Hot answers tagged

34 votes

What actions should I, as an end user, take in response to EFAIL?

Notably, PGP is not the problem. The problem lies with the mail handling apps in your browser which you have allowed to use your PGP keys. Those browser apps decrypt the message as they should, but ...
user avatar
13 votes
Accepted

What is the web of trust?

A hierarchical public key infrastructure is when some Certification Authority (CA) issues certificates to a lot of sub-entities: the CA signs certificates to guarantee the link between an identity and ...
user avatar
12 votes

What actions should I, as an end user, take in response to EFAIL?

Disable HTML rendering. (Not HTML sending: HTML rendering. It doesn't matter what mail you send; what matters is what your mailer does on receipt of the adversary's mail.) Consider configuring your ...
user avatar
11 votes
Accepted

Why don't banks sign their email using S/MIME?

It's usually a costs vs. benefits decision. Costs: Create your own CA infrastructure or buy a public certificate for each sender Teach employees how to use it Teach employees how not to use it, ...
user avatar
9 votes

What actions should I, as an end user, take in response to EFAIL?

There is another solution apart from disabling HTML rendering - which you nonetheless should. This is a list of affected clients and webmailers1: The efail attack in its current form relies first ...
user avatar
  • 7,913
8 votes
Accepted

Why shouldn't I sign my email newsletter using an s/mime email certificate?

Signing emails is useful only insofar as recipients verify the signature. Theoretically, signing the emails might improve deliverability, but only if a recipient configures his filters for incoming ...
user avatar
6 votes

What are the security differences between SMIME email and PGP email?

1: The advantage of S/MIME over PGP is that you sign/encrypt a complete mime entity, not a text. This makes it possible to sign/encrypt an entire message/rfc822. Yes, headers must be visible and ...
user avatar
6 votes

What actions should I, as an end user, take in response to EFAIL?

The current advice is to avoid automatically decrypting the email in your email client. In most cases that means uninstalling the relevant plugin. You then need to copy the encrypted text to a ...
user avatar
  • 1,092
6 votes

What actions should I, as an end user, take in response to EFAIL?

Short term fixes There are two short term fixes to choose between: Disable HTML rendering in your email client. (And note that's rendering HTML, i.e. viewing it, not sending it.) Stop decrypting ...
user avatar
  • 64.2k
5 votes
Accepted

Is RC2-CBC at all secure?

RC2 is a currently "unbroken" block cipher; the best known attack is a "related-key attack", i.e. something which does not really apply in practice (related-key attacks are about ...
user avatar
  • 168k
5 votes
Accepted

Is it possible and does it make sense to sign an E-mail with PGP and S/MIME?

You can sign with both PGP and S/MIME. Contrary to Oliver Schmidt's response, it is possible to create an external signature using PGP (you can sign any file with a PGP key, not just text - a ...
user avatar
  • 9,691
5 votes

Can a nation-state adversary perform a MITM attack by compelling a CA to issue them with fake certs?

Yes, but this would be difficult to do without it being discovered. From a purely technical standpoint you're correct, there's nothing stopping a nation-state from compelling a Certificate Authority ...
user avatar
  • 4,567
5 votes

S/MIME certificate expired and renewed, do my correspondents have to do anything?

Theory is that everything works automatically. Practice sometimes differs. I suppose that you are talking about S/MIME and X.509 certificates. With S/MIME, when you send an email: The email is ...
user avatar
  • 168k
5 votes
Accepted

Signing but not encrypting trivial generic e-mails

If the email was addressed to a specific student, the same replay attack would be possible if you intercepted the email in transit. The problem with this email is not the vagueness of the recipient, ...
user avatar
  • 48.8k
5 votes
Accepted

Verify S/MIME signature with no certificate included

Aside: you mean openssl smime -verify (or the newer and slightly better openssl cms -verify). openssl verify is a quite different operation which verifies one or more cert(s) against a truststore and ...
user avatar
5 votes
Accepted

What's the point of S/MIME?

