jamesaepp

4 ms·

1.
by jamesaepp 6y ago
Yes, I'm satisfied with the evidence presented that the "major" vendors aren't signing their zones, but I do think we're far off-topic at this point as to whether or not the client IP address has value in the messag
2.
by jamesaepp 6y ago
The fact is that almost none of the communications we use on a daily basis are end-to-end encrypted. What response would you get if you told staff, partners, executives, support personnel, etc that the new standard was based on GPG web-of-t
3.
by jamesaepp 6y ago
The problem for the mob rests on the fact that they advertise the system as being e2e, when it is not - at least with the definition I use for e2e. https://zoom.us/security My rule-of-thumb (NOT A LITMUS TEST) for e2e is as
4.
by jamesaepp 6y ago
If only people had this type of mindset and attitude _before_ they selected a communications platform.
5.
by jamesaepp 6y ago
Short answer: No.
6.
by jamesaepp 6y ago
Thanks for the link, that's quite interesting. While web browsers can implement their own DNS resolver, that's completely irrelevant when we're talking about an MTA. The server(s) the MTA(s) are running on have their own unde
7.
by jamesaepp 6y ago
>Virtually none of the important names are signed. Source? >...Or likely ever will be Source?
8.
by jamesaepp 6y ago
I'm not sure what you mean by the "transmitted data itself is not encrypted". The payload (the packet above layer 5) is encrypted. The distinction people need to make is who the _confidentiality_ applies to. The communication
9.
by jamesaepp 6y ago
Trouble being that SPF and DKIM only work when they've been implemented correctly and they rely on DNS. That requires DNS to be resilient against attacks (DNS isn't foolproof).
10.
by jamesaepp 6y ago
While yes, email has no implicit authentication and forging an email is trivial, pulling that attack off is super difficult due to modern SPF and DKIM mechanisms. I'm not super familiar with DKIM but I'll use SPF in my example bel
11.
by jamesaepp 6y ago
I'm not looking for an argument, I've never noticed this behavior before. Why is this done? People are saying this is some kind of way to combat spamming/spoofing/malicious email but I don't see how that's the
12.
by jamesaepp 6y ago
Can someone break down what this means for me? I'm assuming an example of say Thunderbird as the MUA connects to gmail's servers with SMTP over TLS or using STARTTLS and happens to include this header of the client's public O
13.
by jamesaepp 9y ago
Wow they exchanged one monopoly for another monopoly that can use force. Genius voter population over there.