PGP/MIME considered harmful for mobile

[David Shaw]

On Feb 27, 2011, at 2:48 PM, Robert J. Hansen wrote:

> On 2/27/11 2:37 PM, Martin Gollowitzer wrote:
>> I sign *all* my e-mail except for messages sent from my mobile (in that
>> case, my signature tells the receiver why the message is not signed and
>> offers the receiver to request a signed proof of authenticity later) or
>> messages to people who can't receive signed messages (I had a case where
>> e-mails arrived empty because of the MS Exchange/Antivirus/whatever
>> combination at the receivers working place).
> 
> You may want to reconsider this practice.
> 
> Signatures have value if they are correct, originating from a validated
> key, belonging to a trusted individual.  If any of those are absent the
> signature is more or less just line noise.  You cannot make any logical
> inferences from a signature that is bad, that comes from a non-validated
> key, or an untrusted individual.

I disagree with this.  Obviously a bad signature doesn't say much (except perhaps "check your mail system - it's breaking things"), but there is still value in the continuity between multiple signed messages.  It's important to not make of that more than it is: for all I know there are 200 people all sharing key 1CF3A917, but it does raise the bar for someone who wants to claim to be Martin.

(and insert key ID collision attack here!)

David