Re:Forced Exposure
by nwh on Tuesday August 20, 2013 @07:06AM
(#6242874)
> You don't necessarily need a $5000 HSM solution to issue your own SSL certificates at this level.
Well sure, I can issue them myself in a few minutes, the issue is that arbitrary mail servers won't be able to authenticate me. Which means we're means we're back to MITM attacks—better than plain text if the observer can't manipulate the data stream—but I wouldn't bet on it. Work with the assumption that the NSA is Mallory, not Eve.
Re:Forced Exposure
by nwh on Tuesday August 20, 2013 @09:38AM
(#6243603)
The WOT at least provides some authenticity, but only for people you already know. If I want to email you and aren't part of your WOT, then it's as good as plaintext.
Well sure, I can issue them myself in a few minutes, the issue is that arbitrary mail servers won't be able to authenticate me. Which means we're means we're back to MITM attacks—better than plain text if the observer can't manipulate the data stream—but I wouldn't bet on it. Work with the assumption that the NSA is Mallory, not Eve.