3 ms·

I think the difference is people can envision how someone can write a fake sender on snail mail but they can't envision how it's done on email -- they need to l

I think the difference is people can envision how someone can write a fake sender on snail mail but they can't envision how it's done on email -- they need to log in first, after all. (Also I wonder if using the word "signature" only makes it harder to explain. Like, trying to explain to someone how an analog signature proves your identity. Because, well, it doesn't.)

pilsetnieks 8y ago
> they can't envision how it's done on email -- they need to log in first, after all By now every single email user with an email address that has been exposed to the internet has received untold amounts of spam emails with their own address spoofed as the sender. The only question is if they've ever noticed it.
- duiker101 8y ago
  Probably not, if they use any decent email provider 99% of spam gets correctly filtered and you never really see it unless you look in the spam folder, which most people don't anyway. Also, I don't think I ever received an email with the sender as one of my email addresses.
  - hopler 8y ago
    Not really. I get a steady stream of replies to me from ignorant users who reply to "Joe job" spam, as do everyone I know. It's the most common way someone thinks "I've been hacked" when they get the fallout from one of these "Joe jobs"
usrusr 8y ago
What you are saying, put into more provocative words: email world be safer now if, from the beginning, every email client had a big, friendly button "send from different address". In the years of earthly mass adaption it would have been colloquially called "the Bill Gates button". It certainly would not be hard to explain the value of signatures in that timeline.
- mehrdadn 8y ago
  Well I don't know if it would be safer per se... I imagine you'd probably want some USPIS enforcement for that to happen, otherwise it might end up like phone calls (given it seems people understand caller IDs are spoofable and yet it's as big a problem now as it's ever been). But yes, it could've made it potentially easier to explain.
- Fei8reim 8y ago
  I make extensive use of the bill gates button, it's a thunderbird extension called virtual identities.
smichel17 8y ago
My email client (geary) makes it pretty easy to add and send from aliases. If I ever need to explain this to someone, I'll keep a demonstration of this in mind :)
dTal 8y ago
An analog signature does "prove" your identity. Not very well, of course - the amount of effort to forge it is much less than a digital signature - but that's a question of degree, not kind. They are still easier to verify than they are to forge. I think the metaphor is very useful. It also neatly explains the concept of key sharing, which seems to present some pedagogical difficulty for some reason - you can sign your letters all you want, but if I've never seen your signature before then it doesn't actually prove anything. Public key = knowing what your signature looks like Private key = the muscle memory required to create a signature

pilsetnieks 8y ago

> they can't envision how it's done on email -- they need to log in first, after all By now every single email user with an email address that has been exposed to the internet has received untold amounts of spam emails with their own address spoofed as the sender. The only question is if they've ever noticed it.

duiker101 8y ago
Probably not, if they use any decent email provider 99% of spam gets correctly filtered and you never really see it unless you look in the spam folder, which most people don't anyway. Also, I don't think I ever received an email with the sender as one of my email addresses.
- hopler 8y ago
  Not really. I get a steady stream of replies to me from ignorant users who reply to "Joe job" spam, as do everyone I know. It's the most common way someone thinks "I've been hacked" when they get the fallout from one of these "Joe jobs"

usrusr 8y ago

What you are saying, put into more provocative words: email world be safer now if, from the beginning, every email client had a big, friendly button "send from different address". In the years of earthly mass adaption it would have been colloquially called "the Bill Gates button". It certainly would not be hard to explain the value of signatures in that timeline.

mehrdadn 8y ago
Well I don't know if it would be safer per se... I imagine you'd probably want some USPIS enforcement for that to happen, otherwise it might end up like phone calls (given it seems people understand caller IDs are spoofable and yet it's as big a problem now as it's ever been). But yes, it could've made it potentially easier to explain.
Fei8reim 8y ago
I make extensive use of the bill gates button, it's a thunderbird extension called virtual identities.

smichel17 8y ago

My email client (geary) makes it pretty easy to add and send from aliases. If I ever need to explain this to someone, I'll keep a demonstration of this in mind :)

dTal 8y ago

An analog signature does "prove" your identity. Not very well, of course - the amount of effort to forge it is much less than a digital signature - but that's a question of degree, not kind. They are still easier to verify than they are to forge. I think the metaphor is very useful. It also neatly explains the concept of key sharing, which seems to present some pedagogical difficulty for some reason - you can sign your letters all you want, but if I've never seen your signature before then it doesn't actually prove anything. Public key = knowing what your signature looks like Private key = the muscle memory required to create a signature