Subject: [art] verify envelope and who is email

From: pradeep xplorer <[email-masked]>
Date: Thu, 11 Oct 2018 02:14:30 +0000

I am again stressing the need for two applications
Verify envelope that verifies who the sender is
Who is email address that shows the credentials or identity documents or certificates of a email owner. This can be password protected or shown only if the user has the public key of the email owner.
With these laws can be enacted so emails can be used instead of sending registered snail mail
Right now banks and govts are getting away with solving my situation based on emails. I have health problems because of lack of lifestyle that cannot be postponed
And all these could have been delivered by engineers on payroll years ago
All desktops using emails should have access to these standard applications
Pradeep Kumar xplorer

---

From: Ben Campbell <[email-masked]>
Date: Wed, 10 Oct 2018 21:41:52 -0500

(as individual)

Hi Pradeep,

The applications you propose seem to accomplish the same thing as cryptographic signatures and a PKI. Those technologies already exist. As far as I can tell, the only functional difference is that they are optional to use, and I gather you wish for something that is mandatory. The IETF can provide tools, but it cannot establish policy to force their deployment or use. That power belongs to governments.

Ben.

> On Oct 10, 2018, at 9:14 PM, pradeep xplorer <[email-masked]> wrote:
> 
> _______________________________________________
> art mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/art

---

From: pradeep xplorer <[email-masked]>
Date: Thu, 11 Oct 2018 02:55:47 +0000

Please be specific where are the tools. I am using android where are the tools in Google play store?. I am saying tools are not available. If i am wrong correct me point me to the tools available for major platforms.
Pradeep Kumar xplorer
________________________________
From: Ben Campbell <[email-masked]>
Sent: Thursday, October 11, 2018 8:11:52 AM
To: pradeep xplorer
Cc: Yakov Shafranovich; [email-masked]
Subject: Re: [art] verify envelope and who is email

(as individual)

Hi Pradeep,

Ben.

---

From: Ben Campbell <[email-masked]>
Date: Wed, 10 Oct 2018 22:08:52 -0500

To be clear, the IETF is also not a software development shop. We make standards, not code. We cannot make people implement, deploy or use them.

Digital signatures will only help your problem if people use them, and they are not used widely. But if we introduce even more tools to accomplish a subset of the same thing, they will likely be used even less widely.

But to your specific question: A DuckDuckGo search for “s/mime for android” turns up several hits. I am not an Android user, so I do not have experience with any of them.

Ben.

> On Oct 10, 2018, at 9:55 PM, pradeep xplorer <[email-masked]> wrote:
>

---

From: Yakov Shafranovich <[email-masked]>
Date: Wed, 10 Oct 2018 23:14:12 -0400

The SPF and DKIM protocols allow verification of the envelope against
a domain name and some of the headers / content respectively
(depending on configuration). There are additional protocols like
DMARC, DANE, etc. which provide additional functionality in this
space. The initial development of these protocols was done in IRTF's
ASRG group back in 2001 and on. However, as Ben said, we cannot force
people to use them.

May of these are in-use today by most major email providers. For
example, Gmail added DKIM support back in 2008:
https://gmail.googleblog.com/2008/07/fighting-phishing-with-ebay-and-paypal.html

Here is information about Hotmail support for SPF and DKIM:
https://wordtothewise.com/2012/12/hotmail-moves-to-spf-authentication/
https://blogs.msdn.microsoft.com/tzink/2016/10/18/hotmailoutlook-com-evaluates-dkim-a-little-differently-than-office-365/

A more extreme case of how DKIM digital signatures were used is the
case of Wikileaks using Gmail's DKIM keys to verify the authenticity
of stolen/leaked DNC emails in 2016:
https://blog.erratasec.com/2016/10/yes-we-can-validate-wikileaks-emails.html

Thanks

---

From: Yakov Shafranovich <[email-masked]>
Date: Wed, 10 Oct 2018 23:17:06 -0400

To be clear, this accomplishes verification of various types of
Internet identifiers like email addresses against other Internet
identifiers like domain names. These protocols do not necessarily
address the issue of how to verify something on the Internet against a
real world identity, although the PKI pieces may lead in that
direction.

Thanks
On Wed, Oct 10, 2018 at 11:14 PM Yakov Shafranovich

---

From: pradeep xplorer <[email-masked]>
Date: Thu, 11 Oct 2018 06:46:29 +0000

>From the answers it looks like theres no application verifyenvelope like putty that can be downloaded and used to verify envelope of an inbound email because some combination of human intelligence and software has to be used to do this task and cannot be completely automated. It is not available on each and every desktop that can recieve emails. OR this is not implemented and released because of some policy decisions. By that i mean the expertise and technology is available making it widely available as a app that can be downloaded and used would lead to problems for some and they are against it becoming available.

________________________________
From: Yakov Shafranovich <[email-masked]>
Sent: Thursday, October 11, 2018 8:47 AM
To: Ben Campbell
Cc: [email-masked]; [email-masked]
Subject: Re: [art] verify envelope and who is email

Thanks