5 ms·
I forget where but someone proposed regularly rotating your DKIM key and publishing old keys for deniability. So you can still use strong keys and provide a le
by linsomniac 2y ago
I forget where but someone proposed regularly rotating your DKIM key and publishing old keys for deniability. So you can still use strong keys and provide a level of deniability.
- rsc 2y agoIn the link in the parent comment. :-)
- jabart 2y agoDoing this only provides deniability in public. If this was brought to a court there are enough server logs to build out if that DKIM record was valid along with a number of DNS history providers.
- singpolyma3 2y agoAs if courts care about any of that. They'll just ask the witness "did you send this email"
- irrational 2y agohttps://xkcd.com/538/ https://xkcd.com/538/
- danesparza 2y agoThe same is true for breaking into a building. An expensive lock won't protect you against a determined attacker.
- speerer 2y agoCounter-example: I've used DKIM as evidence in court.
- withinboredom 2y agoCounter-example example: I've been an expert witness in court to prove an email was a forgery; using DKIM.
- cbozeman 2y agoThat would be a counter-counterexample, wouldn't it?
- jonas21 2y agoNah, it supports the counter-example, so it's a counter-example example.
- singpolyma3 2y agoI'd say it refutes the counter-example. The court doesn't care about DKIM, they care about witness testimony. DKIM might have convinced the witness sometimes though.
- speerer 2y agoCourts typically do not care as much about what an expert witness thinks, as rather why they think it - and whether their reasons hold up enough that the conclusions they support should be accepted.
- inopinatus 2y agoThat is not quite correct. A court is undoubtedly interested in what an expert witness has to say. It is the lawyers appearing before the court that may attempt to play the person not the ball, by variously undermining or bolstering their standing as an expert at all.
- inopinatus 2y agoThe stacking of either term is unnecessary, because all counter-examples are also examples, thus: * an example supporting the counter-example is simply another counter-example, and * an example contradicting the counter-example is, by definition, also another counter-example. Corollary: all examples that can be opposed or contradicted by counter-examples are themselves also counter-examples.
- jillyboel 2y agoWhich is why you say "No". Then when they try to prove that you did in fact send it, this comes up.
- qingcharles 2y agoWell, if you did send it then you just perjured yourself, so you better hope you don't get caught :)
- jillyboel 2y agoYou'd be lying to the court either way if you did send it and meant to conceal it.
- SmellTheGlove 2y agoRight. There’s generally going to be other evidence. Rotating the DKIM isn’t going to save anyone relying on the shaggy defense.
- tptacek 2y agoThis isn't about evidence. In a court case, discovery and court orders can authenticate email messages even if providers publish their keys; the provider will have a record of having verified the email when it was received. But ATO attackers will not have access to those records.
- Ar-Curunir 2y agoThat was Matt Green, the person you replied to =)
- linsomniac 2y agoThere is a better than even chance that you are correct. :-)
- ryan-c 2y agoI've been doing this since around 2018, and have seen a few others implement it. https://rya.nc/dkim-privates.html https://rya.nc/dkim-privates.html
- Groxx 2y ago/me skims, reaches footnotes Sometimes you've just gotta love those auto-shortened URLs: security.googleblog.com/2013/12/internet-wide-efforts-to-fight-email.html Hopefully one day we'll win the fight.
- Bluestein 2y agoGoogle Wave, represent! PS. Of course y'all young'uns won't remember ...