7 ms·

> Non-repudiation over time is a truly powerful property of DKIM'd email for a great many uses outside of blackmail. Exactly. If one enters into an contract us

> Non-repudiation over time is a truly powerful property of DKIM'd email for a great many uses outside of blackmail. Exactly. If one enters into an contract using an e-mail, then DKIM can be used as a proof to the court of law that the contract was accepted by both sides.

chimeracoder 6y ago
> Exactly. If one enters into an contract using an e-mail, then DKIM can be used as a proof to the court of law that the contract was accepted by both sides. It would make a good TV drama plot, but courts don't work this way in real life. If that were the case, courts wouldn't be able to enforce contracts with wet signatures (which are straightforward to forge), or verbal contracts (which are valid contracts and regularly enforced). In practice, you don't need to check DKIM in order to use an email as evidence of a contract, because the courts would more likely just use the many other threats and tools at their disposal to ensure that the email is not fabricated. This is why, even though most contracts are not executed in a cryptographically secure manner, most contract disputes that land before the courts hinge on matters like breach of contract ("we agree on the original terms, but disagree on whether our actions upheld them") or disputes over the intended vs. actual meaning of the contract ("we agree on the text we both signed to, but disagree on the correct interpretation of that text"). Disputes over whether the text of the executed contract is authentic are rare in real life.
- thinkharderdev 6y ago
  Not to mention that DKIM only validates that en email was sent with particular content from a particular email address. It cannot ensure who was actually sitting at the keyboard composing the email.
  - upofadown 6y ago
    More specifically, DKIM only validates that an email passed through a particular mail server.
- amadeuspagel 6y ago
  > If that were the case, courts wouldn't be able to enforce contracts with wet signatures (which are straightforward to forge) I'm pretty confident that I could sign an email with a DKIM key if that were published, however, there's nothing that would give me the confidence that I could forge a pen signature in such a way that not even an expert could detect the forgery. > or verbal contracts (which are valid contracts and regularly enforced). I'm not a a lawyer, but according to the first google result "the Uniform Commercial Code [...] requires that contracts for the sale of goods over $500 to be in writing".[1] > Disputes over whether the text of the executed contract is authentic are rare in real life. Maybe they are rare precisely because it's hard and risky to forge signatures. [1] https://www.hg.org/legal-articles/are-verbal-agreements-binding-35794 https://www.hg.org/legal-articles/are-verbal-agreements-bind...
  - pdonis 6y ago
    > the Uniform Commercial Code [...] requires that contracts for the sale of goods over $500 to be in writing Yes, but not all contracts do that. For example, any contract for services is not covered by the UCC.
  - caf 6y ago
    I'm not a a lawyer, but according to the first google result "the Uniform Commercial Code [...] requires that contracts for the sale of goods over $500 to be in writing".[1] In practice, this doesn't seem to mean that every time you buy an iPhone, Apple provides you a paper contract authenticated with an actual verifiable hand-signed signature of an authorised officer.
deleted 6y ago
[deleted]
avianlyric 6y ago
If non-repudiation is important to you, then both parties should consent to it and use a platform that explicitly supports it. It shouldn’t be sprung on people without consent. It would be like saying it’s fine to keep a recording from someone else’s webcam because it might prove a crime later. There’s a reason why justice systems have statues of limitations. People should need to look over their shoulders for the rest of their lives because of one poorly written email.
- quit32 6y ago
  It is not really being sprung on them with how long it has existed. Not at all like continuing recording on a webcam where you might say things never intended for the party receiving it. Are ppl who don't even know DKIM exists but know they have shady emails saved in the cloud or on their personal really just banking on repudiation and thats why they take no other action like deleting the email or putting more thought into emails they send? Seriously doubt it. Exactly bc of statute of limitations, they would not have to look over their shoulders for the rest of their lives because of one poorly written email.
  - thinkharderdev 6y ago
    I think it is less about user behavior and understanding than it is about the incentives it creates for nefarious actors. Basically, if emails can't be cryptographically verified then stealing a bunch of emails and anonymously dumping them somewhere is pointless since most people would probably not consider them authentic.
  - avianlyric 6y ago
    Consent needs to be given freely, with knowledge of what you’re consenting to. If it’s not free and knowledgeable, it’s not consent. I certainly didn’t realise that DKIM can be used as a non-repudiation signature, I’m sure most people using email don’t. Thus there’s no consent and I would say that non-repudiation has been sprung on me. The duration has nothing to do with it. Just because you can keep a camera hidden in someones room for an extended period of time doesn’t mean it’s ethical or consensual to record them. Finally statues of limitations don’t protect people from a trial in social media. Social media is just as capable as the justice system of destroying a persons life. Unfortunately Twitter doesn’t have a statue of limitations.
shinigami 6y ago
Entering an contract via an email is a ridiculous idea from the start.
- Quarrel 6y ago
  wtf? it happens all the time. I've raised VC money based on emailed contracts, bought businesses based on them, bought domain names. It is incredibly standard and legal (in almost all of the jurisdictions I've worked in, which is a lot).)
  - shinigami 6y ago
    Sure. But what authenticates the contract? Do you sign and scan them?
    - icedchai 6y ago
      PDFs with e-signatures are very common place now. Have you heard of DocuSign or other similar services?
      - couchand 6y ago
        And so it is the e-signature, not the DKIM that matters.
        icedchai 6y ago
        A signed and scanned PDF is also commonly used, same as an old-school fax-based contract where you sign and send it back. But, yes, the DKIM definitely does not matter for contract purposes.
- icedchai 6y ago
  Would you prefer we use fax machines instead?
- xyzzyz 6y ago
  That's right, we need more travel and in-person meetings now.
quit32 6y ago
Yes. I have seen first hand where it was used to help accelerate out of court agreement without needing a lawsuit. Basically a 3rd party had one of their outlook user accounts compromised by a bad actor who used it to tell another company new instructions for something. The 3rd party tried to say other company fell for a phishing email and it was their fault but because of DKIM it was immediately provable that instead 3rd party was compromised and email legit sent from their o365 and they were pretending like they didn't know this. This all got disputed maybe a year after email sent. Love Matthew Green but I personally am not a fan of this proposal. It doesn't fully achieve what he wants bc its only gmail and timing of compromise would be key. Most of the email hacks have actually been very much in the public interest despite being unethical. Breaches also lead to more productive work by companies in better securing accounts and better protecting sensitive information which google has been doing with account security and adding expiring messages. Like do we really want companies to just continue sloppily sending customer info in email bc they can deny its legit or should they focus on not getting this info compromised to begin with? Also, for ransomeware groups that now post data when not paid, it is not really seeming like too big of a disincentive that there is repudiation regarding the files they post.

