3 ms·
One thing that Google publishing their DKIM rotated keys is take fake news to a new level. Basically anybody could use those signing keys to fake email from a
by RcouF1uZ4gsC 6y ago
One thing that Google publishing their DKIM rotated keys is take fake news to a new level.
Basically anybody could use those signing keys to fake email from a politician or celebrity. Imagine the headlines “Celebrity X account hacked, here are the emails, cryptographically verified by Google”
Of course, informed people will know that anybody could have faked them, but I would guess normal people would be fooled. In addition, there is no way to say the emails are definitely fake. At least now, we can tell between actual leaked emails and fake emails.
- woodruffw 6y ago> Of course, informed people will know that anybody could have faked them, but I would guess normal people would be fooled. In addition, there is no way to say the emails are definitely fake. At least now, we can tell between actual leaked emails and fake emails. No, you can't. Google used to use 512- and 1024-bit RSA keys for DKIM signatures, both of which are comfortably within the means of small-to-medium-sized nation states. They currently use 2048-bit keys, which will probably be crackable within the next decade. DKIM is providing a false sense of non-repudiation here, one that it was never designed (much less correctly implemented) to provide.