Ok Google: please publish your DKIM secret keys

Post by upofadown » Mon, Nov 16, 2020, 8:56 PM UTC

tptacek wrote: post #55

xbar wrote: post #25

I think this is a shameful argument. Non-repudiation over time is a truly powerful property of DKIM'd email for a great many uses outside of blackmail. Calling for the ability to remove it during the years 2016-2020 in order to "protect politicians from blackmail" is not only of deeply questionable value but of suspect motivation. Who is the author interested in protecting?

Among messaging cryptographers, it's not even an argument. Serious secure messengers have been designed to avoid non-repudiation since OTR. Non-repudiation is a vulnerability: once counterparties have authenticated each other's messages, the legitimate need for authentication is gone; allowing random strangers to authenticate messages concedes information to them. Here, have a link, from 2004: https://otr.cypherpunks…

Post by pueblito » Mon, Nov 16, 2020, 9:05 PM UTC

tptacek wrote: post #137

baobabKoodaa wrote: post #128

Earlier quoted context omitted.

> His point was that you pointed out a use case for some sort of cryptographic signing, not for (ab-) using DKIM for this purpose rather than what it was designed for. First, thank you for the clarification. Second, to answer tptacek's point, I understand that authenticating emails as a third party is an unintended side effect of the DKIM protocol. I understand that cryptographers would like people to move onto using…

It's just really clear that people in this thread are trying to approach this from first principles without any engagement in the field that they're discussing. That's a fun thing to do as, like, a game or a way to pass the time, and I guess that's what HN is, but it's still crazymaking, because essentially every paper written about messaging cryptography refutes this comment. Cryptographers would like to move people…

Post by shinigami » Mon, Nov 16, 2020, 9:06 PM UTC

bartvk wrote: post #224

shinigami wrote: post #166

Earlier quoted context omitted.

Entering an contract via an email is a ridiculous idea from the start.

I don't know about your country, but in mine (The Netherlands), it is a completely and utterly valid way to enter a contract. Actually, you are free to enter a contract in any way possible. It is vormvrij (translated: form-free). Excluded is the purchase of a house, as far as I know. But for the rest, you are free to come to an agreement via WhatsApp, Facebook, email, or a scrawl on a piece of paper.

Post by shinigami » Mon, Nov 16, 2020, 9:07 PM UTC

Quarrel wrote: post #241

shinigami wrote: post #166

Earlier quoted context omitted.

Entering an contract via an email is a ridiculous idea from the start.

wtf? it happens all the time. I've raised VC money based on emailed contracts, bought businesses based on them, bought domain names. It is incredibly standard and legal (in almost all of the jurisdictions I've worked in, which is a lot).)

Post by iso1631 » Mon, Nov 16, 2020, 9:08 PM UTC

bjornedstrom wrote: post #86

As a security professional I 100% agree with the author. The comments here on Hacker News seem to have tripped on the examples given (keywords: politicians, journalists) and turned this into the more generic and politically loaded discussion whether it's desirable to "cryptographically verify" what politicians write. But that's not the point! The point is that DKIM is technically not designed for this use case and th…