4 ms·

All this talk about email forgery... so why isn't all all of this email authenticated with GPG? This type of authentication is a solved problem. Yes, in the ge

by pdkl95 11y ago

All this talk about email forgery... so why isn't all all of this email authenticated with GPG? This type of authentication is a solved problem. Yes, in the general case PKI is a broken and web-of-trust is hard to bootstrap, but protection against scams like this don't need to solve the general case. Distributing keys internally isn't hard. Even some communication external to the organization should be easily authenticated with pubkey crypto - it's not more difficult than the business contracts everybody already uses regularly. Why is everybody trying to solve this with email headers or fallible human judgment?

leephillips 11y ago
The usual: it's a social problem, not a technological problem. Cryptography is the solution to almost everything that people complain about with email, but, there you go.
chc 11y ago
The same reason basically all other email is not authenticated with GPG: it is a usability nightmare. Even many technically apt people find it too much of a headache. It has no chance of universal adoption in the C suite, and without that kind of adoption, it can't help to prevent things like this.
- pdkl95 11y ago
  What is hard about authentication? This was trivial along time ago with mutt and it was still trivial in recent years with thunderbird+enigmail. If your complain is that your favorite email client doesn't support pubkey authentication, complain to the vendor. The only thing that should even be relevant re: usability is the need to occasionally enter a password. This is even minimized with gpg-agent (or similar), which we can assume is something that would be setup by IT anyway along with everything else related to email. > C suite Then educate them about the need. Even better, educate the lawyers about why authorizing large purchases (i.e. the type of scam currently being discussed) without proper authentication is an unacceptable risk. > it can't help to prevent things like this While you cannot fix a stupid CxO, the problem of deciding if a particular email claiming to to be from that CxO authorizing a purchase order is actually from that CxO is easy. Remember, we only need to solve the internal case, where it is easy to setup PKI. I believe there are even several solutions already available[1] for directory services and key management. Run some sort of local directory service and a local CA and a decent email client should make authentically completely transparent for internal emails.
  - seagreen 11y ago
    > This was trivial along time ago with mutt Nothing is trivial with mutt, especially not GPG related issues. If it seems easy to you then you're a very skilled outlier. Sincerely, A Mutt user for three or four years
    - pdkl95 11y ago
      Using mutt is pretty easy once you've set it up. Configuring it to use pgp (way before gpg existed) was a bit of a challenge years ago. I certainly wouldn't recommend it to most people today. At the time, most email programs required some technical knowledge to setup, so the difficulty is relative. My point is that these solutions have existed for a long time, even in what many would now call the "earlier" years of email. Even decades ago it was common to have the setup within and organization handled by IT. // mutt still wins over more "modern" email software in a lot of ways
      - dguaraglia 11y ago
        Yeah, it does, but tell that to the 99.99% of people who don't even know what a "terminal" is. I feel this kind of argument is the worst unintentional straw man: "we don't need to fix this problem, because there's a perfectly fine, super obscure solution". We need to fix this problem for the accountants, not the IT guys.
      - seagreen 11y ago
        Sorry if my comment seemed snappy. I actually am a current mutt user -- so I know its advantages. It's awesome when it is set up. I think you're getting downvoted in this thread because while you're trying to make a distinction between difficulty of setup and difficulty of use, the waters have already been poisoned by so many people that (wrongly) say "FOSS tools like mutt are easy to set up" that people are lumping you in with that group, even though that's not what you're saying.
  - PhasmaFelis 11y ago
    "If it's easy for me, it should be easy for anyone" is the scourge of interface design.
eli 11y ago
So do you sign your outgoing mail with GPG? IF not, why not?
- pdkl95 11y ago
  Yes, though this isn't relevant for this type of scam, which is about authenticating internal email.
- Joeboy 11y ago
  I just stopped doing this, because the only tangible impact was people asking why my emails had weird incomprehensible junk in them. Admittedly this usually took the form of mild derision rather than outright hostility.

by pdkl95 11y ago

leephillips 11y ago

The usual: it's a social problem, not a technological problem. Cryptography is the solution to almost everything that people complain about with email, but, there you go.

chc 11y ago

The same reason basically all other email is not authenticated with GPG: it is a usability nightmare. Even many technically apt people find it too much of a headache. It has no chance of universal adoption in the C suite, and without that kind of adoption, it can't help to prevent things like this.

pdkl95 11y ago
What is hard about authentication? This was trivial along time ago with mutt and it was still trivial in recent years with thunderbird+enigmail. If your complain is that your favorite email client doesn't support pubkey authentication, complain to the vendor. The only thing that should even be relevant re: usability is the need to occasionally enter a password. This is even minimized with gpg-agent (or similar), which we can assume is something that would be setup by IT anyway along with everything else related to email. > C suite Then educate them about the need. Even better, educate the lawyers about why authorizing large purchases (i.e. the type of scam currently being discussed) without proper authentication is an unacceptable risk. > it can't help to prevent things like this While you cannot fix a stupid CxO, the problem of deciding if a particular email claiming to to be from that CxO authorizing a purchase order is actually from that CxO is easy. Remember, we only need to solve the internal case, where it is easy to setup PKI. I believe there are even several solutions already available[1] for directory services and key management. Run some sort of local directory service and a local CA and a decent email client should make authentically completely transparent for internal emails.
- seagreen 11y ago
  > This was trivial along time ago with mutt Nothing is trivial with mutt, especially not GPG related issues. If it seems easy to you then you're a very skilled outlier. Sincerely, A Mutt user for three or four years
  - pdkl95 11y ago
    Using mutt is pretty easy once you've set it up. Configuring it to use pgp (way before gpg existed) was a bit of a challenge years ago. I certainly wouldn't recommend it to most people today. At the time, most email programs required some technical knowledge to setup, so the difficulty is relative. My point is that these solutions have existed for a long time, even in what many would now call the "earlier" years of email. Even decades ago it was common to have the setup within and organization handled by IT. // mutt still wins over more "modern" email software in a lot of ways
    - dguaraglia 11y ago
      Yeah, it does, but tell that to the 99.99% of people who don't even know what a "terminal" is. I feel this kind of argument is the worst unintentional straw man: "we don't need to fix this problem, because there's a perfectly fine, super obscure solution". We need to fix this problem for the accountants, not the IT guys.
    - seagreen 11y ago
      Sorry if my comment seemed snappy. I actually am a current mutt user -- so I know its advantages. It's awesome when it is set up. I think you're getting downvoted in this thread because while you're trying to make a distinction between difficulty of setup and difficulty of use, the waters have already been poisoned by so many people that (wrongly) say "FOSS tools like mutt are easy to set up" that people are lumping you in with that group, even though that's not what you're saying.
- PhasmaFelis 11y ago
  "If it's easy for me, it should be easy for anyone" is the scourge of interface design.

eli 11y ago

So do you sign your outgoing mail with GPG? IF not, why not?

pdkl95 11y ago
Yes, though this isn't relevant for this type of scam, which is about authenticating internal email.
Joeboy 11y ago
I just stopped doing this, because the only tangible impact was people asking why my emails had weird incomprehensible junk in them. Admittedly this usually took the form of mild derision rather than outright hostility.