GPG support in Mahogany

[Xavier Nodet]

On Wed, 11 Dec 2002 12:24:01 +0100 "Janusz A. Urbanowiz" <alex@syjon.fantastyka.net> wrote:

> On Tue, Dec 10, 2002 at 06:38:06PM +0100, Xavier Nodet wrote:

> [PGP default threat model]
> It is described in the two-part documentation to the original PGP 2.

I found this: <http://www.pgpi.org/doc/guide/2.6.3i/en/>. I will look at
it.

> OpenPGP defines a way to mark the message that its circulation should be
> limited. It is called 'for your eyes only'.

I now see that, as you say below, this is a social problem I was trying
to solve. If I send some information to someone, there is no way I can
prevent him to do whatever he wants with this info.

> > >> I'm speaking about the destinator decrypting first, then re-encrypting
> > >> for a third person.
> > 
> > > You want to detect it, prevent it, prove it or what?
> > 
> > I want to detect it.

> But why? Why you worry about this, but you don't worry that someone's
> machine in the message path isn't compromised?

I do not understand how a compromised machine in the path is a problem.
The reason to encrypt is exactly to make sure one does not have to
bother with that, no? Would you want to say that an external (w.r.t.
encryption) signature could be removed?

> We can't solve a social problem with technology.

Yes. I see that now. Thanks for this enlightment.

> If you want to approach the problem, make a good implementation for 'for
> your eyes' option for both sending and receiving messages. 

It seems easy for sending: something like a checkbox in the 'Encrypt'
dialog would be enough, no?

Upon reception of an encrypted 'for your eyes only' message, we should
not allow the user to save the clear-text. Of course, this does not
really prevent anything, but it makes it clear that this was not what
the originator had in mind.

Is there anything else? BTW, is there some forum or mailing list
specifically devoted to those 'mail+crypto' problems?

> Include From and To headers in a message when signing it. Check the
> included headers when verifying the signature.

I (or, rather, we) will try to do that.

Thanks again for your time.

-- 
Xavier Nodet
"They that can give up essential liberty to obtain a little temporary
safety deserve neither liberty nor safety." - Benjamin Franklin, 1759.