To be clear, the reason the above comment is downvoted, is because the issue in the article will not be solved by signing emails. Signing is a way of ensuring the email has not been tampered with. The attacker created a domain that looks similar to the original (e.g. using gooogle.com instead of google.com). Google gets around this by owning all the alternatives but many other companies cannot realistically do this). Even if we had secure end-to-end email, their emails would still be signed because the scammers are using their domain, and can set DKIM, SPF, DMARC records to ensure their emails are not tampered with. In a future where our emails are encrypted with PGP, email recipients would look up the PGP public key of a email sender, and would get the one the scammer had uploaded.
The reason why people hate on LetsEncrypt somewhat, is that these scammers can create a TLS certificate immediately and for free for their new phishing domain (e.g. gooooogle.com). It would have otherwise been a small financial barrier for scammers to get this setup, and some of these scammers operate on volume (trying many different domains, getting only a few victims). I think LetsEncrypt does a great job, yes there is a small price to pay to allow the rest of the internet to have secure http traffic (https).
I think the real issue is of user experience. There is no easy way to check who your emails came from except from checking the from: field in the email. Reading these emails is boring and tiring. I think if email clients warned users to validate sender email addresses when receiving emails for the first time, it would make it safer. Therefore, bob@goooogle.com will show up for validation again, and the user has to read and validate it.
Effectively, I suggest using "whitelists" instead of "blacklists". If I had a startup, I would think deeply about not provide emails to my employees. That's how bad I think it is. But then again, to communicate with other companies, its either email or linkedIn...
The point here is that I could sign any email as long as I control the address. The fact that an email is signed does not mean it's to be trusted. Same with https.
That is not what the comment says. The comment says:
but all these scams would not work in a world where authors and publishers only trust signed e-mails.
Not that people will take the time and effort to verify the signatures. Not to mention that you can still call them and say "eeeh I'm Jones, you know, I just had to renew my signature, so it won't check, but it's me. bye"
Comments
It would be like https: worthless because of Let's Encrypt
To be clear, the reason the above comment is downvoted, is because the issue in the article will not be solved by signing emails. Signing is a way of ensuring the email has not been tampered with. The attacker created a domain that looks similar to the original (e.g. using gooogle.com instead of google.com). Google gets around this by owning all the alternatives but many other companies cannot realistically do this). Even if we had secure end-to-end email, their emails would still be signed because the scammers are using their domain, and can set DKIM, SPF, DMARC records to ensure their emails are not tampered with. In a future where our emails are encrypted with PGP, email recipients would look up the PGP public key of a email sender, and would get the one the scammer had uploaded.
The reason why people hate on LetsEncrypt somewhat, is that these scammers can create a TLS certificate immediately and for free for their new phishing domain (e.g. gooooogle.com). It would have otherwise been a small financial barrier for scammers to get this setup, and some of these scammers operate on volume (trying many different domains, getting only a few victims). I think LetsEncrypt does a great job, yes there is a small price to pay to allow the rest of the internet to have secure http traffic (https).
I think the real issue is of user experience. There is no easy way to check who your emails came from except from checking the from: field in the email. Reading these emails is boring and tiring. I think if email clients warned users to validate sender email addresses when receiving emails for the first time, it would make it safer. Therefore, bob@goooogle.com will show up for validation again, and the user has to read and validate it.
Effectively, I suggest using "whitelists" instead of "blacklists". If I had a startup, I would think deeply about not provide emails to my employees. That's how bad I think it is. But then again, to communicate with other companies, its either email or linkedIn...
This analogy is flawed in two points:
1. Let's Encrypt isn't useless
because
2. With certificates you can be sure, the message you received, is from the certificate owner. This applies to websites and emails.
The point here is that I could sign any email as long as I control the address. The fact that an email is signed does not mean it's to be trusted. Same with https.
From where would you get the private PGP key of the person who owns the email address?
That is not what the comment says. The comment says:
Not that people will take the time and effort to verify the signatures. Not to mention that you can still call them and say "eeeh I'm Jones, you know, I just had to renew my signature, so it won't check, but it's me. bye"
Can you please elaborate why LE.org makes https worthless? I don’t want to make improper assumptions as to your meaning