to trust
messages that have your name on it, but no signature.
Which method you choose probably will be influenced most by who,
exactly, you want to be able to verify your signatures. SMIME uses, in
large part, the same infrastructure that is already in virtually every
mail client to support SSL connections. That's one of the reasons that
SMIME is supported by nearly every major mail client available, out of
the box. PGP does pretty much exactly the same thing, but requires an
entirely separate infrastructure. I'm not aware of any major client
that supports PGP by default; they require plugins, mostly. That gives
SMIME a significant advantage if you want to sign messages, and have
that information be useful to a wide audience.
11:36 p.m.
On 1/30/06, Gordon Messmer <yinyang(a)eburg.com> wrote:
Arthur Pemberton wrote:
>
> Could someone briefly fill me in on the if, why and how of email
> signing (I do not mean signatures). I am sure I can google the how,
> but I would like opions and experiences.
OK, I presume that you mean cryptographic signing. Message signing can
be done with either SMIME or PGP. Both accomplish the same thing, and
operate in virtually the same way.
Why sign? It's all about trust. If you reliably sign your messages,
the people with whom you exchange messages can configure their mail
client to trust the fingerprint of your certificate (or, they may trust
someone who signed your certificate). They can trust that a message
with your name on it, which has a valid signature, was written by you
and has not been tampered with. They should also learn not to trust
messages that have your name on it, but no signature.
Which method you choose probably will be influenced most by who,
exactly, you want to be able to verify your signatures. SMIME uses, in
large part, the same infrastructure that is already in virtually every
mail client to support SSL connections. That's one of the reasons that
SMIME is supported by nearly every major mail client available, out of
the box. PGP does pretty much exactly the same thing, but requires an
entirely separate infrastructure. I'm not aware of any major client
that supports PGP by default; they require plugins, mostly. That gives
SMIME a significant advantage if you want to sign messages, and have
that information be useful to a wide audience.
Thanks. That's exactly what I wanted to know. I wanted to know before I
put in the effor to encoperate signing into my emails.
Two questions for now:
1) Can I do both SMIME and PGP in my emails?
2) What happens when the receiving client can't read the signature?
--
As a boy I jumped through Windows, as a man I play with Penguins.
12:54 a.m.
Arthur Pemberton wrote:
1) Can I do both SMIME and PGP in my emails?
I'm not really sure. I don't know anyone who does.
2) What happens when the receiving client can't read the
signature?
If you mean "when the client doesn't have the software to process the
signature", it should just show up as an attachment.
2:04 a.m.
Thank you
On 1/31/06, Gordon Messmer <yinyang(a)eburg.com> wrote:
Arthur Pemberton wrote:
>
> 1) Can I do both SMIME and PGP in my emails?
I'm not really sure. I don't know anyone who does.
> 2) What happens when the receiving client can't read the signature?
If you mean "when the client doesn't have the software to process the
signature", it should just show up as an attachment.
--
fedora-list mailing list
fedora-list(a)redhat.com
To unsubscribe: https://www.redhat.com/mailman/listinfo/fedora-list
--
As a boy I jumped through Windows, as a man I play with Penguins.
7:17 a.m.
On Mon, 2006-01-30 at 23:36 -0600, Arthur Pemberton wrote:
1) Can I do both SMIME and PGP in my emails?
I wouldn't think so. A signature is added to a message as confirmation
that the message hasn't been tampered with, therefore its based on the
message contents.
Conjecture, because adding a signature adds to the contents: If you
were to add one then the other, the first signature would try to
proclaim the message to be okay. The second signature added would try
to proclaim the message with the first signature, in combination, to be
okay. But adding the second signature changed the message, so anyone
trying only to use the first signature (because that's all that their
client supported) would see the message had been changed (by the second
signature).
--
Don't send private replies to my address, the mailbox is ignored.
I read messages from the public lists.
9:58 a.m.
On Tue, 2006-01-31 at 23:47 +1030, Tim wrote:
On Mon, 2006-01-30 at 23:36 -0600, Arthur Pemberton wrote:
> 1) Can I do both SMIME and PGP in my emails?
