4 ms·

>but all these scams would not work in a world where authors and publishers only trust signed e-mails. It would be like https: worthless because of Let's Encry

by eznzt 6y ago

>but all these scams would not work in a world where authors and publishers only trust signed e-mails. It would be like https: worthless because of Let's Encrypt

alsetmusic 6y ago
> It would be like https: worthless because of Let's Encrypt Can you please elaborate why LE.org makes https worthless? I don’t want to make improper assumptions as to your meaning
pacamara619 6y ago
This analogy is flawed in two points: 1. Let's Encrypt isn't useless because 2. With certificates you can be sure, the message you received, is from the certificate owner. This applies to websites and emails.
- eznzt 6y ago
  The point here is that I could sign any email as long as I control the address. The fact that an email is signed does not mean it's to be trusted. Same with https.
  - merlinscholz 6y ago
    From where would you get the private PGP key of the person who owns the email address?
    - eznzt 6y ago
      That is not what the comment says. The comment says: >but all these scams would not work in a world where authors and publishers only trust signed e-mails. Not that people will take the time and effort to verify the signatures. Not to mention that you can still call them and say "eeeh I'm Jones, you know, I just had to renew my signature, so it won't check, but it's me. bye"
throw14082020 6y ago
To be clear, the reason the above comment is downvoted, is because the issue in the article will not be solved by signing emails. Signing is a way of ensuring the email has not been tampered with. The attacker created a domain that looks similar to the original (e.g. using gooogle.com instead of google.com). Google gets around this by owning all the alternatives but many other companies cannot realistically do this). Even if we had secure end-to-end email, their emails would still be signed because the scammers are using their domain, and can set DKIM, SPF, DMARC records to ensure their emails are not tampered with. In a future where our emails are encrypted with PGP, email recipients would look up the PGP public key of a email sender, and would get the one the scammer had uploaded. The reason why people hate on LetsEncrypt somewhat, is that these scammers can create a TLS certificate immediately and for free for their new phishing domain (e.g. gooooogle.com). It would have otherwise been a small financial barrier for scammers to get this setup, and some of these scammers operate on volume (trying many different domains, getting only a few victims). I think LetsEncrypt does a great job, yes there is a small price to pay to allow the rest of the internet to have secure http traffic (https). I think the real issue is of user experience. There is no easy way to check who your emails came from except from checking the from: field in the email. Reading these emails is boring and tiring. I think if email clients warned users to validate sender email addresses when receiving emails for the first time, it would make it safer. Therefore, bob@goooogle.com will show up for validation again, and the user has to read and validate it. Effectively, I suggest using "whitelists" instead of "blacklists". If I had a startup, I would think deeply about not provide emails to my employees. That's how bad I think it is. But then again, to communicate with other companies, its either email or linkedIn...

by eznzt 6y ago

>but all these scams would not work in a world where authors and publishers only trust signed e-mails. It would be like https: worthless because of Let's Encrypt

alsetmusic 6y ago

> It would be like https: worthless because of Let's Encrypt Can you please elaborate why LE.org makes https worthless? I don’t want to make improper assumptions as to your meaning

pacamara619 6y ago

This analogy is flawed in two points: 1. Let's Encrypt isn't useless because 2. With certificates you can be sure, the message you received, is from the certificate owner. This applies to websites and emails.

eznzt 6y ago
The point here is that I could sign any email as long as I control the address. The fact that an email is signed does not mean it's to be trusted. Same with https.
- merlinscholz 6y ago
  From where would you get the private PGP key of the person who owns the email address?
  - eznzt 6y ago
    That is not what the comment says. The comment says: >but all these scams would not work in a world where authors and publishers only trust signed e-mails. Not that people will take the time and effort to verify the signatures. Not to mention that you can still call them and say "eeeh I'm Jones, you know, I just had to renew my signature, so it won't check, but it's me. bye"

throw14082020 6y ago

To be clear, the reason the above comment is downvoted, is because the issue in the article will not be solved by signing emails. Signing is a way of ensuring the email has not been tampered with. The attacker created a domain that looks similar to the original (e.g. using gooogle.com instead of google.com). Google gets around this by owning all the alternatives but many other companies cannot realistically do this). Even if we had secure end-to-end email, their emails would still be signed because the scammers are using their domain, and can set DKIM, SPF, DMARC records to ensure their emails are not tampered with. In a future where our emails are encrypted with PGP, email recipients would look up the PGP public key of a email sender, and would get the one the scammer had uploaded. The reason why people hate on LetsEncrypt somewhat, is that these scammers can create a TLS certificate immediately and for free for their new phishing domain (e.g. gooooogle.com). It would have otherwise been a small financial barrier for scammers to get this setup, and some of these scammers operate on volume (trying many different domains, getting only a few victims). I think LetsEncrypt does a great job, yes there is a small price to pay to allow the rest of the internet to have secure http traffic (https). I think the real issue is of user experience. There is no easy way to check who your emails came from except from checking the from: field in the email. Reading these emails is boring and tiring. I think if email clients warned users to validate sender email addresses when receiving emails for the first time, it would make it safer. Therefore, bob@goooogle.com will show up for validation again, and the user has to read and validate it. Effectively, I suggest using "whitelists" instead of "blacklists". If I had a startup, I would think deeply about not provide emails to my employees. That's how bad I think it is. But then again, to communicate with other companies, its either email or linkedIn...