4 ms·

My secure email provider is /usr/local/bin/gpg, so ... yes?

• jimktrains2 13y ago
  Still leaks email metadata:)
  • wiml 13y ago
    Very true :) But with a little statistical analysis, that's true of basically all communication. An organization with the NSA's resources can automatically infer a set of people I probably talk to even if they can't directly observe my communications with them. I'm not willing to turn my life into a Le Carre novel, and I think that's the level of effort it'd take.
  • DanBC 13y ago
    Which is cryptographically tied to an identity.
    • icebraining 13y ago
      Nope, just to a key.
      • DanBC 13y ago
        So Ann doesn't know she's really talking to Bob? Ann just has some key that she hopes is Bob's, and isn't Eve doing MITM? Isn't that why web-of-trust is important?
        • mbq 13y ago
          Nope, that Eve can intercept a copy of GPG-encrypted mail and extract plaintext To, From, Title, time, with some luck also some info about sender's IP and software, plus all info that is in recipient's and possibly sender's public key (this usually covers full, true name, work, approximate location and alternative e-mails, often also a photo). What you mention is an orthogonal problem.
          • DanBC 13y ago
            Hang on, I'm a bit confused here. Ann has a key. Ann must know that the key is Bob's key. If Ann isn't sure that the key is Bob's key there's a bunch of bad stuff that might happen. So now Eve can get the metadata, and be pretty sure that the stuff sent to Bob actually is sent to Bob, and not someone else, because it's encrypted with Bob's public key. Eve can't decrypt anything. But my post wasn't about Eve getting any content, it was about Eve getting metadata that's cryptographically tied to an identity. Where am I going wrong?
            • jimktrains2 13y ago
              The connection between key and identity doesn't have to be public. The point is that the headers of an email aren't encrypted (otherwise it couldn't be delivered). In the headers is who the message is to, who it's from, the subject, the time, and if you're lucky, the ip of the sender. All of that isn't encrypted and free for the taking and has nothing to do with the id attached to the key used to encrypt the content.
              • DanBC 13y ago
                Right, the metadata is always public. Without strong encryption you have metadata that can be tied to an identity using statistics with enough data. With strong encryption you have metadata that can be tied to a key and an identity using statistics with enough data.
        • hollerith 13y ago
          Who is Ann, and what have you done with Alice :)
          • jimktrains2 13y ago
            Perhaps Bob knows both Alice and Ann and is using encryption so that Alice doesn't find out about Ann;)