4 ms·

You must have a very low opinion of average Joe/Jill, to not expect them to understand "When you send an email there is no proof that it came from you." I real

by dTal 8y ago

You must have a very low opinion of average Joe/Jill, to not expect them to understand "When you send an email there is no proof that it came from you." I really don't see what's so hard about the first paragraph, which is the only one intended to be understood by a layperson. Even though the concept of "signing" has a long-established and well-known non-digital meaning, which nearly everyone will understand, the paragraph still goes out of its way to define it. Seems pretty idiot proof to me.

chrisseaton 8y ago
> When you send an email there is no proof that it came from you. I can imagine the average person replying 'yes there is there's the from box in the email'.
- loup-vaillant 8y ago
  It's not a case of not understanding, it's a case of not believing. If you're talking to a lay person that trusts you, they may raise such an objection, but they'll believe you once you reply "that can be, and often is, faked". Belief is a thorny issue when trying to communicate to the masses, though.
- Carpetsmoker 8y ago
  Just because some users don't know what they're doing means all users are idiots. This is like "we shouldn't use locks because some people often lose their keys".
  - chrisseaton 8y ago
    I don't know if you're replying to the wrong person, but I'm not arguing we shouldn't use anything. I'm answering 'will they understand' and my opinion is 'no'.
0xCMP 8y ago
Frankly I do not. My own mother tries her hardest, but I can't stop her from using variants of "Iam${X}.123" for her bank passwords and etc. Let alone am I going to try getting her to use PGP and sign her emails.
- joombaga 8y ago
  Where X = (e.g.) bankofamerica? Or X = mother's name? Either way, yikes.
sethammons 8y ago
I knew a smart guy that believed someone could physically watch him through his monitor.
- jl6 8y ago
  Given laptop webcam placement these days, this is kinda true...
  - NikkiA 8y ago
    I was looking at (budget) desktop monitors the other day, and noticed a disturbing number of them included a built-in webcam.
- ozzyman700 8y ago
  TEMPEST but to the max
- acct1771 8y ago
  And?
  - sethammons 8y ago
    As an example of people not understanding the tech around them.
skocznymroczny 8y ago
"What do you mean there's no proof it came from me, it says <name>@gmail.com right there in the sender address! What do you mean the sender address can be spoofed? Headers? What's that."
- ddrdrck_ 8y ago
  Exactly. And now imagine you manage in some way to explain average user that he cannot trust email sender. Then explain him that if email is signed then it is OK. He will most probably answer "why the hell now should I trust email sender !? There is just a dumb icon saying the email is signed. I do not trust it !!!". Which would just be the most sane reaction actually
- fouric 8y ago
  ...and then you tell them that it's exactly like someone writing a fake return address on a piece of mail before sending it to you, and they understand, because as stated above, this is conceptually very simple. You don't need to talk about "headers" at all - I don't know why you're bringing them up.
teilo 8y ago
And you must not work in tech support. But all this is irrelevant for the most part because aside from understanding WHY it's useful and important, there's the fact that most people are using web clients, and trying to, say, sign or verify a message in GMail is pretty much an unclimbable mountain for the vast majority of people. Heck, even on desktop clients it's a pain in the ass. Ever tried to create, install, and use an S/MIME certificate in a major desktop client, like Outlook or Apple Mail? It's ridiculous. An obscure mix of trying to use the right browser, export the certificate in the right format, sometimes even convert it on the command line, use the right mail client extension, etc. So it's the tools that are the main problem. Until S/MIME or similar is built into major webmail clients, and certificate creation and installation is simple on the desktop, it's never going to happen.
- Carpetsmoker 8y ago
  > And you must not work in tech support. The people you see in tech support are not representative for the entire population. This is like working in a hospital and coming to the conclusion that most people in the world have a serious illness.
jcranmer 8y ago
It's actually much worse than you expect. Most email clients don't show the email address of the sender; they show the display name. If you get an email from "The President <l33thacker101@evil.h4x0rz.club>", most users will see that the email comes "The President." And l33thacker101@evil.h4x0rz.club could get a valid signature for her domain, because she obviously controls it, and people would see that the email from "The President" really did come from "The President." There are many problems with email. The ability for l33thacker101@evil.h4x0rz.club to claim to be innocent.grandma@grandmas.knitting.club is not at the top of the list.
- frosted-flakes 8y ago
  Why do so many email clients do this? In my opinion, it only makes things more confusing. It's especially irritating when a contact has multiple email addresses (work/personal) and it's not obvious which is which.
PKop 8y ago
> I really don't see what's so hard This is hilarious. Do you have parents and/or grandparents? Have you not had to repeatedly explain the simplest things over and over again? User names and passwords are hard enough, and you're expecting most people to understand email signing? What experience do you base this expectation on?
saberience 8y ago
haha, I don't think you understand. If I told my dad "There is no proof that an email that came from me, came from me." He's going to say... "but it came from <myname>@gmail.com" That's what you don't seem to comprehend. Yes, for you this seems obvious. But really, to the average Joe/Jill, this idea that you could get an email from the address you expect but it has been spoofed is gibberish.
- detaro 8y ago
  And you really think you couldn't explain that to him? There's a large difference between what people intuitively expect and what they can understand if told about it. Envelope analogies can go surprisingly far. (Assuming they believe you. If they think you can't be trusted about such things, then that's a problem of course)

by dTal 8y ago

chrisseaton 8y ago

> When you send an email there is no proof that it came from you. I can imagine the average person replying 'yes there is there's the from box in the email'.

