Slashdot Mirror

I suppose it would make sense if you had to make an exchange of keys with someone before initiating communication. Thus, when you give out your email to people, you could give them a key that they would need in order to send you an email, and similar methods would apply to other communication mechanisms. Now the spammers will need to waste inordinate amounts of computer time computing all kinds of keys, and the practice of spamming will (hopefully) disappear. Now this being /., someone will tell me why such a scheme is impossible. :-)

It already exists. It's called S/Mime. You can learn how to use it here and here. It not only provides you with a way for receivers to know your mail is authentic, but it also allows you to send secure email if you have an S/Mime key for the receiver. (And you'll get their key the first time they sign their message to provide authenticity to you) It's like SSL for email. The major problem is that it is not pre-installed by default and most of the under-30 crowd uses web mail, therefore no one can be bothered to use it.

Mac OS X and Windows

The following has been my email sig for years. Did you know that, to date, only one person I know has made use of it?

Learn how to secure your email
(Mac OS X 10.3+) http://www.joar.com/certificates/
(Windows) http://www.marknoble.com/tutorial/smime/smime.aspx

I'll trot this pony out one more time:

(Mac OS X 10.3+) http://www.joar.com/certificates/
(Windows) http://www.marknoble.com/tutorial/smime/smime.aspx

While I appreciate the idea and all, why? It's really not worth the time to encrypt my email. Do you think that if the feds are monitoring your line, they are just going to say, "Damn! He's encrypted. Let's move on to the next." I'm going to guess not. If anything, seeing that you email is encrypted might be enough to peak their interest to make you MORE watched, not less. This also takes precious manpower away from the people who are trying to stop the next terror attack in the US. Regardless of you political opinions, I don't see how anyone could think that impeding these guys is a good thing.

Me on the other hand, I don't care. There is nothing incriminating in my email beyond sending stupid YouTube links to a buddy or bitching to the wife about who chooses whats for dinner. I'm really not interesting enough for the Feds to care about. Please take no offense when I say that I doubt anyone else here is either.

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

re: http://www.joar.com/certificates/

I read your MAC OSX article/how-to.

What? Not one mention or link to information on GPG http://www.gnupg.com/

and/or PGP???

http://www.pgp.com/

I support and use the former and recommend the latter to my Microsoft locked-in friends.

What about enigmail http://enigmail.mozdev.org/for Thunderbird

or firegpg http://firegpg.tuxfamily.org/ for firefox?

Open your mind. .mac is not the end-all and be-all...

P.S. Note that this post is signed with firegpg.
- --
Bill Arlofski
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.7 (GNU/Linux)
Comment: 'email gpgpublickey@revpol.com for my public key'

iD8DBQFHFDNKcBKMMWOpTtwRAnvtAKCSio6bcxucHd+pMxemwtkb3hwF1ACg5f0E
wdrDjE0Jh0R9szqcerv0OOQ=
=nlx9
-----END PGP SIGNATURE-----

I'll trot this pony out one more time:

(Mac OS X 10.3+) http://www.joar.com/certificates/
(Windows) http://www.marknoble.com/tutorial/smime/smime.aspx

Even if you do run your own server... well, better safe than sorry.

Learn how to secure your email
(Mac OS X 10.3+) http://www.joar.com/certificates/
(Windows) http://www.marknoble.com/tutorial/smime/smime.aspx

You yanks are all bleating on about how bad this is and how high these figures are. What makes you think your own government is being any less nosy about your affairs?

Because I encrypt my email... Learn how to secure *your* email on Mac OS X 10.3+ and Windows.

Gonzales would be permitted to force Internet providers to keep logs of Web browsing, instant message exchanges, or e-mail conversations indefinitely.

Other than email, I'd be really surprised if most ISPs logged anything in the first place. As for email... nothing has ever protected you there unless you use encryption. Learn how to secure your email for Mac OS X 10.3+ and Windows.

In short, that statement would be a lot scarier if the word "indefinitely" were omitted.

• Mac OS X 10.3+
• Windows

You can get a free personal certificate from Thawte that works great. Once you've setup your account with them, you can create a signature for each email address you use. On the Mac side, you just download the certificate, and the Mac takes care of automatically installing it. Mail will also detect the certificates you install, and you'll see sign and encrypt (provided you have the recipients public key) buttons when you compose new messages. Here's a tutorial on getting it up and running with Mail:

http://joar.com/certificates/

It also works with Outlook, Outlook Express, Thunderbird, and Mozilla:

http://www.marknoble.com/tutorial/smime/smime.aspx

I feel it is appropriate to mention this page. It can also help with the spam filtering. Spammers don't sign their email :-)

I'm a Belgian citizen. I've been signing and encrypting email using a free S/MIME certificate since it was possible on OS X.

I hope this card will enable more people to do this with more ease of use and more security. But I doubt it, given our gov's tradition with Microsoft.

I use a Thawte p.cert to sign my email - there's a good writeup on configuring it to work with OSX's Mail.app here -- also a good example on how to provide visually appealing technical documentation that I can talk non-technically inclined people into reading.

Learn how to cryptographically sign your mail in Panther

If your messages are encrypted, then you don't have to worry about automated programs kicking them for their content or attachments. That will be up to the decrypting party. I pity the ISP that starts blocking messages because they are encrypted.

Learn how to cryptographically sign your mail on Mac OS X 10.3

Well at least if your using Mac OS X 10.3 Mail.app

I used this tutorial on how to certify my email adress so the one receiving my email will know that's it me. Also when the receiver and the sender got a certified email adress you can encrypt your email adress.

Yes I know about PGP but this is much easier since Mail automatically adds the senders key for you when you get a mail that's signed.

I keep hoping that digital signatures will become common place. I recently setup a digital signature on my mail client (instructions for Mac users) and I'm impressed at how easy it is to use. With a small cadre of of my email buddies I can easily confirm the sender and encrypt communications. If I'm particular, the read-receipt does the job for me to know that it was sent, but rarely do I doubt this.

I'm afraid my trust in digital signatures may be naive though. They are too hard to setup. Does anyone know of any concerted efforts in this area?