I wouldn't think so. A signature is added to a message as confirmation
that the message hasn't been tampered with, therefore its based on the
message contents.
Conjecture, because adding a signature adds to the contents: If you
were to add one then the other, the first signature would try to
proclaim the message to be okay. The second signature added would try
to proclaim the message with the first signature, in combination, to be
okay. But adding the second signature changed the message, so anyone
trying only to use the first signature (because that's all that their
client supported) would see the message had been changed (by the second
signature).
In theory, it should be possible with S/MIME and PGP/MIME (OpenPGP).
In each case, the signature is a separate Mime attachment which signs
the encoded Mime part (I'm in a big discussion over on MailScanner over
busted signatures because they are rewriting and re-encoding the Mime
messages when "Sign Clean Messages" is enabled). In practice, I don't
know of anyone who is doing it or any software which has that
capability. I may try it myself and see what Evolution does with it. I
don't have an S/Mime cert installed yet but Evolution allows you to
select both "PGP Sign" and "S/MIME" sign together. I don't know
what it
does with it when you do that. Verification should be amusing as well.
Mike
--
Michael H. Warfield (AI4NB) | (770) 985-6132 | mhw(a)WittsEnd.com
/\/\|=mhw=|\/\/ | (678) 463-0932 | http://www.wittsend.com/mhw/
NIC whois: MHW9 | An optimist believes we live in the best of all
PGP Key: 0xDF1DD471 | possible worlds. A pessimist is sure of it!
7:40 a.m.
On Tue, 2006-01-31 at 10:58 -0500, Michael H. Warfield wrote:
I'm in a big discussion over on MailScanner over busted
signatures
because they are rewriting and re-encoding the Mime messages
I see quite a few signed messages on here that are flagged as being
invalid, some from the same people, repeatedly. There's not a great
deal of point in signing messages if something is going to mangle them
along the way.
Most PGP ones I see on this list are okay, and I'm guessing that those
PGP ones that fail are usually because the key isn't available from a
public key server (or the one that I'm trying, at least). I can't find
any other sort of failed ones, at the moment, to make a judgement. I
noticed one failed message which had one of those visiting cards
attached, which made me wonder whether their client program stupidly
attached it after signing.
I kept seeing some S/MIME mails are marked invalid that wer from the
same person, over and over, some time ago. I couldn't tell the reason
why, there was nothing to say the certificate had been revoked, I could
only guess the e-mail had been mangled in transit.
I've even found Evolution claiming one message (using PGP signatures)
was okay (the icon, and other stuff, at the bottom of the page). Yet
when opening up the further information window about the signature, it
actually said that the key'd been revoked because it was compromised.
That seemed a very poor behaviour by my mail client.
--
Don't send private replies to my address, the mailbox is ignored.
I read messages from the public lists.
2:32 p.m.
On Tue, 2006-01-31 at 23:47 +1030, Tim wrote:
On Mon, 2006-01-30 at 23:36 -0600, Arthur Pemberton wrote:
> 1) Can I do both SMIME and PGP in my emails?
I wouldn't think so. A signature is added to a message as
confirmation
that the message hasn't been tampered with, therefore its based on the
message contents.
Conjecture, because adding a signature adds to the contents: If you
were to add one then the other, the first signature would try to
proclaim the message to be okay. The second signature added would try
to proclaim the message with the first signature, in combination, to be
okay. But adding the second signature changed the message, so anyone
trying only to use the first signature (because that's all that their
client supported) would see the message had been changed (by the second
signature).
This message should be signed by both S/MIME and PGP, so, yes, it's
"possible". In this case, the signatures do nest in a nested multipart
MIME hierarchy. The message body is encoded quoted-printable in one
MIME part. The encoded part is then signed and the signature is in
another MIME part. That assemblage is nested in another MIME part which
is then S/MIME signed and that forms another MIME part.
Message ----
Mime S ----
Mime P ----
Body
Mime P ----
GPG signature on Body
Mime P ----
Mime S ----
S/Mime Signature on Mime P
Mime S ----
Message ----
Now, why anyone would want to do this, I don't know. But it obviously
is possible and Evolution will, obviously, do it. In theory, this
should work. No guarantees about any and all clients being able to read
and verify it, however. Evolution certainly handles it. I've seen
enough compatibility problems between varying clients just withing pure
PGP/GPG and within pure S/MIME to have any expectations here.
