3 ms·

I wish someone would do this for S/MIME. S/MIME has native support in many MUAs, even Mail.app on iOS. http://smime.io/ http://smime.io/ https://github.com/rou

by rmoriz 10y ago

I wish someone would do this for S/MIME. S/MIME has native support in many MUAs, even Mail.app on iOS. http://smime.io/ http://smime.io/ https://github.com/roundcube/roundcubemail/issues/4977 https://github.com/roundcube/roundcubemail/issues/4977

lmm 10y ago
Can you get a free S/MIME certificate? Even if you could, S/MIME leaves you dependent on CA infrastructure that's often state-controlled.
- elgaton 10y ago
  StartSSL [1] and COMODO [2] still offer them (of course, there's still the CA compromise issue you mentioned). Keep in mind, however, that a hierarchical, centralized trust model can still be useful (e.g. in medium-to-large organizations, where having an internal CA and delegating identity verification to a few knowledgeable employees is more practical than having everyone build a web of trust). [1] https://www.startssl.com/ https://www.startssl.com/ [2] https://www.comodo.com/home/email-security/free-email-certificate.php https://www.comodo.com/home/email-security/free-email-certif...
  - lmm 10y ago
    > Keep in mind, however, that a hierarchical, centralized trust model can still be useful (e.g. in medium-to-large organizations, where having an internal CA and delegating identity verification to a few knowledgeable employees is more practical than having everyone build a web of trust). Sure, but it's easy to build that kind of model on top of OpenPGP (just have an organizational signing key and tell everyone to trust that), whereas it's almost impossible to build a CA-independent model on top of SSL.
deleted 10y ago
[deleted]
noinsight 10y ago
I'm waiting for Let's Encrypt to start offering S/MIME certificates.
grinich 10y ago
Is S/MIME really that widely used? It seems to be sort of widely deployed, but not necessarily understood or required by users in secure environments.
- rmoriz 10y ago
  yes. And it's already supported in many clients without plugins, many companies just sign their mails. You probably don't even notice that if you don't know where to look. It's very unobtrusive compared to gpg.
- spilk 10y ago
  It's widely used in US government/military. DISA runs key escrow for users' encryption keys that are carried around on smartcards.

by rmoriz 10y ago

lmm 10y ago

Can you get a free S/MIME certificate? Even if you could, S/MIME leaves you dependent on CA infrastructure that's often state-controlled.

elgaton 10y ago
StartSSL [1] and COMODO [2] still offer them (of course, there's still the CA compromise issue you mentioned). Keep in mind, however, that a hierarchical, centralized trust model can still be useful (e.g. in medium-to-large organizations, where having an internal CA and delegating identity verification to a few knowledgeable employees is more practical than having everyone build a web of trust). [1] https://www.startssl.com/ https://www.startssl.com/ [2] https://www.comodo.com/home/email-security/free-email-certificate.php https://www.comodo.com/home/email-security/free-email-certif...
- lmm 10y ago
  > Keep in mind, however, that a hierarchical, centralized trust model can still be useful (e.g. in medium-to-large organizations, where having an internal CA and delegating identity verification to a few knowledgeable employees is more practical than having everyone build a web of trust). Sure, but it's easy to build that kind of model on top of OpenPGP (just have an organizational signing key and tell everyone to trust that), whereas it's almost impossible to build a CA-independent model on top of SSL.

deleted 10y ago

[deleted]

noinsight 10y ago

I'm waiting for Let's Encrypt to start offering S/MIME certificates.

grinich 10y ago

Is S/MIME really that widely used? It seems to be sort of widely deployed, but not necessarily understood or required by users in secure environments.

rmoriz 10y ago
yes. And it's already supported in many clients without plugins, many companies just sign their mails. You probably don't even notice that if you don't know where to look. It's very unobtrusive compared to gpg.
spilk 10y ago
It's widely used in US government/military. DISA runs key escrow for users' encryption keys that are carried around on smartcards.