3 ms·
All emails are basically signed these days via DKIM by your mail service. Each server along the chain should also be signing them too, so your whole path is kno
by withinboredom 3y ago
All emails are basically signed these days via DKIM by your mail service. Each server along the chain should also be signing them too, so your whole path is known and validated. You can validate those keys via DNS.
True story, I was an expert witness on a case once where I showed how the other guys were submitting forged emails into evidence -- by using DKIM signatures/hashes. That was probably some of the most fun I've ever had.
- Infernal 3y agoI’ve always wondered about tampering of digital evidence like that, how much it might happen and not be detected, and what the penalty would be if it were.
- withinboredom 3y agoPart of the work was explaining that a print out of an email is just a representation of the email, an actual email contains headers (like a digital stamp) that explain how the email got to where it is (in gmail -- "show original" -- that naming really helped, btw) and without it, you just have a piece of paper with words on it. The equivalent would be printing out the body of a newspaper article without the author or source. You have words, but you can't prove that it came from that newspaper unless someone else can corroborate it.
- autoexec 3y agoEmail has been around long enough that it's hard to imagine someone submitting an email as evidence without including full headers. Do you think that it was done intentionally to trick the court or was it just incompetence?
- macintux 3y agoAs best as I can recall, Outlook for the Mac doesn’t have any way to see the full headers. I’m skeptical many people know the headers exist.
- autoexec 3y agoGood point! It used to be possible in outlook, but it looks like MS took that option away for years (WTF). Recently (within the last year) they said they brought it back. In Outlook 365 for Mac you should be able to right click on a message and select "View Source" to get the message with the full headers. That's the same way people did it in Outlook for Mac 2011 I agree, most people have no idea headers exist (beyond the short headers), but I expect lawyers and law enforcement to know better. Handling digital evidence is not new and at technology's timescale email is ancient.
- sigzero 3y agoYou can but it is clunky. Save the email out as an .eml file and open it in an editor. You see all the headers.
- unyttigfjelltol 3y agoIt costs money and attention to insist on full headers. Unless the lawyers think there's something worth digging for, technical details would be omitted from copies just like they are in your email GUI. And, on the other hand, either party can demand the other prove via live witness that the evidence is authentic, reliable and useful. If the witness isnt credible, the document can be excluded.
- withinboredom 3y agoFor reasons I can’t go into detail, but it was intentional and incredibly stupid.
- 0cf8612b2e1e 3y agoKnowingly submitting fraudulent evidence is considered a pretty bad idea. Regardless if it is analog or digital.
- dpifke 3y agoDKIM helps for the headers the email provider chooses to sign (such as Subject), but does not attest as to the content of the message.
- IAmLiterallyAB 3y agoIncorrect, DKIM also signs the body of the message.
- willhackett 3y agoOnly from the mail server to the receiving mail server.
- dpifke 3y agoYou're right and I was wrong. The DKIM signer selects a list of headers (h=) to be signed, but the body is always implicitly included (and thus not listed). I was confused because I thought there needed to be a flag to include it, and had never seen such from Gmail or others. For anyone else that's curious: https://rfc-editor.org/rfc/rfc6376#section-3.7 https://rfc-editor.org/rfc/rfc6376#section-3.7