My S/MIME certificate is signed by the CACert.org, <www.cacert.org>;,
root certificate. Maybe we'll see who can verify either with what...
Mike
--
Michael H. Warfield (AI4NB) | (770) 985-6132 | mhw(a)WittsEnd.com
/\/\|=mhw=|\/\/ | (678) 463-0932 | http://www.wittsend.com/mhw/
NIC whois: MHW9 | An optimist believes we live in the best of all
PGP Key: 0xDF1DD471 | possible worlds. A pessimist is sure of it!
2:43 p.m.
I guess it would have helped if I had actually flipped the S/MIME bit
BEFORE hitting send. The previous message did not have the S/MIME
signature. This one should. :-( I doubled checked it this time...
Mike
On Tue, 2006-01-31 at 15:32 -0500, Michael H. Warfield wrote:
On Tue, 2006-01-31 at 23:47 +1030, Tim wrote:
> On Mon, 2006-01-30 at 23:36 -0600, Arthur Pemberton wrote:
> > 1) Can I do both SMIME and PGP in my emails?
> I wouldn't think so. A signature is added to a message as confirmation
> that the message hasn't been tampered with, therefore its based on the
> message contents.
> Conjecture, because adding a signature adds to the contents: If you
> were to add one then the other, the first signature would try to
> proclaim the message to be okay. The second signature added would try
> to proclaim the message with the first signature, in combination, to be
> okay. But adding the second signature changed the message, so anyone
> trying only to use the first signature (because that's all that their
> client supported) would see the message had been changed (by the second
> signature).
This message should be signed by both S/MIME and PGP, so, yes, it's
"possible". In this case, the signatures do nest in a nested multipart
MIME hierarchy. The message body is encoded quoted-printable in one
MIME part. The encoded part is then signed and the signature is in
another MIME part. That assemblage is nested in another MIME part which
is then S/MIME signed and that forms another MIME part.
Message ----
Mime S ----
Mime P ----
Body
Mime P ----
GPG signature on Body
Mime P ----
Mime S ----
S/Mime Signature on Mime P
Mime S ----
Message ----
Now, why anyone would want to do this, I don't know. But it obviously
is possible and Evolution will, obviously, do it. In theory, this
should work. No guarantees about any and all clients being able to read
and verify it, however. Evolution certainly handles it. I've seen
enough compatibility problems between varying clients just withing pure
PGP/GPG and within pure S/MIME to have any expectations here.
My S/MIME certificate is signed by the CACert.org, <www.cacert.org>;,
root certificate. Maybe we'll see who can verify either with what...
Mike
--
fedora-list mailing list
fedora-list(a)redhat.com
To unsubscribe: https://www.redhat.com/mailman/listinfo/fedora-list
--
Michael H. Warfield (AI4NB) | (770) 985-6132 | mhw(a)WittsEnd.com
/\/\|=mhw=|\/\/ | (678) 463-0932 | http://www.wittsend.com/mhw/
NIC whois: MHW9 | An optimist believes we live in the best of all
PGP Key: 0xDF1DD471 | possible worlds. A pessimist is sure of it!
2:55 p.m.
This did not sign properly
I got a message : gpg command line and output:,C:\\gnupg\\gpg.exe
--charset utf8 --batch --no-tty --status-fd 2 --verify,gpg: CRC error;
c8aba6 - dc3c8a,gpg: quoted printable character in armor - probably a
buggy MTA has been used
Michael H. Warfield wrote:
I guess it would have helped if I had actually flipped the S/MIME
bit
BEFORE hitting send. The previous message did not have the S/MIME
signature. This one should. :-( I doubled checked it this time...
Mike
On Tue, 2006-01-31 at 15:32 -0500, Michael H. Warfield wrote:
>On Tue, 2006-01-31 at 23:47 +1030, Tim wrote:
>
>>On Mon, 2006-01-30 at 23:36 -0600, Arthur Pemberton wrote:
>>
>>>1) Can I do both SMIME and PGP in my emails?
