4 ms·
> Makes me wonder if it's time to metaphorically pack it in, and respecify the SMTP infrastructure on top of HTTP(S), precisely because that seems like the only
by Xylakant 10y ago
> Makes me wonder if it's time to metaphorically pack it in, and respecify the SMTP infrastructure on top of HTTP(S), precisely because that seems like the only way we're going to get cert security with email systems.
Transport security is not the actual issue. SMTP over TLS has been around for a while and is fairly well functional. The problem is attaching an identity to the senders email. That's what S/MIME and GPG/PGP do, but the actual real-world problem here is that you need to somehow certify that the sender is the right person. So you can either have a centralized set of authorities (S/MIME) or Web of Trust (GPG/PGP). Neither option actually scales. Some countries started issuing certificates in their ID cards, but given that other countries don't even have ID cards, this is obviously not going to fix this either.
HTTPS has the same problems in principle, but it only needs to certify a comparatively small number of entities (web servers) as opposed to actual users.
- jerf 10y ago"Transport security is not the actual issue." From what I hear from security folks, transport security is still an issue. You can negotiate up to TLS easily in SMTP, as long as you don't care about certificate validity. But without caring about certificate validity, MITM is still quite possible.
- Xylakant 10y agosure, there are still providers that don't offer TLS, but my point is that fixing TLS doesn't even begin to tackle this actual problem. It's an orthogonal problem. This issue is about authorization/authentication, not about transport security/MITM attacks. PGP and SMIME, even when used for signing only will protect against this attack while even fully deployed TLS will not.
- semi-extrinsic 10y ago> Transport security is not the actual issue. Depends on what you mean by transport security. I agree TLS solves important aspects, but I can still pretend like I am xylakant@example.com without issues, since most domains (especially corporate ones!) don't enforce strict enough SPF/DKIM/DMARC policies. If anyone can pretend to be any user, I'd say transport security is lacking. In Thunderbird I have a DKIM validation plugin that shows the status below the subject line. I've seen e.g. large global oil companies that don't have any DKIM on their emails in 2016. That means anyone could send emails as ceo@oilcorp.com (or better yet (cfo|ITsupport|HR)@oilcorp.com) to employees of oilcorp and it would look genuine.
- Edmond 10y agowe are working on addressing the true-ID problem with a privacy preserving trust relay protocol: https://github.com/CipherTrustee/Trust-Relay-Protocol-API/blob/master/README.md https://github.com/CipherTrustee/Trust-Relay-Protocol-API/bl... Basically a scalable way to verify identities in a federated manner.
- Xylakant 10y agoI wish you best of luck, but I'm afraid this is a pipe dream. You can't tie a real person/institution to an identity in a privacy preserving manner which is what's required here. This is fundamentally a social problem and I'm afraid no technical solution exists. Technical tools may help, though.