Re: [gentoo-user] Mailing list and PGP/MIME

[Daniel Iliev]

On Mon, 26 May 2008 16:16:47 +0100
Mick <michaelkintzios@×××××.com> wrote:

> On Monday 26 May 2008, Daniel Iliev wrote:
> > On Sun, 25 May 2008 20:04:29 +0200
> >
> > Wolf Canis <wolf.canis@××××××××××.com> wrote:
> > > Mick wrote:
>
> > > > There are other lists however, when
> > > > it is not that rare for malicious (or unhinged) individuals to
> > > > impersonate someone else and hijack their email address to
> > > > publish offensive content. After a while using a digital
> > > > signature (GnuPG or x509) becomes a habit.
> > >
> > > That's exactly the case. ;-)
> >
> > Two questions.
> > How would signing your emails to this list help you:
> >   - in avoiding the above to happen to you?
> >   - help you in case that happens after all?
> >
> >
> > Explain, please.
>
> The reason I have given above does not apply as much to this list (so
> far). In any case, the principle is that unless I have signed this
> message you cannot be sure that it was authored/sent by me and as a
> matter of course you should assume that it was sent by someone else.
> You can then trust/distrust the content of the message and the
> potential impact of any advice offered in it accordingly.
>
> As far as this list is concerned singed messages don't cause any
> harm.  Once you set your client to sign messages, that's what it
> does . . .
>


My point is that digital signatures are not designed to spare any
troubles, just the opposite. The idea is to deprive the sender of
opportunity to say "that's not a message of mine" and the sole purpose
of digital signatures is to provide a means of verifying the origin [1]
and integrity [2] of a message.

1. Trouble saving
Will signatures help if a mailing list (ML) receives spam?
No. The admins won't accept arguments like "Those mails weren't signed,
it's not me". Signature or not the address gets its ban and that's it.

2. Origin authentication
MLs like this one are nothing but bunch of people who help each other
on voluntary basis w/o knowing each other in person.
Hence no need for [1].

3. Integrity
Besides the few very obvious exceptions there is no person that has the
opportunity to alter all messages. In public places like MLs, web
forums, etc the correct answer usually comes out after a discussion
involving several people. So, tempering with single person's messages
is pointless. Hence no need for [2]

4. Unavailability
I can't verify the validity of the signatures, even if I wished to,
because I don't have the corresponding public keys.

5. Trust
Even if all public keys were easily obtainable and I had the wish to
install them, are all of them signed by a certificate authorities which
I trust?


Bottom line: I see no reason for signing messages to MLs like this one.


-- 
Best regards,
Daniel
-- 
gentoo-user@l.g.o mailing list