>
>>I wouldn't think so. A signature is added to a message as confirmation
>>that the message hasn't been tampered with, therefore its based on the
>>message contents.
>
>>Conjecture, because adding a signature adds to the contents: If you
>>were to add one then the other, the first signature would try to
>>proclaim the message to be okay. The second signature added would try
>>to proclaim the message with the first signature, in combination, to be
>>okay. But adding the second signature changed the message, so anyone
>>trying only to use the first signature (because that's all that their
>>client supported) would see the message had been changed (by the second
>>signature).
>
> This message should be signed by both S/MIME and PGP, so, yes, it's
>"possible". In this case, the signatures do nest in a nested multipart
>MIME hierarchy. The message body is encoded quoted-printable in one
>MIME part. The encoded part is then signed and the signature is in
>another MIME part. That assemblage is nested in another MIME part which
>is then S/MIME signed and that forms another MIME part.
>
> Message ----
> Mime S ----
> Mime P ----
> Body
> Mime P ----
> GPG signature on Body
> Mime P ----
> Mime S ----
> S/Mime Signature on Mime P
> Mime S ----
> Message ----
>
> Now, why anyone would want to do this, I don't know. But it obviously
>is possible and Evolution will, obviously, do it. In theory, this
>should work. No guarantees about any and all clients being able to read
>and verify it, however. Evolution certainly handles it. I've seen
>enough compatibility problems between varying clients just withing pure
>PGP/GPG and within pure S/MIME to have any expectations here.
>
> My S/MIME certificate is signed by the CACert.org, <www.cacert.org>;,
>root certificate. Maybe we'll see who can verify either with what...
>
> Mike
>--
>fedora-list mailing list
>fedora-list(a)redhat.com
>To unsubscribe: https://www.redhat.com/mailman/listinfo/fedora-list
>
--
Michael Yep
Development / Technical Operations
RemoteLink, Inc.
(630) 983-0072 x164
GPG Public Key
http://pgpkeys.mit.edu:11371/pks/lookup?op=get&search=0x126439D9
3:12 p.m.
On Tue, 2006-01-31 at 14:55 -0600, Michael Yep wrote:
This did not sign properly
I got a message : gpg command line and output:,C:\\gnupg\\gpg.exe
--charset utf8 --batch --no-tty --status-fd 2 --verify,gpg: CRC error;
c8aba6 - dc3c8a,gpg: quoted printable character in armor - probably a
buggy MTA has been used
Hmmm... What MUA where you using?
This looks to be a "Content-Transfer-Encoding" issue. If it's not
nested the GPG signature has no MIME "Content-Transfer-Encoding". If
it's nested within an S/MIME signed wrapping, it's been set to and
encoded "Content-Transfer-Encoding: quoted-printable". The encoding is
correct but your MUA failed to unencode it before trying to verify it.
So GPG complains that it ran into a quoted-printable escape, which it
did (but it's certainly not the MTA's fault here). So the question is,
did Evolution make an error when it encoded the GPG signature
quoted-printable or did the receiving MUA make the error when it failed
to honor it. This is exactly the kind of compatibility errors one might
expect.
Michael H. Warfield wrote:
> I guess it would have helped if I had actually flipped the S/MIME bit
> BEFORE hitting send. The previous message did not have the S/MIME
> signature. This one should. :-( I doubled checked it this time...
>
> Mike
>
> On Tue, 2006-01-31 at 15:32 -0500, Michael H. Warfield wrote:
>
>>On Tue, 2006-01-31 at 23:47 +1030, Tim wrote:
>>
>>>On Mon, 2006-01-30 at 23:36 -0600, Arthur Pemberton wrote:
>>>
>>>>1) Can I do both SMIME and PGP in my emails?
>>
>>>I wouldn't think so. A signature is added to a message as confirmation
>>>that the message hasn't been tampered with, therefore its based on the
>>>message contents.
