4 ms·

I get the problems with email encryption, but what do people think of email signing? It's a shame it's so hard to do, but I always thought it'd be a good prote

by dm319 6y ago

I get the problems with email encryption, but what do people think of email signing? It's a shame it's so hard to do, but I always thought it'd be a good protection against phishing.

nobody9999 6y ago
>I get the problems with email encryption, but what do people think of email signing? It's a shame it's so hard to do, but I always thought it'd be a good protection against phishing. I think email signing is wonderful. In fact, my email client (Thunderbird) is configured to sign all messages sent by my primary identity. For many years, I used Enigmail, until Thunderbird integrated the functionality a few months ago. However, the value of signing is diluted significantly by the narrow adoption and ignorance of the greater populace. As an example, I was exchanging emails with my financial advisor and giving them specific instructions on the disposition of certain funds. Having a GPG signature is great for this, since they can confirm that the email hadn't been modified in transit. But rather than being glad that I cryptographically signed my instructions, I received a phone call saying something along the lines of "there's all this junk at the end of your email. We're concerned it's been tampered with." When I explained what the "junk" was, rather than asking how to confirm the signature in the future, I was met with confusion and the distinct impression that I was acting in an inappropriate way. Their solution: All instructions from me must be verbally confirmed via telephone. Not that such verification is a bad thing, but the complete ignorance, then rejection of a perfectly valid confirmation mechanism (without any interest in learning how to secure their communications) by folks who should care about such things left me flabbergasted. As long as the above is the norm, email signing (and I still do it where it matters) will be much less valuable than it could be. More's the pity.
- dm319 6y ago
  That's frustrating. It's also very variable how different email clients deal with signing. My work outlook will flag it with a sort of rosette, whereas Gmail doesn't mark it in any obvious way.

by dm319 6y ago

I get the problems with email encryption, but what do people think of email signing? It's a shame it's so hard to do, but I always thought it'd be a good protection against phishing.

nobody9999 6y ago

>I get the problems with email encryption, but what do people think of email signing? It's a shame it's so hard to do, but I always thought it'd be a good protection against phishing. I think email signing is wonderful. In fact, my email client (Thunderbird) is configured to sign all messages sent by my primary identity. For many years, I used Enigmail, until Thunderbird integrated the functionality a few months ago. However, the value of signing is diluted significantly by the narrow adoption and ignorance of the greater populace. As an example, I was exchanging emails with my financial advisor and giving them specific instructions on the disposition of certain funds. Having a GPG signature is great for this, since they can confirm that the email hadn't been modified in transit. But rather than being glad that I cryptographically signed my instructions, I received a phone call saying something along the lines of "there's all this junk at the end of your email. We're concerned it's been tampered with." When I explained what the "junk" was, rather than asking how to confirm the signature in the future, I was met with confusion and the distinct impression that I was acting in an inappropriate way. Their solution: All instructions from me must be verbally confirmed via telephone. Not that such verification is a bad thing, but the complete ignorance, then rejection of a perfectly valid confirmation mechanism (without any interest in learning how to secure their communications) by folks who should care about such things left me flabbergasted. As long as the above is the norm, email signing (and I still do it where it matters) will be much less valuable than it could be. More's the pity.

dm319 6y ago
That's frustrating. It's also very variable how different email clients deal with signing. My work outlook will flag it with a sort of rosette, whereas Gmail doesn't mark it in any obvious way.