3 ms·
You are technically correct (the best kind of correct), but in practice the nuance you're referring to does not make as much difference as you think. Yes, emai
by rainsford 3y ago
You are technically correct (the best kind of correct), but in practice the nuance you're referring to does not make as much difference as you think. Yes, email senders could send email from whatever user they want or change the body from what the user wrote, but in practice of course they aren't doing that for the kind of email providers like Gmail that most people use.
If the deniability of a DKIM signed email reduces to "maybe Gmail spoofed emails from me", you don't have much of an argument. Yes, in a technical cryptographic sense, DKIM does not prove you sent the email, but when combined with how most providers like Gmail work, it makes it very likely you did send the email in every practical sense.
This isn't just a nitpicking nuance. In theory, rotating and publishing DKIM keys makes no difference to deniability since DKIM doesn't technically provide non-repudiation at the individual user level. In practice though, a service like Gmail implementing DKIM rotation and key publishing would make emails for a huge number of users more deniable going forward.
- disruptiveink 3y agoYes, this is the point. Most (nearly all?) of the publicly available providers a user is likely to use won't allow you to use their MTAs and set From headers in a way that would impersonate someone else on that domain, provided you're authenticated as yourself. So pointing out DKIM only authenticates the domain only weakens the argument from "UserX at Gmail sent this email" to "UserX at Gmail sent this email provided no one found a suitable, currently unknown exploit at Gmail or performed an inside job". For a journalist and most juries, provided the absence of any reasonable suspicion or evidence of weaknesses / foul play at Gmail, both statements have equal strength.