It's not really a concern as far as the DoD is concerned.
If something needs a digital signature, then the person sending it is going to know how to configure their Outlook client to send in plaintext anyway. Our Outlook clients don't come "preconfigured" for signing, so the user has to know:
1. What a certificate is. 2. Configure ActivCard Gold on their machine to register the cert. 3. Navigate Outlook and find the security prefs. 4. Which cert to actually use with Outlook (there are 3 on each CAC card.) 5. To use THEIR cert, there are often more than just yours on any given machine.
From a DoD point of view, email coming in from "The Wild" from family and friends doesn't need a signature anyway, so it's not going to matter if a signature gets borked when the HTML is stripped. And if it's coming from a vendor who actually needs to use a signature, they'll be able to meet all five criteria mentioned above, and won't even use HTML.
OR...the NOC will simply add their domain to the whitelist and let it through.
Also, if the email is coming from a.mil domain, then it will arrive with HTML intact. If the generals/admirals didn't have the ability to automatically indent and inject their [Username] when replying, they'd collapse in a fit of frothing and twitching.
The DoD really hasn't ramped up the whole digital signature thing quite yet. They talk a big deal, but when it comes down to the Nuts&Bolts implementation, the only ones using it are the geeks, not the grunts.
Bad People already knew about this several years ago.
Good People found out about it and let MORE Good People know about it.
Now the Bad People cannot hide what they would do if we, the Good People, had been ignorant.
True, such knowledge would allow stupid Bad People to do Stupid Bad Things, but that is one of the True Prices of Freedom. With great knowledge comes great responsibility. If in the process of informing Good People about Bad Things, someone uses that information for Evil, then I will willingly pay the price.
"He who would trade freedom for peace or security deserves neither." -Benjamin Franklin
Slashdot Mirror
It's not really a concern as far as the DoD is concerned.
.mil domain, then it will arrive with HTML intact. If the generals/admirals didn't have the ability to automatically indent and inject their [Username] when replying, they'd collapse in a fit of frothing and twitching.
If something needs a digital signature, then the person sending it is going to know how to configure their Outlook client to send in plaintext anyway. Our Outlook clients don't come "preconfigured" for signing, so the user has to know:
1. What a certificate is.
2. Configure ActivCard Gold on their machine to register the cert.
3. Navigate Outlook and find the security prefs.
4. Which cert to actually use with Outlook (there are 3 on each CAC card.)
5. To use THEIR cert, there are often more than just yours on any given machine.
From a DoD point of view, email coming in from "The Wild" from family and friends doesn't need a signature anyway, so it's not going to matter if a signature gets borked when the HTML is stripped. And if it's coming from a vendor who actually needs to use a signature, they'll be able to meet all five criteria mentioned above, and won't even use HTML.
OR...the NOC will simply add their domain to the whitelist and let it through.
Also, if the email is coming from a
The DoD really hasn't ramped up the whole digital signature thing quite yet. They talk a big deal, but when it comes down to the Nuts&Bolts implementation, the only ones using it are the geeks, not the grunts.
As usual.
Bad People already knew about this several years ago.
Good People found out about it and let MORE Good People know about it.
Now the Bad People cannot hide what they would do if we, the Good People, had been ignorant.
True, such knowledge would allow stupid Bad People to do Stupid Bad Things, but that is one of the True Prices of Freedom. With great knowledge comes great responsibility. If in the process of informing Good People about Bad Things, someone uses that information for Evil, then I will willingly pay the price.
"He who would trade freedom for peace or security deserves neither." -Benjamin Franklin