5 ms·

Because it adds nothing. Unless both part exchange their keys securely and both parties store the keys securely you are just delegating identification to a diff

Because it adds nothing. Unless both part exchange their keys securely and both parties store the keys securely you are just delegating identification to a different infrastructure with no indication of it being more secure but with an added false sense of security with is even more dangerous.

ricardobeat 8y ago
Yet this is exactly how SSL security is implemented. Speaking of that, couldn’t companies use their existing domain certificate to sign emails?
- jcranmer 8y ago
  No. You need a CA certificate that is authorized to sign email certificates to sign the email certificate that signs emails. The domain certificate is merely authorized for the SSL connection itself, and the CA that signs it likely doesn't have trust bits for email either.
- jhasse 8y ago
  You mean like DKIM? https://en.wikipedia.org/wiki/DomainKeys_Identified_Mail https://en.wikipedia.org/wiki/DomainKeys_Identified_Mail
dijit 8y ago
Either this is true and the CA system for HTTPS is (as you say) a false sense of security. Or it’s not true because we implicitly trust key signers; unless you’re talking about PGP only, which only has a web-of-trust model and a very poor usability track record. If that’s the case you should look at S/MIME which is very similar in its model to what we currently use for securing websites.
- berbec 8y ago
  Well, the CA system for HTTPS is a false sense of Identity protection. Is great for encryption. 0: https://stripe.ian.sh/ https://stripe.ian.sh/
  - tialaramex 8y ago
    That site really is stripe.ian.sh like the certificate says. It really is for Stripe, a real US company. That the US (and every other county we care about) intentionally lets crooks run companies in order to defraud the general populace is a problem you could try taking up with your government. Although in the US that's currently led by a career grifter and a bunch of crooks so your message may not get through. But the Web PKI did everything it could here, don't blame us.
    - berbec 8y ago
      I'm just rehashing an old argument: https is encryption vs https is identity. Sorry

ricardobeat 8y ago

Yet this is exactly how SSL security is implemented. Speaking of that, couldn’t companies use their existing domain certificate to sign emails?

jcranmer 8y ago
No. You need a CA certificate that is authorized to sign email certificates to sign the email certificate that signs emails. The domain certificate is merely authorized for the SSL connection itself, and the CA that signs it likely doesn't have trust bits for email either.
jhasse 8y ago
You mean like DKIM? https://en.wikipedia.org/wiki/DomainKeys_Identified_Mail https://en.wikipedia.org/wiki/DomainKeys_Identified_Mail

dijit 8y ago

Either this is true and the CA system for HTTPS is (as you say) a false sense of security. Or it’s not true because we implicitly trust key signers; unless you’re talking about PGP only, which only has a web-of-trust model and a very poor usability track record. If that’s the case you should look at S/MIME which is very similar in its model to what we currently use for securing websites.

berbec 8y ago
Well, the CA system for HTTPS is a false sense of Identity protection. Is great for encryption. 0: https://stripe.ian.sh/ https://stripe.ian.sh/
- tialaramex 8y ago
  That site really is stripe.ian.sh like the certificate says. It really is for Stripe, a real US company. That the US (and every other county we care about) intentionally lets crooks run companies in order to defraud the general populace is a problem you could try taking up with your government. Although in the US that's currently led by a career grifter and a bunch of crooks so your message may not get through. But the Web PKI did everything it could here, don't blame us.
  - berbec 8y ago
    I'm just rehashing an old argument: https is encryption vs https is identity. Sorry