5 ms·

The same reason basically all other email is not authenticated with GPG: it is a usability nightmare. Even many technically apt people find it too much of a hea

by chc 11y ago

The same reason basically all other email is not authenticated with GPG: it is a usability nightmare. Even many technically apt people find it too much of a headache. It has no chance of universal adoption in the C suite, and without that kind of adoption, it can't help to prevent things like this.

pdkl95 11y ago
What is hard about authentication? This was trivial along time ago with mutt and it was still trivial in recent years with thunderbird+enigmail. If your complain is that your favorite email client doesn't support pubkey authentication, complain to the vendor. The only thing that should even be relevant re: usability is the need to occasionally enter a password. This is even minimized with gpg-agent (or similar), which we can assume is something that would be setup by IT anyway along with everything else related to email. > C suite Then educate them about the need. Even better, educate the lawyers about why authorizing large purchases (i.e. the type of scam currently being discussed) without proper authentication is an unacceptable risk. > it can't help to prevent things like this While you cannot fix a stupid CxO, the problem of deciding if a particular email claiming to to be from that CxO authorizing a purchase order is actually from that CxO is easy. Remember, we only need to solve the internal case, where it is easy to setup PKI. I believe there are even several solutions already available[1] for directory services and key management. Run some sort of local directory service and a local CA and a decent email client should make authentically completely transparent for internal emails.
- seagreen 11y ago
  > This was trivial along time ago with mutt Nothing is trivial with mutt, especially not GPG related issues. If it seems easy to you then you're a very skilled outlier. Sincerely, A Mutt user for three or four years
  - pdkl95 11y ago
    Using mutt is pretty easy once you've set it up. Configuring it to use pgp (way before gpg existed) was a bit of a challenge years ago. I certainly wouldn't recommend it to most people today. At the time, most email programs required some technical knowledge to setup, so the difficulty is relative. My point is that these solutions have existed for a long time, even in what many would now call the "earlier" years of email. Even decades ago it was common to have the setup within and organization handled by IT. // mutt still wins over more "modern" email software in a lot of ways
    - dguaraglia 11y ago
      Yeah, it does, but tell that to the 99.99% of people who don't even know what a "terminal" is. I feel this kind of argument is the worst unintentional straw man: "we don't need to fix this problem, because there's a perfectly fine, super obscure solution". We need to fix this problem for the accountants, not the IT guys.
    - seagreen 11y ago
      Sorry if my comment seemed snappy. I actually am a current mutt user -- so I know its advantages. It's awesome when it is set up. I think you're getting downvoted in this thread because while you're trying to make a distinction between difficulty of setup and difficulty of use, the waters have already been poisoned by so many people that (wrongly) say "FOSS tools like mutt are easy to set up" that people are lumping you in with that group, even though that's not what you're saying.
- PhasmaFelis 11y ago
  "If it's easy for me, it should be easy for anyone" is the scourge of interface design.
  - pdkl95 11y ago
    What interface design? The only thing that should be visible to most people is some sort of alert that explains that an email was blocked because the signature was missing or invalid. Everything else should be setup by IT. The MUA should find (and verify) the key in the directory service and automatically handle the signing/signature-verification. You might need UI to use signatures with external email, but that is a separate problem.
- DontGiveTwoFlux 11y ago
  I one time was interested in setting up a command line email client - mutt with procmail or something along those lines. Three hours later I hadn't gotten it working and gave up. Good for you, but these things are not trivial.
  - pdkl95 11y ago
    If you had finished setting up mutt, you might have noticed that authentication is handled for you when you use mutt. This is about internal emails, where most people will have someone else setup their email. I'm not even recommending it mutt (or any other specific MUA) as a solution today. These are simply examples that demonstrate how simple authentication can be. If you want me to believe that internal pubkey authentication (probably based on a directory service provided by the IT department), then you are going to have to explain how most orginizations are able to handle stuff like internal addresses books, which are also provided by directory services (LDAP, Active Directory, etc). An address book requires far more UI than authentication, yet it is a common feature.

by chc 11y ago

pdkl95 11y ago

What is hard about authentication? This was trivial along time ago with mutt and it was still trivial in recent years with thunderbird+enigmail. If your complain is that your favorite email client doesn't support pubkey authentication, complain to the vendor. The only thing that should even be relevant re: usability is the need to occasionally enter a password. This is even minimized with gpg-agent (or similar), which we can assume is something that would be setup by IT anyway along with everything else related to email. > C suite Then educate them about the need. Even better, educate the lawyers about why authorizing large purchases (i.e. the type of scam currently being discussed) without proper authentication is an unacceptable risk. > it can't help to prevent things like this While you cannot fix a stupid CxO, the problem of deciding if a particular email claiming to to be from that CxO authorizing a purchase order is actually from that CxO is easy. Remember, we only need to solve the internal case, where it is easy to setup PKI. I believe there are even several solutions already available[1] for directory services and key management. Run some sort of local directory service and a local CA and a decent email client should make authentically completely transparent for internal emails.

seagreen 11y ago
> This was trivial along time ago with mutt Nothing is trivial with mutt, especially not GPG related issues. If it seems easy to you then you're a very skilled outlier. Sincerely, A Mutt user for three or four years
- pdkl95 11y ago
  Using mutt is pretty easy once you've set it up. Configuring it to use pgp (way before gpg existed) was a bit of a challenge years ago. I certainly wouldn't recommend it to most people today. At the time, most email programs required some technical knowledge to setup, so the difficulty is relative. My point is that these solutions have existed for a long time, even in what many would now call the "earlier" years of email. Even decades ago it was common to have the setup within and organization handled by IT. // mutt still wins over more "modern" email software in a lot of ways
  - dguaraglia 11y ago
    Yeah, it does, but tell that to the 99.99% of people who don't even know what a "terminal" is. I feel this kind of argument is the worst unintentional straw man: "we don't need to fix this problem, because there's a perfectly fine, super obscure solution". We need to fix this problem for the accountants, not the IT guys.
  - seagreen 11y ago
    Sorry if my comment seemed snappy. I actually am a current mutt user -- so I know its advantages. It's awesome when it is set up. I think you're getting downvoted in this thread because while you're trying to make a distinction between difficulty of setup and difficulty of use, the waters have already been poisoned by so many people that (wrongly) say "FOSS tools like mutt are easy to set up" that people are lumping you in with that group, even though that's not what you're saying.
PhasmaFelis 11y ago
"If it's easy for me, it should be easy for anyone" is the scourge of interface design.
- pdkl95 11y ago
  What interface design? The only thing that should be visible to most people is some sort of alert that explains that an email was blocked because the signature was missing or invalid. Everything else should be setup by IT. The MUA should find (and verify) the key in the directory service and automatically handle the signing/signature-verification. You might need UI to use signatures with external email, but that is a separate problem.
DontGiveTwoFlux 11y ago
I one time was interested in setting up a command line email client - mutt with procmail or something along those lines. Three hours later I hadn't gotten it working and gave up. Good for you, but these things are not trivial.
- pdkl95 11y ago
  If you had finished setting up mutt, you might have noticed that authentication is handled for you when you use mutt. This is about internal emails, where most people will have someone else setup their email. I'm not even recommending it mutt (or any other specific MUA) as a solution today. These are simply examples that demonstrate how simple authentication can be. If you want me to believe that internal pubkey authentication (probably based on a directory service provided by the IT department), then you are going to have to explain how most orginizations are able to handle stuff like internal addresses books, which are also provided by directory services (LDAP, Active Directory, etc). An address book requires far more UI than authentication, yet it is a common feature.