11 ms·
I’m so sad there aren’t free certificates for emails address anymore. S/MIME is so easy to use and makes so much sense…
by frizlab 2y ago
I’m so sad there aren’t free certificates for emails address anymore. S/MIME is so easy to use and makes so much sense…
- tptacek 2y agoIt makes sense if end-to-end security isn't a requirement; otherwise: it chains up to certificate authorities. From a security engineering perspective, CAs are what you use when you have constant introductions between mutually untrusted parties. That's not how email conversations work!
- dogma1138 2y agoS/MIME is still end to end encrypted. The fact that it relies on certificates means that it doesn’t protects against spoofing and one can argue that the certificate chain makes spoofing “easier” by creating an implicit chain of trust. However pretty much every E2EE protocol doesn’t addresses spoofing without a side channel exchange of some sort which would allow you to pin the key of the party you wish to communicate with.
- frizlab 2y agoMaybe there is actually; I’ll try that. https://github.com/polhenarejos/acme_email https://github.com/polhenarejos/acme_email EDIT: Mostly useless; have to trust a root CA (CASTLE).
- frizlab 2y agoActalis does do free S/MIME certificates for private use, but they do not allow using your own CSR. They generate the private key for you and allow you to download it, but the key stays on the server forever AFAICT.