loup-vaillant 8y ago
It's not a case of not understanding, it's a case of not believing. If you're talking to a lay person that trusts you, they may raise such an objection, but they'll believe you once you reply "that can be, and often is, faked". Belief is a thorny issue when trying to communicate to the masses, though.
Carpetsmoker 8y ago
Just because some users don't know what they're doing means all users are idiots. This is like "we shouldn't use locks because some people often lose their keys".
- chrisseaton 8y ago
  I don't know if you're replying to the wrong person, but I'm not arguing we shouldn't use anything. I'm answering 'will they understand' and my opinion is 'no'.

0xCMP 8y ago

Frankly I do not. My own mother tries her hardest, but I can't stop her from using variants of "Iam${X}.123" for her bank passwords and etc. Let alone am I going to try getting her to use PGP and sign her emails.

joombaga 8y ago
Where X = (e.g.) bankofamerica? Or X = mother's name? Either way, yikes.

sethammons 8y ago

I knew a smart guy that believed someone could physically watch him through his monitor.

jl6 8y ago
Given laptop webcam placement these days, this is kinda true...
- NikkiA 8y ago
  I was looking at (budget) desktop monitors the other day, and noticed a disturbing number of them included a built-in webcam.
ozzyman700 8y ago
TEMPEST but to the max
acct1771 8y ago
And?
- sethammons 8y ago
  As an example of people not understanding the tech around them.

skocznymroczny 8y ago

"What do you mean there's no proof it came from me, it says <name>@gmail.com right there in the sender address! What do you mean the sender address can be spoofed? Headers? What's that."

ddrdrck_ 8y ago
Exactly. And now imagine you manage in some way to explain average user that he cannot trust email sender. Then explain him that if email is signed then it is OK. He will most probably answer "why the hell now should I trust email sender !? There is just a dumb icon saying the email is signed. I do not trust it !!!". Which would just be the most sane reaction actually
fouric 8y ago
...and then you tell them that it's exactly like someone writing a fake return address on a piece of mail before sending it to you, and they understand, because as stated above, this is conceptually very simple. You don't need to talk about "headers" at all - I don't know why you're bringing them up.

teilo 8y ago

And you must not work in tech support. But all this is irrelevant for the most part because aside from understanding WHY it's useful and important, there's the fact that most people are using web clients, and trying to, say, sign or verify a message in GMail is pretty much an unclimbable mountain for the vast majority of people. Heck, even on desktop clients it's a pain in the ass. Ever tried to create, install, and use an S/MIME certificate in a major desktop client, like Outlook or Apple Mail? It's ridiculous. An obscure mix of trying to use the right browser, export the certificate in the right format, sometimes even convert it on the command line, use the right mail client extension, etc. So it's the tools that are the main problem. Until S/MIME or similar is built into major webmail clients, and certificate creation and installation is simple on the desktop, it's never going to happen.

Carpetsmoker 8y ago
> And you must not work in tech support. The people you see in tech support are not representative for the entire population. This is like working in a hospital and coming to the conclusion that most people in the world have a serious illness.

jcranmer 8y ago

It's actually much worse than you expect. Most email clients don't show the email address of the sender; they show the display name. If you get an email from "The President <l33thacker101@evil.h4x0rz.club>", most users will see that the email comes "The President." And l33thacker101@evil.h4x0rz.club could get a valid signature for her domain, because she obviously controls it, and people would see that the email from "The President" really did come from "The President." There are many problems with email. The ability for l33thacker101@evil.h4x0rz.club to claim to be innocent.grandma@grandmas.knitting.club is not at the top of the list.

frosted-flakes 8y ago
Why do so many email clients do this? In my opinion, it only makes things more confusing. It's especially irritating when a contact has multiple email addresses (work/personal) and it's not obvious which is which.

PKop 8y ago

> I really don't see what's so hard This is hilarious. Do you have parents and/or grandparents? Have you not had to repeatedly explain the simplest things over and over again? User names and passwords are hard enough, and you're expecting most people to understand email signing? What experience do you base this expectation on?

saberience 8y ago

haha, I don't think you understand. If I told my dad "There is no proof that an email that came from me, came from me." He's going to say... "but it came from <myname>@gmail.com" That's what you don't seem to comprehend. Yes, for you this seems obvious. But really, to the average Joe/Jill, this idea that you could get an email from the address you expect but it has been spoofed is gibberish.

detaro 8y ago
And you really think you couldn't explain that to him? There's a large difference between what people intuitively expect and what they can understand if told about it. Envelope analogies can go surprisingly far. (Assuming they believe you. If they think you can't be trusted about such things, then that's a problem of course)