9 ms·
For a number of years it was (non-officially) thought to be a feature to use weak DKIM keys. Some folks argued that short keys allowed you to preserve deniabili
by matthewdgreen 2y ago
For a number of years it was (non-officially) thought to be a feature to use weak DKIM keys. Some folks argued that short keys allowed you to preserve deniability, since DKIM signatures would only be short-lived and nobody would be able to use DKIM signatures to prove that any email was authentic. (I’m not saying that this is why most companies used short keys, just that there was a general view that short keys were not all bad.)
DKIM deniability is a particular hobbyhorse of mine [1]. These short keys are obviously not the way to achieve it, but I view this kind of thing as a result of the muddled thinking that’s been associated with DKIM and the community’s lack of desire to commit to the implications of an all-email signing mechanism.
[1] https://blog.cryptographyengineering.com/2020/11/16/ok-google-please-publish-your-dkim-secret-keys/ https://blog.cryptographyengineering.com/2020/11/16/ok-googl...
- linsomniac 2y agoI forget where but someone proposed regularly rotating your DKIM key and publishing old keys for deniability. So you can still use strong keys and provide a level of deniability.
- rsc 2y agoIn the link in the parent comment. :-)
- jabart 2y agoDoing this only provides deniability in public. If this was brought to a court there are enough server logs to build out if that DKIM record was valid along with a number of DNS history providers.
- singpolyma3 2y agoAs if courts care about any of that. They'll just ask the witness "did you send this email"
- irrational 2y agohttps://xkcd.com/538/ https://xkcd.com/538/
- danesparza 2y agoThe same is true for breaking into a building. An expensive lock won't protect you against a determined attacker.
- speerer 2y agoCounter-example: I've used DKIM as evidence in court.
- withinboredom 2y agoCounter-example example: I've been an expert witness in court to prove an email was a forgery; using DKIM.
- cbozeman 2y agoThat would be a counter-counterexample, wouldn't it?
- jonas21 2y agoNah, it supports the counter-example, so it's a counter-example example.
- singpolyma3 2y agoI'd say it refutes the counter-example. The court doesn't care about DKIM, they care about witness testimony. DKIM might have convinced the witness sometimes though.
- speerer 2y ago
- SmellTheGlove 2y agoRight. There’s generally going to be other evidence. Rotating the DKIM isn’t going to save anyone relying on the shaggy defense.
- tptacek 2y agoThis isn't about evidence. In a court case, discovery and court orders can authenticate email messages even if providers publish their keys; the provider will have a record of having verified the email when it was received. But ATO attackers will not have access to those records.
- Ar-Curunir 2y agoThat was Matt Green, the person you replied to =)
- linsomniac 2y agoThere is a better than even chance that you are correct. :-)
- ryan-c 2y agoI've been doing this since around 2018, and have seen a few others implement it. https://rya.nc/dkim-privates.html https://rya.nc/dkim-privates.html
- Groxx 2y ago/me skims, reaches footnotes Sometimes you've just gotta love those auto-shortened URLs: security.googleblog.com/2013/12/internet-wide-efforts-to-fight-email.html Hopefully one day we'll win the fight.
- Bluestein 2y agoGoogle Wave, represent! PS. Of course y'all young'uns won't remember ...
- GTP 2y agoIsn't deniability at odds with DKIM's goal? What would be the point of setting DKIM then? Sure, it helps with spam scores. But most companies rely on a major email provider to send emails, so maybe they wouldn't have deliverability issues anyway?
- marcosdumay 2y agoYes. Deniability and perfect forward secrecy are at odds with how people use email anyway. But that doesn't stop people from demanding both very loudly, and some people from promising them.
- matthewdgreen 2y agoI don't know what you're saying. Most email isn't encrypted so PFS wouldn't apply to the content of email messages. When you mention PFS are you talking about email encrypted with something like GPG/PGP? Or are you talking about PFS in the context of the TLS connections used to protect SMTP? I'm not sure what "deniability" refers to in your post and how you think people use email in ways that would contraindicate it. Once I understand what you're saying, I guess we could move on to who the demanders and promisers are and what you think they're doing.
- dfc 2y agoYou should read the blog post Prof. Green linked to. All of your questions are addressed there.
- GTP 2y agoYes, I've now read it and it answered those questions. But it also stumbled upon an easier possible solution without realizing it: if you wish to pretend you didn't send some emails, you can still claim that someone stole your password. Whether this claim will be believed or not, is independent of DKIM. Spoofing is a better excuse than a stolen password only in the case of a single email. If there's a conversation spanning multiple messages, a spoofer wouldn't be able to properly answer the messages of the other party, as he doesn't receive them.
