2

Suppose one of my duties for a small organization is to send out statements to clients by email.

Suppose one of the directors / owners / trustees want to be able to audit the numbers. Specifically he wants the ability to check that I'm not keeping two sets of books (One set for the directors and auditors and one set for the clients).

Is it enough to CC him all the statements as I'm sending them ? You can assume I know basic hacking, such as the SMTP protocol, but I don't have access to any computers other than my own.

Or do we need a more advanced product like GMail vault ? https://support.google.com/vault/answer/2539616?hl=en

  • I don't think you can do this without delegating the sending to a trusted third party - which then would be be able to do the very same attacks. – CodesInChaos Feb 22 '14 at 20:00
  • Ask whatever firm the organization has hired for the annual/regular audits what they need, then provide it. – Anti-weakpasswords Feb 22 '14 at 20:28
  • We regard many companies as trustworthy: They just need a reasonable track record of securing their products, e.g. responding quickly when becoming aware of exploits. – Nic Roets Feb 22 '14 at 20:32
  • Answering the core question has other applications as well: For example you may be sending out notices of a meeting and you want to prove that you did it properly. – Nic Roets Feb 22 '14 at 21:00
3

I guess it depends on the context, and what a proof would consist of.

It's possible to prove that something was written at a certain time using a timestamping service or protocol. Essentially you just need someone to sign your document along with the time of the signature. There are services that do this at a not-insignificant fee, and there are also "outside-the-box" solutions that accomplish roughly the same task.

But all of these prove that something was written, not that it was sent (or more appropriately, received).

The concept of "sent" is pretty hopeless if not paired with "received", since I can send you an email, but keep it trapped on my own server for some time (and in fact modify it if desired), before eventually letting delivery happen. Likewise, your mail server can "receive" an email but not insert it into your mailbox (think spam trapping).

So, the only useful concept here has to be round-trip verification. If you send an email, and your recipient sends back a reply (preferably signed, and including the claimed signature time), then you can prove that the recipient claimed to receive your email at a given time. It's not quite the same thing, but it could be appropriate for your needs. Alternately, you could use a trusted timestamping authority to certify the time the signed receipt was received.

Some other variation on these concepts might instead be appropriate; all depending on your needs.

  • The clients have agreed that their statements can be delivered by email. Similar to the posting rule, we can a assume that email was received provided it was relayed/sent by the mail server of a trusted third party. So the director / trustee want's an easy way to check that the email was relayed/sent by that trusted third party. You can even provide a list of companies you would trust. – Nic Roets Feb 23 '14 at 9:16

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.