Subject: Re: signed e-mail

From: Michael Ströder <[email-masked]>
Date: Fri, 09 Nov 2001 22:48:30 +0100

Rob G Weemhoff wrote:
> 
> To start with, why are we, as security advocates, not all using signed
> e-mail?

Because signing the e-mail on this list does not make much sense...?
Or what does your certificate really mean? Or mine? Both are
validated against "trusted" root CA certs in our browsers but that's
all.

But you're somewhat right. In most PKI projects I couldn't use
S/MIME e-mail while most project members had S/MIME capable MUAs...

Ciao, Michael.

---

From: "Rob G Weemhoff" <[email-masked]>
Date: Fri, 9 Nov 2001 18:34:51 +0100

----
Regards,
Ing. Rob G. WEEMHOFF 
Senior Consulting IT-Architect 
IBM Security and Privacy Services (EMEA)
Tel:        +31(0)20 513  9102 
Mobile: +31(0)653263269

E-mail: [email-masked] 
Fax: +31(0)33 2470578
Computerweg 8
3821 AB  Amersfoort
The Netherlands

http://www.ibm.com/security
See you at AIM (RobGWeemhoff)

---

From: Stephen Kent <[email-masked]>
Date: Tue, 13 Nov 2001 10:48:14 -0500

>To start with, why are we, as security advocates, not all using signed
Rob,

As a Mac and Eudora user, I don not appear to have a viable option 
for S/MIME support, so I don't send signed e-mail.  Otherwise I would 
do so, just to try to set a good example, even though I agree that on 
this list it would serve relatively little practical purpose.

Steve

---

From: Christine Karman <[email-masked]>
Date: Thu, 14 Nov 2002 12:11:15 +0100

>Because signing the e-mail on this list does not make much sense...?

It does. It would prevent people from spoofing, posing as someone who has 
contributed before. In e-mail, trust is built up in the course of time, not 
by the commercial company that issued your certificate.

dagdag
Christine

>Subject Name: E=[email-masked], CN=Michael Stroeder, G=Michael, 
>SN=Stroeder; Valid: False; ThumbPrint: 
>7FCFD6A4C4C52CC35434B2EC4C3F5B2E99C53123. Click 
><http://localhost/certificates/7FCFD6A4C4C52CC35434B2EC4C3F5B2E99C53123>Here 
>for more certificate info

---

From: Ricardo Barroso <[email-masked]>
Date: Thu, 14 Nov 2002 17:33:22 +0000

Hi people!

I also have made before several times to my self the Rob's question...
And I agree with Christine, I think that the people who is able to use 
signed e-mails (sorry, Stephen!) should do that
even that some people don't trust in the root CA you can at least try to 
prevent mail spoofing/impersonation.
Although we've not millions of EUR/$/£/... involved in this mailing-list 
"transactions" it can at least demonstrate, test
and even motivate other people to use digital certificates to sign their 
own e-mails.

Regards,
Ricardo Barroso

PS: 1) For the distracted people, if your e-mail client supports you can 
see that this e-mail is signed...
       2) Stephen, you can still read this mail though your browser 
doesn't support digital signatures, don't you?

MULTICERT S.A.
www.multicert.com <http://www.multicert.com>

Christine Karman wrote:

> It does. It would prevent people from spoofing, posing as someone who 
> has contributed before. In e-mail, trust is built up in the course of 
> time, not by the commercial company that issued your certificate.
>
> dagdag
> Christine
>
>> 7FCFD6A4C4C52CC35434B2EC4C3F5B2E99C53123. Click Here 
>> <http://localhost/certificates/7FCFD6A4C4C52CC35434B2EC4C3F5B2E99C53123>