chimeracoder 6y ago

> Exactly. If one enters into an contract using an e-mail, then DKIM can be used as a proof to the court of law that the contract was accepted by both sides. It would make a good TV drama plot, but courts don't work this way in real life. If that were the case, courts wouldn't be able to enforce contracts with wet signatures (which are straightforward to forge), or verbal contracts (which are valid contracts and regularly enforced). In practice, you don't need to check DKIM in order to use an email as evidence of a contract, because the courts would more likely just use the many other threats and tools at their disposal to ensure that the email is not fabricated. This is why, even though most contracts are not executed in a cryptographically secure manner, most contract disputes that land before the courts hinge on matters like breach of contract ("we agree on the original terms, but disagree on whether our actions upheld them") or disputes over the intended vs. actual meaning of the contract ("we agree on the text we both signed to, but disagree on the correct interpretation of that text"). Disputes over whether the text of the executed contract is authentic are rare in real life.

thinkharderdev 6y ago
Not to mention that DKIM only validates that en email was sent with particular content from a particular email address. It cannot ensure who was actually sitting at the keyboard composing the email.
- upofadown 6y ago
  More specifically, DKIM only validates that an email passed through a particular mail server.
amadeuspagel 6y ago
> If that were the case, courts wouldn't be able to enforce contracts with wet signatures (which are straightforward to forge) I'm pretty confident that I could sign an email with a DKIM key if that were published, however, there's nothing that would give me the confidence that I could forge a pen signature in such a way that not even an expert could detect the forgery. > or verbal contracts (which are valid contracts and regularly enforced). I'm not a a lawyer, but according to the first google result "the Uniform Commercial Code [...] requires that contracts for the sale of goods over $500 to be in writing".[1] > Disputes over whether the text of the executed contract is authentic are rare in real life. Maybe they are rare precisely because it's hard and risky to forge signatures. [1] https://www.hg.org/legal-articles/are-verbal-agreements-binding-35794 https://www.hg.org/legal-articles/are-verbal-agreements-bind...
- pdonis 6y ago
  > the Uniform Commercial Code [...] requires that contracts for the sale of goods over $500 to be in writing Yes, but not all contracts do that. For example, any contract for services is not covered by the UCC.
- caf 6y ago
  I'm not a a lawyer, but according to the first google result "the Uniform Commercial Code [...] requires that contracts for the sale of goods over $500 to be in writing".[1] In practice, this doesn't seem to mean that every time you buy an iPhone, Apple provides you a paper contract authenticated with an actual verifiable hand-signed signature of an authorised officer.