>>
>>>Conjecture, because adding a signature adds to the contents: If you
>>>were to add one then the other, the first signature would try to
>>>proclaim the message to be okay. The second signature added would try
>>>to proclaim the message with the first signature, in combination, to be
>>>okay. But adding the second signature changed the message, so anyone
>>>trying only to use the first signature (because that's all that their
>>>client supported) would see the message had been changed (by the second
>>>signature).
>>
>> This message should be signed by both S/MIME and PGP, so, yes, it's
>>"possible". In this case, the signatures do nest in a nested
multipart
>>MIME hierarchy. The message body is encoded quoted-printable in one
>>MIME part. The encoded part is then signed and the signature is in
>>another MIME part. That assemblage is nested in another MIME part which
>>is then S/MIME signed and that forms another MIME part.
>>
>> Message ----
>> Mime S ----
>> Mime P ----
>> Body
>> Mime P ----
>> GPG signature on Body
>> Mime P ----
>> Mime S ----
>> S/Mime Signature on Mime P
>> Mime S ----
>> Message ----
>>
>> Now, why anyone would want to do this, I don't know. But it obviously
>>is possible and Evolution will, obviously, do it. In theory, this
>>should work. No guarantees about any and all clients being able to read
>>and verify it, however. Evolution certainly handles it. I've seen
>>enough compatibility problems between varying clients just withing pure
>>PGP/GPG and within pure S/MIME to have any expectations here.
>>
>> My S/MIME certificate is signed by the CACert.org, <www.cacert.org>;,
>>root certificate. Maybe we'll see who can verify either with what...
>>
>> Mike
>>--
>>fedora-list mailing list
>>fedora-list(a)redhat.com
>>To unsubscribe: https://www.redhat.com/mailman/listinfo/fedora-list
>>
--
Michael Yep
Development / Technical Operations
RemoteLink, Inc.
(630) 983-0072 x164
GPG Public Key
http://pgpkeys.mit.edu:11371/pks/lookup?op=get&search=0x126439D9
--
Michael H. Warfield (AI4NB) | (770) 985-6132 | mhw(a)WittsEnd.com
/\/\|=mhw=|\/\/ | (678) 463-0932 | http://www.wittsend.com/mhw/
NIC whois: MHW9 | An optimist believes we live in the best of all
PGP Key: 0xDF1DD471 | possible worlds. A pessimist is sure of it!
2:58 p.m.
On Tuesday 31 Jan 2006 20:43, Michael H. Warfield wrote:
Message was signed with key 0x1E3CC7593760ABB4.
Status: Bad signature.
Message was signed by 73517.757(a)compuserve.com (Key ID:
0xE1C94B46DF1DD471). The signature is valid, but the key's validity
is unknown.
Anne
--
Registered Linux User No.293302 (http://counter.li.org/)
4:45 p.m.
Michael H. Warfield wrote:
I guess it would have helped if I had actually flipped the S/MIME
bit
BEFORE hitting send. The previous message did not have the S/MIME
signature. This one should. :-( I doubled checked it this time...
Is anyone using Thunderbird 1.5+? 1.0.7 doesn't indicate success or
failure validating the signature on that message. I think there was a
similar issue when Courier's webmail first got signature support.
Thunderbird wasn't able to parse its (apparently valid) messages, either.
3:57 p.m.
On 1/30/06, Gordon Messmer <yinyang(a)eburg.com> wrote:
Arthur Pemberton wrote:
>
> Could someone briefly fill me in on the if, why and how of email
> signing (I do not mean signatures). I am sure I can google the how,
> but I would like opions and experiences.
OK, I presume that you mean cryptographic signing. Message signing can
be done with either SMIME or PGP. Both accomplish the same thing, and
operate in virtually the same way.
Why sign? It's all about trust. If you reliably sign your messages,
the people with whom you exchange messages can configure their mail
client to trust the fingerprint of your certificate (or, they may trust
someone who signed your certificate). They can trust that a message
with your name on it, which has a valid signature, was written by you
and has not been tampered with. They should also learn not to trust
messages that have your name on it, but no signature.