- lupusreal 2y agoMeanwhile in the real world, screenshots of emails without any cryptographic authentication at all are good enough to send people to prison.
- anonym29 2y agoI absolutely believe you - lawyers, judges, and juries alike tend to be technologically illiterate, but do you have any references/links to this happening?
- OJFord 2y agoIn particular where the defendant denies the veracity of the screenshot.
- matthewdgreen 2y agoIf you read the blog post, you'll see that newspapers frequently verify DKIM signatures on stolen email corpora before they publish about them. Eg: https://www.propublica.org/nerds/authenticating-email-using-dkim-and-arc-or-how-we-analyzed-the-kasowitz-emails https://www.propublica.org/nerds/authenticating-email-using-...
- tsimionescu 2y agoThey were asking for evidence that people have been convicted based on screenshots of emails, almost the opposite of using DKIM to authenticate emails.
- tptacek 2y agoThe issue here isn't rules of evidence, it's user privacy. In the real world, DKIM has repeatedly been used to violate privacy. More importantly: latent verifiable secure DKIM signatures on archived emails offer no value to users; they literally only have real-world value to attackers.
- tsimionescu 2y ago
- phkahler 2y agoWhat's the problem with verifiable email? You can just delete old emails (if gmail or whoever archives them that's another problem). Most people probably operate under the assumption that email is verifiable in some way anyway. If you receive malicious email, isn't it a good thing to be able to verify where it came from? Doesn't that benefit senders and receivers alike? Or is this a case of "I want to verify you, but I don't want you to verify me"?
- deleted 2y ago[deleted]
- infogulch 2y agoIt's more "I want you to be able to verify I sent an email to you, but I don't want you to be able to prove to a third party that I sent it." The fact that this is possible is some cryptography black magic.
- phkahler 2y agoSounds nefarious. Why would a sender want the recipient to verify authenticity while being able to deny it to a 3rd party. Sending threats or blackmail come to mind as top uses. Breaking confidentiality agreements is another. What's a legit honest above board use?
- meindnoch 2y agoI don't see how this could be possible. If I have some information which I can use to prove that you were the sender, then I can just share the same information with a third party, and they can verify just the same.
- kstrauser 2y agoThe idea is that for spam filtering purposes, you can prove this morning that the email I sent you this morning came from me, because I’m the only person who had the signing key on it. Anyone else could validate that too. But let’s say I publish that signing key tomorrow. Once I do that, you can’t prove I sent today’s mail because anyone could’ve used that published key tomorrow forget the signature.
- ls612 2y ago[flagged]
- throitallaway 2y agoIt's tiring that most things have to come back to politics nowadays.
- matja 2y agoI don't think this rationale is correct. DKIM doesn't authenticate a user, since the user doesn't the private key - DKIM authenticates that the MTA knows the private key on behalf of the domain owner, which isn't necessarily the users using that domain to send email. What's more dangerous is that a jury wouldn't know the difference.
- password4321 2y agoFor 20 years Fastmail allowed any customer to spoof From: another https://news.ycombinator.com/item?id=42536750#42539217 https://news.ycombinator.com/item?id=42536750#42539217
- JackSlateur 2y agoHa, at least ! Thank you for the comment. If there is some mail from my addr, with a valid DKIM signature, it proves nothing: - perhaps the mail was sent by somebody else on the same plateform, but in my name (identity usurpation of the user part of the mail) - perhaps somebody got illegal access to my email account, without me knowing - .. ? In no case it proves that I, as a human, sent this email. But of course, justice is a fiction that cannot exist: there is no justice, only probabilities (and feelings :( ).
- rstuart4133 2y agoFrom the blog: > The fix would cost you basically nothing, and would remove a powerful tool from hands of thieves. Maybe that was true a while ago, but it becoming much less true now. Most people and organisations outsource the email handling to the likes of Google and Microsoft. They tend to reject email that isn't DKIM signed, and add a "DKIM validated" header to those that are. "Tend" is probably too weak a word now - email that isn't signed isn't likely to be delivered. So the mostly likely scenario now is "someone steaks email that can no longer be DKIM validated, but it is possible prove it was DKIM validated when it was received". If that's true rotating keys doesn't help.
- tptacek 2y agoThe idea isn't to stop Google from signing and validating DKIM. It's that the major players who do DKIM should rotate and publish their keys, so that at any given instant their current DKIM key is only valid for N hours, and after that it's public, so anyone can forge backdated messages.