4 ms·

There's some painful truth in this comment. Not to mention - email is very easy to branch in order to more safely secure that record. If IT owns the email ser

There's some painful truth in this comment. Not to mention - email is very easy to branch in order to more safely secure that record. If IT owns the email server, and IT is fucking up... very easy to BCC/Forward a copy of the whole chain to my personal email for my own records.

k0k0r0 4y ago
I don't know much about that Email and legal stuff, but here in Germany I pay a couple of Euros every month to a well-known and respected company whose server is set up in such a way that my emails can be used in court without any issue (like claims that I altered the emails after receiving them). At least they claim that and I do believe them. I do not (yet) have a business, but I use it nevertheless. Just in case.
- devmunchies 4y ago
  > but here in Germany I pay a couple of Euros every month to a well-known and respected company whose server is set up in such a way that my emails can be used in court without any issue (like claims that I altered the emails after receiving them) That's already cryptographically built into email with DKIM. An email message is signed with a private key, and can be verified as authentic by the receiver using the public key in the sender's DNS records. Click on "Show Original" in a Gmail mail to see the meta data. https://en.wikipedia.org/wiki/DomainKeys_Identified_Mail https://en.wikipedia.org/wiki/DomainKeys_Identified_Mail
  - woodruffw 4y ago
    While this is technically true, it's not a correct use of DKIM: DKIM is meant to provide authenticity for the receiving mail server (by verifying the message against a key associated with the sending server), not nonrepudiation for the sending user. Many email providers historically used short keys (RSA <512, and later 1024) for DKIM, meaning that lots of emails circa 2012 and older appear to be nonrepudiable but in fact are. Long-term authenticity of emails is very difficult and is arguably an anti-feature; Matt Green correctly observes[1] that Google should be rotating and publishing its DKIM keys regularly to prevent people from falsely concluding that a DKIM signature is "proof" of a message's authenticity. [1]: https://blog.cryptographyengineering.com/2020/11/16/ok-google-please-publish-your-dkim-secret-keys/ https://blog.cryptographyengineering.com/2020/11/16/ok-googl...
- mytailorisrich 4y ago
  I belive that emails can be used in court without any specific setup within most EU jurisdictions or EU overall.

k0k0r0 4y ago

I don't know much about that Email and legal stuff, but here in Germany I pay a couple of Euros every month to a well-known and respected company whose server is set up in such a way that my emails can be used in court without any issue (like claims that I altered the emails after receiving them). At least they claim that and I do believe them. I do not (yet) have a business, but I use it nevertheless. Just in case.

devmunchies 4y ago
> but here in Germany I pay a couple of Euros every month to a well-known and respected company whose server is set up in such a way that my emails can be used in court without any issue (like claims that I altered the emails after receiving them) That's already cryptographically built into email with DKIM. An email message is signed with a private key, and can be verified as authentic by the receiver using the public key in the sender's DNS records. Click on "Show Original" in a Gmail mail to see the meta data. https://en.wikipedia.org/wiki/DomainKeys_Identified_Mail https://en.wikipedia.org/wiki/DomainKeys_Identified_Mail
- woodruffw 4y ago
  While this is technically true, it's not a correct use of DKIM: DKIM is meant to provide authenticity for the receiving mail server (by verifying the message against a key associated with the sending server), not nonrepudiation for the sending user. Many email providers historically used short keys (RSA <512, and later 1024) for DKIM, meaning that lots of emails circa 2012 and older appear to be nonrepudiable but in fact are. Long-term authenticity of emails is very difficult and is arguably an anti-feature; Matt Green correctly observes[1] that Google should be rotating and publishing its DKIM keys regularly to prevent people from falsely concluding that a DKIM signature is "proof" of a message's authenticity. [1]: https://blog.cryptographyengineering.com/2020/11/16/ok-google-please-publish-your-dkim-secret-keys/ https://blog.cryptographyengineering.com/2020/11/16/ok-googl...
mytailorisrich 4y ago
I belive that emails can be used in court without any specific setup within most EU jurisdictions or EU overall.