Which method you choose probably will be influenced most by who,
exactly, you want to be able to verify your signatures. SMIME uses, in
large part, the same infrastructure that is already in virtually every
mail client to support SSL connections. That's one of the reasons that
SMIME is supported by nearly every major mail client available, out of
the box. PGP does pretty much exactly the same thing, but requires an
entirely separate infrastructure. I'm not aware of any major client
that supports PGP by default; they require plugins, mostly. That gives
SMIME a significant advantage if you want to sign messages, and have
that information be useful to a wide audience.
What is the difference between "S/MIME" and "S/MIME opaque" ?
--
fedora-list mailing list
fedora-list(a)redhat.com
To unsubscribe: https://www.redhat.com/mailman/listinfo/fedora-list
--
As a boy I jumped through Windows, as a man I play with Penguins.
4:39 p.m.
Arthur Pemberton wrote:
What is the difference between "S/MIME" and "S/MIME opaque" ?
Although I haven't used opaque signing, I've seen it explained thusly:
“Opaque” signed messages are encoded such that the recipient requires an
S/MIME-enabled e-mail client to automatically read the message.
I take it to mean that an opaque message is encoded (not encrypted) so
that it's not plain text, but can be decoded by anyone with an
SMIME-enabled client.
4:18 p.m.
On 1/30/06, Gordon Messmer <yinyang(a)eburg.com> wrote:
Arthur Pemberton wrote:
>
> Could someone briefly fill me in on the if, why and how of email
> signing (I do not mean signatures). I am sure I can google the how,
> but I would like opions and experiences.
OK, I presume that you mean cryptographic signing. Message signing can
be done with either SMIME or PGP. Both accomplish the same thing, and
operate in virtually the same way.
Why sign? It's all about trust. If you reliably sign your messages,
the people with whom you exchange messages can configure their mail
client to trust the fingerprint of your certificate (or, they may trust
someone who signed your certificate). They can trust that a message
with your name on it, which has a valid signature, was written by you
and has not been tampered with. They should also learn not to trust
messages that have your name on it, but no signature.
Which method you choose probably will be influenced most by who,
exactly, you want to be able to verify your signatures. SMIME uses, in
large part, the same infrastructure that is already in virtually every
mail client to support SSL connections. That's one of the reasons that
SMIME is supported by nearly every major mail client available, out of
the box. PGP does pretty much exactly the same thing, but requires an
entirely separate infrastructure. I'm not aware of any major client
that supports PGP by default; they require plugins, mostly. That gives
SMIME a significant advantage if you want to sign messages, and have
that information be useful to a wide audience.
A follow up question which I haven't yet understood from Googling, what
happens when my GPG signed email gets sent to my prof. who used Outlook?
--
As a boy I jumped through Windows, as a man I play with Penguins.
4:41 p.m.
Arthur Pemberton wrote:
A follow up question which I haven't yet understood from Googling, what
happens when my GPG signed email gets sent to my prof. who used Outlook?
He'll see a message, either with an inline PGP signature, or an
attachment (depending on your client configuration), but won't have any
indication that the signature is valid. It's just some extra data in
the message. He'd have to install a PGP plugin for Outlook, and get
your key's fingerprint from you in order to validate signed messages.
This is why I advocate SMIME: more people already have the software to
validate your messages.
4:52 p.m.
On 1/31/06, Gordon Messmer <yinyang(a)eburg.com> wrote:
Arthur Pemberton wrote:
>
> A follow up question which I haven't yet understood from Googling, what
> happens when my GPG signed email gets sent to my prof. who used Outlook?
He'll see a message, either with an inline PGP signature, or an
attachment (depending on your client configuration), but won't have any
indication that the signature is valid. It's just some extra data in
the message. He'd have to install a PGP plugin for Outlook, and get
your key's fingerprint from you in order to validate signed messages.
This is why I advocate SMIME: more people already have the software to
validate your messages.
Ok. What is your understanding and response to this article I got to from
wikipedia.org: http://weblog.infoworld.com/udell/2004/03/23.html#a952
--
As a boy I jumped through Windows, as a man I play with Penguins.
5:40 p.m.
Arthur Pemberton wrote:
Ok. What is your understanding and response to this article I got to
from wikipedia.org <http://wikipedia.org>;:
http://weblog.infoworld.com/udell/2004/03/23.html#a952
I've seen the article... It reflects real and valid criticisms of both
Microsoft's implementation of SMIME in Outlook (not displaying the
actual email address), and with Thawte's freemail certificate service.
