Re: getross - email privacy /security of system

On Sun, 5 Nov 2006, Ryan Barrett wrote:

> wow, is that true? i'd meant that they'd need to include encryption, PGP
> style, in their base installs. outlook and thunderbird already do that?!? or
> do you just mean there are plugins available?

At least a few of these products have some flavor of S/MIME or some such 
on board. All based on some flavor of hierarchical X.509 certificates; 
not PGP-style peer certificates.

Trying to get it to work is about as much fun a getting a root canal 
treatment. For example, getting one combination of Outlook/Exchange to 
talk to another version of Outlook/Exchange can be a challenge; I've 
seen instances where the receiving Exchange stripped the cryptographic 
signature; I've seen other instances of the message being eaten 
altogether. The user was completely in the dark in both cases, and 
tracing the logs I could see it happening but I'm in the dark as to what 
caused it to this day.

Finding a certificate authority with clean hands is another challenge. 
Would you trust one who takes $35 out of your credit card, then claims 
the transaction fails, holds you ransom until you pay another $35, and 
subsequently runs you in circles when you try to get your money back?

PGP is great. Unfortunately, IMHO the old PGP was greater than the 
subsequent PGP and when I had to maintain multiple copies of PGP with 
radically different command lines just to decrypt older stuff I sort of 
gave up. The teething pains of GPG are less pronounced but I still 
haven't come round to switching (which is a good thing, because my usage 
was in fact affected by the barn-door sized bug that was fixed 
recently, if I understood the announcement correctly).

Crypto is not for the faint of heart. And end-users, by and large, have 
more trust in the authorities than they have in technology, and much as 
I distrust some authorities, the above examples do point out that the 
technosceptical users do have an point that's rooted in fact.

Cheers,

 				-- Bert
_______________________________________________
Pine-info mailing list
[email protected]
http://mailman1.u.washington.edu/mailman/listinfo/pine-info