deleted 6y ago

[deleted]

avianlyric 6y ago

If non-repudiation is important to you, then both parties should consent to it and use a platform that explicitly supports it. It shouldn’t be sprung on people without consent. It would be like saying it’s fine to keep a recording from someone else’s webcam because it might prove a crime later. There’s a reason why justice systems have statues of limitations. People should need to look over their shoulders for the rest of their lives because of one poorly written email.

quit32 6y ago
It is not really being sprung on them with how long it has existed. Not at all like continuing recording on a webcam where you might say things never intended for the party receiving it. Are ppl who don't even know DKIM exists but know they have shady emails saved in the cloud or on their personal really just banking on repudiation and thats why they take no other action like deleting the email or putting more thought into emails they send? Seriously doubt it. Exactly bc of statute of limitations, they would not have to look over their shoulders for the rest of their lives because of one poorly written email.
- thinkharderdev 6y ago
  I think it is less about user behavior and understanding than it is about the incentives it creates for nefarious actors. Basically, if emails can't be cryptographically verified then stealing a bunch of emails and anonymously dumping them somewhere is pointless since most people would probably not consider them authentic.
- avianlyric 6y ago
  Consent needs to be given freely, with knowledge of what you’re consenting to. If it’s not free and knowledgeable, it’s not consent. I certainly didn’t realise that DKIM can be used as a non-repudiation signature, I’m sure most people using email don’t. Thus there’s no consent and I would say that non-repudiation has been sprung on me. The duration has nothing to do with it. Just because you can keep a camera hidden in someones room for an extended period of time doesn’t mean it’s ethical or consensual to record them. Finally statues of limitations don’t protect people from a trial in social media. Social media is just as capable as the justice system of destroying a persons life. Unfortunately Twitter doesn’t have a statue of limitations.

shinigami 6y ago

Entering an contract via an email is a ridiculous idea from the start.

Quarrel 6y ago
wtf? it happens all the time. I've raised VC money based on emailed contracts, bought businesses based on them, bought domain names. It is incredibly standard and legal (in almost all of the jurisdictions I've worked in, which is a lot).)
- shinigami 6y ago
  Sure. But what authenticates the contract? Do you sign and scan them?
  - icedchai 6y ago
    PDFs with e-signatures are very common place now. Have you heard of DocuSign or other similar services?
    - couchand 6y ago
      And so it is the e-signature, not the DKIM that matters.
      - icedchai 6y ago
        A signed and scanned PDF is also commonly used, same as an old-school fax-based contract where you sign and send it back. But, yes, the DKIM definitely does not matter for contract purposes.
icedchai 6y ago
Would you prefer we use fax machines instead?
xyzzyz 6y ago
That's right, we need more travel and in-person meetings now.

quit32 6y ago

Yes. I have seen first hand where it was used to help accelerate out of court agreement without needing a lawsuit. Basically a 3rd party had one of their outlook user accounts compromised by a bad actor who used it to tell another company new instructions for something. The 3rd party tried to say other company fell for a phishing email and it was their fault but because of DKIM it was immediately provable that instead 3rd party was compromised and email legit sent from their o365 and they were pretending like they didn't know this. This all got disputed maybe a year after email sent. Love Matthew Green but I personally am not a fan of this proposal. It doesn't fully achieve what he wants bc its only gmail and timing of compromise would be key. Most of the email hacks have actually been very much in the public interest despite being unethical. Breaches also lead to more productive work by companies in better securing accounts and better protecting sensitive information which google has been doing with account security and adding expiring messages. Like do we really want companies to just continue sloppily sending customer info in email bc they can deny its legit or should they focus on not getting this info compromised to begin with? Also, for ransomeware groups that now post data when not paid, it is not really seeming like too big of a disincentive that there is repudiation regarding the files they post.