I believe that Thawte has improved that service, so that they'll only
grant you a certificate if you prove that you can receive email sent to
the address that you indicate.
8:19 p.m.
On 1/31/06, Gordon Messmer <yinyang(a)eburg.com> wrote:
Arthur Pemberton wrote:
>
> Ok. What is your understanding and response to this article I got to
> from wikipedia.org <http://wikipedia.org>;:
> http://weblog.infoworld.com/udell/2004/03/23.html#a952
I've seen the article... It reflects real and valid criticisms of both
Microsoft's implementation of SMIME in Outlook (not displaying the
actual email address), and with Thawte's freemail certificate service.
I believe that Thawte has improved that service, so that they'll only
grant you a certificate if you prove that you can receive email sent to
the address that you indicate.
Ok fair enough. Thank you. I think I will start googling for info on how to
S/MIME. BTW, any idea what packages are needed to enable it in KMail?
--
fedora-list mailing list
fedora-list(a)redhat.com
To unsubscribe: https://www.redhat.com/mailman/listinfo/fedora-list
--
As a boy I jumped through Windows, as a man I play with Penguins.
11:45 p.m.
Arthur Pemberton wrote:
Ok fair enough. Thank you. I think I will start googling for info on
how to S/MIME. BTW, any idea what packages are needed to enable it in
KMail?
Good question. I've got kdepim-3.4.2-0.fc4.3 installed, and KMail
reports that "GPGME" was compiled without S/MIME support. I don't see
any ancillary packages that might provide such support as a module.
If the latest version lacks such support, perhaps you could file an RFE
bug in bugzilla.
10:46 a.m.
At 9:45 PM -0800 1/31/06, Gordon Messmer wrote:
Arthur Pemberton wrote:
>
> Ok fair enough. Thank you. I think I will start googling for info on
> how to S/MIME. BTW, any idea what packages are needed to enable it in
> KMail?
Good question. I've got kdepim-3.4.2-0.fc4.3 installed, and KMail
reports that "GPGME" was compiled without S/MIME support. I don't see
any ancillary packages that might provide such support as a module.
If the latest version lacks such support, perhaps you could file an RFE
bug in bugzilla.
From yum'ing around on FC3, it may be that you also need gnupg2,
which says
that it can be installed along with a gnupg 1.4.
____________________________________________________________________
TonyN.:' <mailto:tonynelson@georgeanelson.com>
' <http://www.georgeanelson.com/>
6:44 a.m.
On Tue, 2006-01-31 at 14:41 -0800, Gordon Messmer wrote:
He'll see a message, either with an inline PGP signature, or an
attachment (depending on your client configuration), but won't have
any indication that the signature is valid. It's just some extra data
in the message. He'd have to install a PGP plugin for Outlook, and
get your key's fingerprint from you in order to validate signed
messages.
This is why I advocate SMIME: more people already have the software to
validate your messages.
I think both systems have big problems:
Both have quite a bit of complexity, both in getting them set up, and
understanding that you should really pay attention to "invalid"
warnings.
Getting a certificate to prove who you are can be difficult. And I have
concerns that some don't really do checks that would prove you are who
you say you are. And even with a cert, it may just prove that the same
computer was used, but not prove whoever was typing on it.
Really verifying self-made PGP certificates is difficult. It seems more
suited to trusting friends you've met in person (i.e. that you're really
getting mail from that guy you met yesterday, not someone sitting next
to him who heard you say your e-mail address out loud), but you don't
know who they really are unless you checked some other form of ID out
when you met them. And again, a PGP-signed mail may just prove that you
got an e-mail from their computer, not prove who it was typing on their
keyboard.
--
Don't send private replies to my address, the mailbox is ignored.
I read messages from the public lists.
6657
days inactive
6658
days old
23 comments
7 participants
participants (7)
-
Anne Wilson -
Arthur Pemberton -
Gordon Messmer -
Michael H. Warfield -
Michael Yep -
Tim -
Tony Nelson