Subject: [openpgp] On Signed-Only Mails

From: Vincent Breitmoser <[email-masked]>
Date: Tue, 29 Nov 2016 10:18:37 +0100

Hi all,

(cross-posting on openpgp and messaging mls)

during my work on bringing OpenPGP to K-9 Mail, I found myself
reevaluating a lot of things. This time it's about signed-only mails.

In short, my conclusion so far is that signed-only mails are very rarely
useful, they are holding OpenPGP back as a solution for encrypted
e-mail, and in the interest of usability we should not roll them out in
email crypto solutions on equal terms with encryption.

In some more detail:
https://k9mail.github.io/2016/11/24/OpenPGP-Considerations-Part-I.html

I received positive as well as negative feedback about this, and I'd
love to hear more thoughts about it.

 - V

---

From: Peter Gutmann <[email-masked]>
Date: Tue, 29 Nov 2016 09:25:45 +0000

Vincent Breitmoser <[email-masked]> writes:

>[...] Signed-Only Mails are Useless [...]

Yup, and it's for exactly the reasons given there that the S/MIME WG decided
many years ago not to sign messages sent to the list.  Courts, similarly, rule
on the intent of the signer, not some attached bag of bits (see e.g. Steven
Mason's excellent "Electronic Signatures in Law").  So while I wouldn't go so
far as to call them harmful, I'd agree that they're mostly useless, unless
you're using one to make some special point.  Even then, if it's for legal
purposes, a court will look at almost everything but the signature when
deciding on its effect.

Peter.

---

From: Vincent Breitmoser <[email-masked]>
Date: Tue, 29 Nov 2016 10:29:47 +0100

> So while I wouldn't go so far as to call them harmful

More specifically, harmful for UX. Dragging them along as a feature does
not make UX design easier :)

 - V

---

From: Peter Gutmann <[email-masked]>
Date: Tue, 29 Nov 2016 09:36:42 +0000

>not make UX design easier :)

 Ah, yes, in that case it's definitely harmful.

Peter.

---

From: Kristian Fiskerstrand <[email-masked]>
Date: Tue, 29 Nov 2016 10:58:43 +0100

On 11/29/2016 10:18 AM, Vincent Breitmoser wrote:
> love to hear more thoughts about it

Confidentiality is not a requirement for a number of my use cases, but
integrity control (including authentication) is. Clearsigned messages
can make archiving easier, and allow for sharing of information across
groups, while still maintaining it is in non-modified form from an
authorized party.

Incidentally I do request confirmation through signed media on a
context-dependent basis in the event of receiving non-signed email.

-- 
----------------------------
Kristian Fiskerstrand
Blog: https://blog.sumptuouscapital.com
Twitter: @krifisk
----------------------------
Public OpenPGP keyblock at hkp://pool.sks-keyservers.net
fpr:94CB AFDD 3034 5109 5618 35AA 0B7F 8B60 E3ED FAE3
----------------------------
Nosce te ipsum!
Know thyself!

---

From: Vincent Breitmoser <[email-masked]>
Date: Tue, 29 Nov 2016 11:18:45 +0100

> Clearsigned messages can make archiving easier, and allow for sharing
> of information across groups, while still maintaining it is in
> non-modified form from an authorized party.

Incidentally, this aligns with a thought Bjarni brought up just
recently:

https://github.com/mailpile/Mailpile/issues/1693

 - V

---

From: Brian Sniffen <[email-masked]>
Date: Tue, 29 Nov 2016 14:13:18 -0500

> https://k9mail.github.io/2016/11/24/OpenPGP-Considerations-Part-I.html

Perhaps you don't see the use cases, but I see many every day: signed
e-mail messages for e-mail based manipulation of databases (e.g., bug
trackers, auto-builders, deployment systems).  Clearsigning is
particularly useful because it lets me CC others (they see the command
language, have an opportunity to learn it, question my action---the
social setting of e-mail works very well for interaction with this sort
of command language).

