4 ms·

along the same lines, did you know that you can get an authenticated email that the listed sender never sent to you? If the third party can get a server to sen

along the same lines, did you know that you can get an authenticated email that the listed sender never sent to you? If the third party can get a server to send it to themselves (for example Google forms will send them an email with the contents that they want) they can then forward it to you while spoofing the from: field as Google.com in this example, and it will appear in your inbox from the "sender" (Google.com) and appear as fully authenticated - even though Google never actually sent you that. This is another example where you would think that "who it's for" is something the sender would sign but nope!

tennysont 6mo ago
I asked about this on the PGP mailing list at one point, and I think I was told that the best solution is to start emails with "Hi <recipient>," which seems like a funny low-tech solution to a (sad) problem.
- HanyouHottie 6mo ago
  The solution to this problem without needing to modify your message is to use a protocol that will sign, then encrypt, then sign again. See section 5 here [1] or section 15 here [2]. [1] https://theworld.com/~dtd/sign_encrypt/sign_encrypt7.html https://theworld.com/~dtd/sign_encrypt/sign_encrypt7.html [2] https://computerresearch.org/index.php/computer/article/view/100954/2-High-Security-by-using-Triple_html https://computerresearch.org/index.php/computer/article/view...
  - tennysont 6mo ago
    > without needing to modify your message Careful. I argue this is even worse. In this convention, you need to change the behavior of others. If I send a message to Alice with contents "Hey, I can't meet today" using your sign-encrypt-sign scheme, then Alice can take the inner most layer and use it to impersonate me. Alice can send "Hey, I can't meet today" to Bob at any time. I must rely on Bob demanding proof that he was, in fact, the intended recipient. From the first link: > Note though that an effective security standard should require not only that the author must provide one of these five proofs, but also that the recipient must demand some such proof as well. If your convention was upgraded into a protocol with automatic verification, then that would be different.

tennysont 6mo ago

I asked about this on the PGP mailing list at one point, and I think I was told that the best solution is to start emails with "Hi <recipient>," which seems like a funny low-tech solution to a (sad) problem.

HanyouHottie 6mo ago
The solution to this problem without needing to modify your message is to use a protocol that will sign, then encrypt, then sign again. See section 5 here [1] or section 15 here [2]. [1] https://theworld.com/~dtd/sign_encrypt/sign_encrypt7.html https://theworld.com/~dtd/sign_encrypt/sign_encrypt7.html [2] https://computerresearch.org/index.php/computer/article/view/100954/2-High-Security-by-using-Triple_html https://computerresearch.org/index.php/computer/article/view...
- tennysont 6mo ago
  > without needing to modify your message Careful. I argue this is even worse. In this convention, you need to change the behavior of others. If I send a message to Alice with contents "Hey, I can't meet today" using your sign-encrypt-sign scheme, then Alice can take the inner most layer and use it to impersonate me. Alice can send "Hey, I can't meet today" to Bob at any time. I must rely on Bob demanding proof that he was, in fact, the intended recipient. From the first link: > Note though that an effective security standard should require not only that the author must provide one of these five proofs, but also that the recipient must demand some such proof as well. If your convention was upgraded into a protocol with automatic verification, then that would be different.