Subject: Goal for S/MIME 2007?

From: "Anders Rundgren" <[email-masked]>
Date: Sun, 21 Jan 2007 09:51:16 +0100

Still waiting for a response...

----- Original Message ----- 
From: Anders Rundgren 
To: [email-masked] 
Sent: Saturday, December 23, 2006 10:36
Subject: Goal for S/MIME 2007?

Today I concluded that my mail-box with 120 fresh messages constituted of about 110 messages where the sender address is either falsified, or is coming through a hijacked computer.

In my opinion S/MIME is the primary culprit for this unbearable situation.

That Windows have showed some weaknesses with respect to virus attacks is undoubtedly true, but viruses would also have had a much less impact if we have had a useful e-mail security architecture.  The same goes for phishing, not to mention spam.

A do believe that the designers of S/MIME did what they could back in the 90'ties.  However, now when we know better [*], shouldn't these guys who indirectly contribute to an annual waste of BILLIONS of good working hours from the Internet community rather try to create a system that to some extent compensates for the mistakes done in the past?

DKIM is a step in the right direction but it does not address confidentiality.  That DKIM was designed to support people who want to run their own mail-servers but cannot afford a domain-certificate is also a bit off since these entities represent at most 0.1% of today's Internet users.

Anders Rundgren

*]
- Client certificates are [still] uncommon
- Encryption at the desktop by consumers does not work
- Security administrators want central policy handling
- Trusted third-parties is the norm (from your employer to Google)
- You cannot send an encrypted e-mail to the IRS and you probably never will
- e-mail encryption is incompatible with many organizations' internal policies
- Security should be transparent, default, and non-intrusive

---

From: "Hallam-Baker, Phillip" <[email-masked]>
Date: Thu, 25 Jan 2007 18:52:09 -0800

I think that in order to address that particular market we would have to spend a lot of time re-engineering S/MIME to be less strict. 

I don't want to make S/MIME looser. I want to work out a way to get people signing and encrypting their email. I don't particularly care what technology they use to do that.

S/MIME implementations lack a small amount of glue to make them more usable. If we can persuade the people deploying DKIM at the client end to add those small necessary pieces of glue to make the user experience seamless we end up with the best of both worlds, ubiquitous lightweight signatures, dependable transactional signatures and message encryption.

> -----Original Message-----
> From: [email-masked] 
> [mailto:[email-masked]] On Behalf Of Anders Rundgren
> Sent: Thursday, January 25, 2007 4:31 PM
> To: [email-masked]
> Subject: Re: Goal for S/MIME 2007?
> 
> 
> In theory S/MIME could be one "cure" against spam, viruses 
> and phishing.
> 
> There are at least two things making this stay as "theory".
> 
> 1.
> There is no S/MIME trust structure that works except rather 
> locally, effectively making every person on the net a "PKI 
> trust administrator".
> Although the DoD have a solution ( 
> http://www.certipath.com/services.htm ), few other 
> organizations can spend huge amounts of tax-payer money just 
> to prove that "it can be done", but are rather evaluating 
> other options.
> 
> 2.
> The unavailability of a cheap, mobile, secure and fully 
> standardized container makes the certificate requirement a 
> much too high bar.  That not even the financial sector have 
> managed to deploy such schemes to more than 1-2% in spite of 
> 10+ years of on-line banking is in my opinion good enough as 
> a proof.  The virtual explosion of Web-mail and mobile phone 
> mail, actually makes the S/MIME-card-everywhere-vision more 
> distant than ever.  Well, the DoD have no problems [of 
> course], 
> http://www.karbonsystems.com/BlackBerry-SMIME-CAC-products_det
ail-83.html
> but who else would buy $200+ card-readers?
> 
> 
> It might be interesting knowing that some governments have indeed
> removed S/MIME from their C2G (Citizen-to-Government) PKI
> schemes since they have noted that the web is a more powerful way
> of delivering services as well as offering encryption for free.
> 
> Regarding the failed DOMSEC experimental RFC, I believe that it
> [partly] failed because the authors did not realize that 
> there already was
> a globally working PKI they should have hooked into; the web-server
> SSL PKI.  Imagine, securing an entire e-mail domain for a measly $100-
> $200 annually!  Too simple, too obvious, and too commercial I guess.
> 
> AR
> 
>