I suppose I could just clearsign a region of a text e-mail, but (a) that
means I need an even more complex UI on mobile devices, and (b) I don't
trust my mail chain not to screw up the formatting---which is part of
why we have PGP/MIME in the first place.  The next-best alternative is
a web interface, but that removes the ability to manage it through
mail---with all the threading and conversation conventions that come
with it.

I'm also curious about the UI: do you expect to only offer
(encrypted+signed) and (plaintext)?  If there are separate toggles for
encryption and signature anyway, what's the UI benefit?

-Brian

---

From: "brian m. carlson" <[email-masked]>
Date: Wed, 30 Nov 2016 03:03:33 +0000

> love to hear more thoughts about it.

I work for a company where all mail needs to be signed.  If someone
wants me to install an SSH public key on a server, I need to be certain
that the person is who they say they are.  Furthermore, if one of the
system administrators sends an announcement email to the all-users list,
encrypting it to all possible employees at the company is not practical.
Signing it is still useful, especially if it includes something like a
Wi-Fi configuration file that people might use on their systems.

I use K-9 Mail for personal and work purposes, and I rely immensely on
the ability to send signed-only emails, often to mailing lists.  I think
that's an extremely common and important use case that we shouldn't
forget about.  Integrity is important even in cases where
confidentiality is not.
-- 
brian m. carlson / brian with sandals: Houston, Texas, US
+1 832 623 2791 | https://www.crustytoothpaste.net/~bmc | My opinion only
OpenPGP: https://keybase.io/bk2204

---

From: Alexander Strobel <[email-masked]>
Date: Wed, 30 Nov 2016 10:03:13 +0100

> email crypto solutions on equal terms with encryption.

I don't think signed only emails are useless. In my personaly opinion I
would love to see all companies sending out signed emails that contain
invoices.
If any company would change their email addresses or someone from
another department sends me an email, I would know that this is
(presumably) not a phishing attack. (At least was sent from someone
within this company which gives me some more trust in the reliability of
its contents.) At the moment I receive an email with a sender address
that might or might not belong to the company. How can I know?
Sure, the company had to put the fingerprints of their key(s) on their
website or tell it on the phone and I would have to check it, but that's
not a very big problem.
Maybe I miss something but, in this case signing seems a good idea to me.

Best regards
 Alex Strobel
 www.gpg4o.com

---

From: Peter Gutmann <[email-masked]>
Date: Wed, 30 Nov 2016 09:06:20 +0000

Brian Sniffen <[email-masked]> writes:

>Perhaps you don't see the use cases, but I see many every day: signed e-mail
>messages for e-mail based manipulation of databases (e.g., bug trackers,
>auto-builders, deployment systems).

That isn't really signed email though, that sounds more authenticated EDI-
style messaging...

Peter.

---

From: Thijs van Dijk <[email-masked]>
Date: Wed, 30 Nov 2016 10:40:15 +0100

On 30 November 2016 at 10:03, Alexander Strobel <[email-masked]>
wrote:

> (presumably) not a phishing attack. [... snip ...]

Yes, conceptually this is a very good case for signing e-mails. In fact,
many companies already do this with more light-weight DKIM signatures. As
an added bonus, users (or UI makers) are saved the hassle of manual key
management because the signing keys are simply available in DNS.

-Thijs van Dijk

---

From: Brian Sniffen <[email-masked]>
Date: Wed, 30 Nov 2016 10:54:57 -0500

> That isn't really signed email though, that sounds more authenticated EDI-

I do mean signed e-mail, where every message is to and from humans---but
sometimes CC's a robot.  The bugs.debian.org system is a good, publicly
available, example of what I mean.

-- 
Brian Sniffen <[email-masked]>
Information Security: Safety, Adversarial Resilience, Tools, Compliance
/(* Akamai - Faster Forward