4 ms·

Because its just noise to non-tech people. It's the same reason why email accounts have 2,000 unread inbox messages or 30 notifications at the top of their pho

Because its just noise to non-tech people. It's the same reason why email accounts have 2,000 unread inbox messages or 30 notifications at the top of their phone. You get so used to seeing the notification that you begin to ignore it. In this case, you see a string of non-readable text that makes up some weird "signature" at the bottom. The conclusion? "Oh. The signature is there. It's been authentic every other time I checked. Why wouldn't it be authentic on the 101st check?" Humans are the hardest vector to defend in an attack. Never underestimate the laziness of people - even when a simple solution exists to combat the problem at hand.

pbhjpbhj 11y ago
But shouldn't one's email program handle all that in the background, so you get the equivalent of a browser's padlock icon showing whether authentication has been successful rather than getting the PGP (or whatever). Yes, there will still be ways around people but this seems like it should be a standard and basic part of all email programs now.
- wolfgke 11y ago
  I agree that it would make sense to add this functionality to the core of the email program. But this is a UI problem (i.e. it makes things that have been understood more comfortable), but does not change whether or not you have understood what a signature means.
- noxToken 11y ago
  This is probably the most elegant solution to a PGP signature. > this seems like it should be a standard and basic part of all email programs now I can't speak with authority on this, but it feels like this would be adding overhead to something that doesn't necessarily need it. Email is supposed(!) to be relatively simple. I can think of many cases where you would definitely want to have PKI integrated into your emails, but I can think of just as many cases where it's unnecessary overhead in email clients as a standard. However, I admit that I could be wrong.
GFischer 11y ago
Just the other day there was an article on Kevin Mitnick, this kind of attack is a malicious version of what he used to do ("Social Engineering") https://news.ycombinator.com/item?id=10796950 https://news.ycombinator.com/item?id=10796950 http://henrikwarne.com/2015/12/27/social-engineering-from-kevin-mitnick/ http://henrikwarne.com/2015/12/27/social-engineering-from-ke...

pbhjpbhj 11y ago

But shouldn't one's email program handle all that in the background, so you get the equivalent of a browser's padlock icon showing whether authentication has been successful rather than getting the PGP (or whatever). Yes, there will still be ways around people but this seems like it should be a standard and basic part of all email programs now.

wolfgke 11y ago
I agree that it would make sense to add this functionality to the core of the email program. But this is a UI problem (i.e. it makes things that have been understood more comfortable), but does not change whether or not you have understood what a signature means.
noxToken 11y ago
This is probably the most elegant solution to a PGP signature. > this seems like it should be a standard and basic part of all email programs now I can't speak with authority on this, but it feels like this would be adding overhead to something that doesn't necessarily need it. Email is supposed(!) to be relatively simple. I can think of many cases where you would definitely want to have PKI integrated into your emails, but I can think of just as many cases where it's unnecessary overhead in email clients as a standard. However, I admit that I could be wrong.

GFischer 11y ago

Just the other day there was an article on Kevin Mitnick, this kind of attack is a malicious version of what he used to do ("Social Engineering") https://news.ycombinator.com/item?id=10796950 https://news.ycombinator.com/item?id=10796950 http://henrikwarne.com/2015/12/27/social-engineering-from-kevin-mitnick/ http://henrikwarne.com/2015/12/27/social-engineering-from-ke...