4 ms·

-- Example -- Dear Ivanhoe, I regret to inform you that your HIV test came back positive. Please contact my office at your earliest convenience to arrange a f

by mthoms 6y ago

-- Example -- Dear Ivanhoe, I regret to inform you that your HIV test came back positive. Please contact my office at your earliest convenience to arrange a follow up. Sincerely, Your doctor

santraginean 6y ago
No doctor should be writing that email in the first place; it would be an example of such a flagrantly negligent treatment of PHI that cryptographic signatures and reputability are kind of irrelevant.
- mthoms 6y ago
  Email is used outside of countries with these kinds of protections. For example, I know someone who had an STI test in Thailand and the results did indeed come via email. Even if this example is imperfect, it's really not that hard to imagine a scenario where some type of compromising information is sent to you. Perhaps even accidentally.
- Dylan16807 6y ago
  Call me back when they ban faxes. Email with server verification is way more secure than that.
ivanhoe 6y ago
Or it could be: "Hey Ivanhoe, your buddy from government here. That thing that we discussed, no problem I arranged everything, T says it's cool, just wire us the money and the project is yours." In my view, if someone is going to blackmail me for some sensitive topic like being HIV positive or dox me in revenge, solution is not that I have to go public and lie that it's not real (and risk to be counter-proven it is) - but to have police put their blackmailing asses in the jail. That's the type of protection of my freedom and privacy that I hope for. And in the end, who has ever believed people doing public denials? Once the word gets out, by the time you publish the rebuttal majority of folks will already have an opinion on it and that will stick with you for long time no matter what you say later.
- mthoms 6y ago
  >to have police put their blackmailing asses in the jail. Email is global. You and I are in privileged positions regarding access to capable law enforcement. We're also privileged with what our societies deems acceptable. We are the exception, not the rule. If you're only thinking about how it affects you and what remedies you would have, then you clearly aren't looking at the big picture.
  - ivanhoe 6y ago
    I'm from Serbia, so no, I'm not really privileged with any of that as we've got oppressive regime in power, inefficient police used to look the other way on crimes, and fairly close-minded and conservative society. Of course, there are places where it's far worse, but I had fairly enough of shit happen to me so far in life (break-up of the country, years of war, living under UN sanctions, hyperinflation, working for $5/month, full-blown dictatorship with secret police killing people, etc.) that I like to think that I actually do have some clue on "a big picture"...
    - mthoms 6y ago
      I can't follow your argument. Above, you said - >the solution is [...] to have police put their blackmailing asses in the jail. But now, you're saying you don't have meaningful access to law enforcement (in this context). So, why did you suggest a solution you know isn't viable? I don't get it. To my mind, you've just made a strong argument for publishing DKIM keys since you readily admit law enforcement cannot tackle the blackmail problem. Indeed, even in countries with "good" law enforcement, they can't reasonably tackle it since the blackmailers almost always come from overseas (or are un-traceable).
      - ivanhoe 6y ago
        A) Because I'm not focusing on myself here, and realistically majority of people affected by these crimes live in the 1st world countries and will have access to some level of legal protection, and B) Even though it's not viable for me to do anything to someone in Russia or China or even US for leaking my data, I see that as the only proper way to address this type of situations. If it's not possible now, then we should concentrate on fixing it and making it possible, instead of trying to lessen the impact, but at the same time helping those same blackmailers to easier hide their own steps (and a bunch of other shady characters who'd rather not be linked to their emails, from pedophiles to corrupted politicians). And also I don't see denying as a reasonable move here, as it comes down to basically lying publicly about the origin of your data and can just get you deeper in the trouble, especially if you're in any sensitive position and there're people out there actively looking to dig your dirt. AFAIK all PR handbooks on damage control say the same.

by mthoms 6y ago

-- Example -- Dear Ivanhoe, I regret to inform you that your HIV test came back positive. Please contact my office at your earliest convenience to arrange a follow up. Sincerely, Your doctor

santraginean 6y ago

No doctor should be writing that email in the first place; it would be an example of such a flagrantly negligent treatment of PHI that cryptographic signatures and reputability are kind of irrelevant.

mthoms 6y ago
Email is used outside of countries with these kinds of protections. For example, I know someone who had an STI test in Thailand and the results did indeed come via email. Even if this example is imperfect, it's really not that hard to imagine a scenario where some type of compromising information is sent to you. Perhaps even accidentally.
Dylan16807 6y ago
Call me back when they ban faxes. Email with server verification is way more secure than that.

ivanhoe 6y ago

Or it could be: "Hey Ivanhoe, your buddy from government here. That thing that we discussed, no problem I arranged everything, T says it's cool, just wire us the money and the project is yours." In my view, if someone is going to blackmail me for some sensitive topic like being HIV positive or dox me in revenge, solution is not that I have to go public and lie that it's not real (and risk to be counter-proven it is) - but to have police put their blackmailing asses in the jail. That's the type of protection of my freedom and privacy that I hope for. And in the end, who has ever believed people doing public denials? Once the word gets out, by the time you publish the rebuttal majority of folks will already have an opinion on it and that will stick with you for long time no matter what you say later.

mthoms 6y ago
>to have police put their blackmailing asses in the jail. Email is global. You and I are in privileged positions regarding access to capable law enforcement. We're also privileged with what our societies deems acceptable. We are the exception, not the rule. If you're only thinking about how it affects you and what remedies you would have, then you clearly aren't looking at the big picture.
- ivanhoe 6y ago
  I'm from Serbia, so no, I'm not really privileged with any of that as we've got oppressive regime in power, inefficient police used to look the other way on crimes, and fairly close-minded and conservative society. Of course, there are places where it's far worse, but I had fairly enough of shit happen to me so far in life (break-up of the country, years of war, living under UN sanctions, hyperinflation, working for $5/month, full-blown dictatorship with secret police killing people, etc.) that I like to think that I actually do have some clue on "a big picture"...
  - mthoms 6y ago
    I can't follow your argument. Above, you said - >the solution is [...] to have police put their blackmailing asses in the jail. But now, you're saying you don't have meaningful access to law enforcement (in this context). So, why did you suggest a solution you know isn't viable? I don't get it. To my mind, you've just made a strong argument for publishing DKIM keys since you readily admit law enforcement cannot tackle the blackmail problem. Indeed, even in countries with "good" law enforcement, they can't reasonably tackle it since the blackmailers almost always come from overseas (or are un-traceable).
    - ivanhoe 6y ago
      A) Because I'm not focusing on myself here, and realistically majority of people affected by these crimes live in the 1st world countries and will have access to some level of legal protection, and B) Even though it's not viable for me to do anything to someone in Russia or China or even US for leaking my data, I see that as the only proper way to address this type of situations. If it's not possible now, then we should concentrate on fixing it and making it possible, instead of trying to lessen the impact, but at the same time helping those same blackmailers to easier hide their own steps (and a bunch of other shady characters who'd rather not be linked to their emails, from pedophiles to corrupted politicians). And also I don't see denying as a reasonable move here, as it comes down to basically lying publicly about the origin of your data and can just get you deeper in the trouble, especially if you're in any sensitive position and there're people out there actively looking to dig your dirt. AFAIK all PR handbooks on damage control say the same.