Re: PGP etiquette.
On Sat, Oct 14, 2006 at 11:15:59AM -0600, Bob Proulx wrote:
> William Yardley wrote:
> > I'll just add that PGP/MIME certificates cause problems for some
> > folks,
> What mailers, even those from MS, still have problems with MIME? A
> couple of years ago I surveyed a bunch of friends who use various
> versions of MS-Outlook and all of them handled MIME fine. I figure
> that is the lowest common denominator with any other mailer having
> better features. :-)
MIME, or PGP/MIME? I wasn't saying that any common mailers didn't
support MIME - just that PGP/MIME itself isn't well supported, and the
resulting attachments cause (at best) confusion for folks whose mailers
can't understand them. I've even seen some people think that they're a
virus.
Though actually, I think it's the "traditional" MIME messages sent by
oldish versions of mutt (with the mime type of the signed part set to
application/pgp, or whatever it was) that really caused problems w/
Outhouse.
> > Signed messages can cause problems for archives (especially signed
> > messages w/ archiving software that doesn't grok MIME).
> Same question. What archives do not handle MIME?
Older versions of monarc, IIRC (whatever archived messages for Mailman).
I think most stuff that's currently around does, but I see messy
mail archives that are still around all the time.
And verifying a PGP/MIME signed message from an archive is a pain at
best.
> I feel compelled to call lack of MIME support FUD unless there is some
> data to back it up. Virtually every MS-Outlook user sends messages as
> MIME because the typical setting is to send both an text html and a
> text plain attachment for every message. I think many of the free web
> mail sites do this as well. I have not heard of any MIME related
> problems in quite a number of years. I don't think claiming that
> people should not use signed messages because of MIME issues is
> valid.
I said that I didn't send PGP/MIME messages to people unless I know
their mailer can grok PGP/MIME. I don't have anything against MIME
itself.
> > I have seen the argument that signing every message makes it easier
> > for people to tell that person XYZ is the same person XYZ who
> > normally posts to the list, whereas if you just sign when you have
> > something important to say, it might be harder for people to know
> > you're the same person.
> It is the identity theft issue. Forged messages. Virus and spam
> email is almost always forged but never signed. If everyone signed
> their email it would be possible to mostly stop forged email. One of
> those, if only, things that we dream about. It is certainly fair to
> argue that there is not now and might not ever be critical mass for
> it. But nothing ventured, nothing gained.
I don't think you'd be able to stop forged email by simply PGP signing
emails, at least with the current key management structure - then
spammers would just start signing their emails - and they'd probably do
a better job of it than non-spammers. Right now, there's nothing
stopping you from creating a (valid) PGP key with my email address as
the UID. So unless you're talking about only accepting mail from people
with known, trusted keys, or using one or more central authorities, I'm
not sure how this is going to fix the problem of forged messages or
forged email addresses.
Given the number of owned / ownable Windows machines out there, a virus
that grabbed the user's passphrase or otherwise gained access to send
via his / her private key, and signed its outgoing messages "from" the
sender could be a huge problem, since they'd appear to be "valid".
Also, part of the problem with PGP is that someone using it has to have
a working understanding of encryption / key management for it to be
effective. It's going to be really hard to have a system that's easy for
users to use, yet hard to fool.
Systems like SPF and DKIM (the second of which does have a PKI
component) have at least a slightly better chance of solving the forging
problem, especially since they're already gaining some critical mass.
For better or worse, looks like DKIM is probably the one that's going to
make it.
> > The biggest problem I have with PGP is that virtually no one I'd
> > actually want to encrypt (and, to a lesser extent, sign) messages to is
> > technical enough to use it properly.
> Sigh. Yes. That is my biggest problem as well. Why does it always
> seem like most of the world is below average? :-)
Well I don't think it's an issue of intelligence, but just that they
don't care, and / or aren't as paranoid.
w