4 ms·
Maybe one reason is because it is a hassle to check the signature of someone you didn't have already in your contact list ? How do you know it's not a fake sig
by elcomet 8y ago
Maybe one reason is because it is a hassle to check the signature of someone you didn't have already in your contact list ?
How do you know it's not a fake signature ? Certainly you have to look at their website and find the key. But what if this person doesn't have a website ?
- Tepix 8y agoWith S/MIME the certificate (signed by a known CA) is included in the email.
- Carpetsmoker 8y agofor S/MIME you don't need this; it's just a CA chain like HTTPS (for better or worse). For PGP I mentioned some possible options: > PGP could also be used; we can bypass much of the key exchange dilemma by just shipping email clients with keys for large organisations (PayPal, Google, etc.); like browsers do with some certificates. Or publish the keys on a DNS record. Even just publishing them on your website (or, if you’re a bank, in local branches etc.) so people can manually add them to their keyrings is a lot better than not signing anything at all!