Subject: re: forwarding an encrypted message

From: "vedaal" <[email-masked]>
Date: Tue, 9 Apr 2002 16:26:55 -0400

- ----- Original Message ----- 
From: "Simon Josefsson" <[email-masked]>
To: "Marc Mutz" <[email-masked]>
Cc: <[email-masked]>; <[email-masked]>; <[email-masked]>
Sent: Tuesday, April 09, 2002 3:32 PM
Subject: Re: Bug#40394: forwarding an encrypted PGP message is useless

> 
> Marc Mutz <[email-masked]> writes:
> 
> > What if, in a mail user agent, the user wants to forward an encrypted
> > message? Allow it? Deny it?
> > Re-encrypt or remove encryption?
> >
> > The problem is, of course, that the original sender might not like his
> > encrypted text being sent out in the clear again...
> 
> Then the original sender should not send the text to someone who will
> do that.
> 
> I don't see how the standard could prevent the user from doing
> this. If it is prevented, then it is only the applications' doing, so
> it wouldn't be difficult to override it.  
...
a way to do it, would be to send the original encrypted message using the
throw- keyid switch,

any re-sending of the message would not be able to identify the original
sender,

moreover, the message could also be sent using the option of 'screen
viewing only' so that the plaintext could not be saved,
except tediously by saving a screen shot, or re-typing the message,
both of which can be 'denied' by the original sender, and can be proved by
the forwarder, only by having someone witness the decryption.

hth,

vedaal

---

From: Matthew Byng-Maddick <[email-masked]>
Date: Wed, 10 Apr 2002 09:06:16 +0100

> except tediously by saving a screen shot, or re-typing the message,

or, less tediously, altering the source code to make that a noop.

> the forwarder, only by having someone witness the decryption.

I've never put very much faith in the screen eyes-only thing for that
reason. What is the point? If you don't trust the person, don't send the
document to them. Once they have it it's their choice who they forward to,
and it's now out of your control. Tough.

MBM

-- 
Matthew Byng-Maddick         <[email-masked]>           http://colondot.net/

---

From: Ben Laurie <[email-masked]>
Date: Wed, 10 Apr 2002 14:41:50 +0100

> and it's now out of your control. Tough.

I believe the original explanation - that it was requested by someone having an
affair, who didn't trust the recipient not to _accidentally_ save to disk and
get them caught.

Cheers,

Ben.

--
http://www.apache-ssl.org/ben.html       http://www.thebunker.net/

"There is no limit to what a man can do or how far he can go if he
doesn't mind who gets the credit." - Robert Woodruff