If it opened without a key, it wasn't encrypted. It was probably signed by the sender, and if you have the sender's public key (out of band) then you can verify the signature. The point of S/MIME is ...
user avatar
  • 7,603
4 votes

I want trusted SMIME certificates for 3rd parties. Is this a reasonable configuration?

I would recommend using a completely separate root for the external and internal certificates, to prevent any information leak about internal hosts or users, through Root01, but also prevent any ...
user avatar
4 votes
Accepted

Does PKCS #7 (CMS) add assurance to an email if a CRL/OCSP response is included, then revoked?

What you are looking for is theoretically viable, provided that you add the missing extra piece, i.e. some form of time stamping. However, behaviour of existing, deployed implementations is likely to ...
user avatar
4 votes

Why don't banks sign their email using S/MIME?

My bank never sends e-mails. Instead, there's a messaging service inside my online banking interface I can use. Furthermore, it is stated on both the bank's site and the printed materials I receive by ...
user avatar
4 votes
Accepted

S/MIME signing and verification - how do I find proper certificate?

###Be careful with the naming Aside: you might want to say a 'separate' or 'separately provided' or 'unincluded' certificate. 'Detached' vs 'embedded' signatures in PKCS7/CMS/SMIME are a fairly ...
user avatar
4 votes
Accepted

Why do we need DKIM to be used along with S/Mime?

S/MIME and DKIM are totally independent from each other. S/MIME signature and encryption is applied by the sender (end user) while DKIM signatures are applied by the mail server of the senders domain. ...
user avatar
4 votes

Why do I need an own certificate to encrypt a S/MIME message?

When a sender uses Thunderbird to send an S/MIME encrypted message to a recipient, Thunderbird requires the sender's certificate in addition to the recipient's certificate, so that Thunderbird can ...
user avatar
  • 19.3k
4 votes
Accepted

Is there any point in using PGP or S/MIME when your receipients mostly don't use it?

... company with sensitive customer relations Given that many common mail clients support at least S/MIME by default, it actually makes sense to use it. This means that mails should at least be ...
user avatar
3 votes

S/MIME certificate expired and renewed, do my correspondents have to do anything?

You are correct in that contacts may receive a "certificate expired", if they attempt to encrypt an email to you first and attempt to use the expired, cached certificate (this doesn't apply to signed-...
user avatar
  • 7,927
3 votes

Yubikey with S/MIME certificate

Store the private key for an S/MIME certificate from Digicert on a Yubikey. You need to download Yubikey PIV Manager https://developers.yubico.com/yubikey-piv-manager/ that allows storing the ...
user avatar
  • 133
3 votes

Is it possible and does it make sense to sign an E-mail with PGP and S/MIME?

To make a long story short: Yes, that will work and it will make sense, too. I'll try to explain this: PGP stores the signature inside the email body. The body of a PGP-signed mail usually ...
user avatar
3 votes
Accepted

Is PGP or S/MIME useful when both servers are self-controlled?

With regards to encryption and preventing a 3rd party from viewing my emails (and ignoring validity/signing), is encrypting an email via PGP or S/MIME useful when I control my server and my recipient ...
user avatar
  • 298
3 votes
Accepted

Does SMIME differ from TLS, PGP, DMARC signature, or a Portal Encrypted email message in terms of legal non-repudiation?

If you are afraid of "snooping" then why would you use signatures ? A "snooper" is a passive eavesdropper, who wants to see the data but certainly not to make you aware that your ...
user avatar
3 votes

EU standardized digital signature for form-data

Digital signature in EU is ruled by REGULATION No 910/2014 on electronic identification and trust services. It is directly applicable in all territories without transposition You will not found any ...
user avatar
  • 255
3 votes

Disable 3DES (Triple DES) in thunderbird

If there would be a way to disable DES3 for this purpose in Thunderbird it would probably be a note on the bug report about it, which isn't. But instead of crying about the insecurity of 3DES let's ...
user avatar

Only top scored, non community-wiki answers of a minimum length are eligible