5 ms·

Kudos to Thunderbird for being the only reliable Windows email client to get S/MIME certificates right. A feature that no current webmail implemented.

by Diti 4y ago

jcims 4y ago
That just boggles my mind. I worked for an ecommerce company in 1998 and told them they should just use S/MIME instead of some bullshit proprietary encryption mechanism they used with their messaging client. It just works. But 24 years later encrypted email is still a mess.
- Dan_Sylveste 4y ago
  >But 24 years later encrypted email is still a mess. By design. Why do you think gmail strips encrypted archive attachments? Surprised they even allow S/MIME.
  - kccqzy 4y ago
    > Why do you think gmail strips encrypted archive attachments? Because Gmail can't scan for malware inside those attachments?
    - Dan_Sylveste 4y ago
      That's the stated reason, but it isn't the one I believe.
    - LaGrange 4y ago
      That's like solving air pollution issues by strangling people.
- Avamander 4y ago
  Probably because S/MIME is too expensive to reach critical mass.
  - jcims 4y ago
    It is if you’re interested in the identity of the human due to the administrative costs. Email providers could issue subscriber certs for every registered address pretty trivially. The biggest UX hurdle is handling the private keys.
    - Avamander 4y ago
      Considering how macOS/iOS will start synchronizing Webauthn tokens, I don't think S/MIME would be that difficult really. Email-validated certificates would be a nice start, but even those are expensive right now. Identity-validated is indeed administratively harder, though in my opinion that part should be done by the state/country authorities - digital driver licenses, state ID's and national ID's could just have that as well. Some EU countries have done exactly that, but software support is lacking.
      - jcims 4y ago
        I helped deploy a Verisign affiliate in Australia that had planned to do just that. I believe the post office was going to be the registration authority to vet users identity, and then there was going be some mechanism to issue a subscriber certificate from there, maybe on a smart card. This was 20 years ago, no idea how far it got. The physical security they built into the facility housing the root CA was pretty intense.
Avamander 4y ago
Gmail does do S/MIME, though non-gsuite users can only view signature status.

Kudos to Thunderbird for being the only reliable Windows email client to get S/MIME certificates right. A feature that no current webmail implemented.

by Diti 4y ago

Kudos to Thunderbird for being the only reliable Windows email client to get S/MIME certificates right. A feature that no current webmail implemented.

jcims 4y ago

That just boggles my mind. I worked for an ecommerce company in 1998 and told them they should just use S/MIME instead of some bullshit proprietary encryption mechanism they used with their messaging client. It just works. But 24 years later encrypted email is still a mess.

Dan_Sylveste 4y ago
>But 24 years later encrypted email is still a mess. By design. Why do you think gmail strips encrypted archive attachments? Surprised they even allow S/MIME.
- kccqzy 4y ago
  > Why do you think gmail strips encrypted archive attachments? Because Gmail can't scan for malware inside those attachments?
  - Dan_Sylveste 4y ago
    That's the stated reason, but it isn't the one I believe.
  - LaGrange 4y ago
    That's like solving air pollution issues by strangling people.
Avamander 4y ago
Probably because S/MIME is too expensive to reach critical mass.
- jcims 4y ago
  It is if you’re interested in the identity of the human due to the administrative costs. Email providers could issue subscriber certs for every registered address pretty trivially. The biggest UX hurdle is handling the private keys.
  - Avamander 4y ago
    Considering how macOS/iOS will start synchronizing Webauthn tokens, I don't think S/MIME would be that difficult really. Email-validated certificates would be a nice start, but even those are expensive right now. Identity-validated is indeed administratively harder, though in my opinion that part should be done by the state/country authorities - digital driver licenses, state ID's and national ID's could just have that as well. Some EU countries have done exactly that, but software support is lacking.
    - jcims 4y ago
      I helped deploy a Verisign affiliate in Australia that had planned to do just that. I believe the post office was going to be the registration authority to vet users identity, and then there was going be some mechanism to issue a subscriber certificate from there, maybe on a smart card. This was 20 years ago, no idea how far it got. The physical security they built into the facility housing the root CA was pretty intense.

Avamander 4y ago

Gmail does do S/MIME, though non-gsuite users can only view signature status.