Re: Announcing an experimental public S/MIME keyserver

2011-06-19 Thread Jan Schejbal
Am 2011-06-12 18:49, schrieb Michael Ströder: With which MIME-type? message/rfc822 seems appropriate, the same that is used if you attach an e-mail to another (or use forward as attachment). Of course, you could also use application/xml after wrapping it into an XML document ;-) And how

Re: Announcing an experimental public S/MIME keyserver

2011-06-17 Thread Kai Engert
On 16.06.2011 13:52, Gervase Markham wrote: On 11/06/11 12:03, Michael Ströder wrote: This means if the user accidently sent in contact information in an e-mail footer this information is also disclosed. If not already there you should put a strong hint on the web page that the signed S/MIME

Re: Announcing an experimental public S/MIME keyserver

2011-06-16 Thread Gervase Markham
On 11/06/11 12:03, Michael Ströder wrote: This means if the user accidently sent in contact information in an e-mail footer this information is also disclosed. If not already there you should put a strong hint on the web page that the signed S/MIME messages should not contain any private data

Re: Announcing an experimental public S/MIME keyserver

2011-06-12 Thread Michael Ströder
Jan Schejbal wrote: Am 2011-06-10 15:54, schrieb Kai Engert: If you want an easier solution, you could write a client that integrates keyserver lookup by doing the web request from within your email client, and ask the user to solve the captcha in a popup message. Maybe offer a download of

Re: Announcing an experimental public S/MIME keyserver

2011-06-11 Thread Jan Schejbal
Am 2011-06-10 15:54, schrieb Kai Engert: If you want an easier solution, you could write a client that integrates keyserver lookup by doing the web request from within your email client, and ask the user to solve the captcha in a popup message. Maybe offer a download of the e-mail? This way,

Re: Announcing an experimental public S/MIME keyserver

2011-06-10 Thread Jean-Marc Desperrier
Kai Engert wrote: I'm thinking the following could solve the problem Please help me: which problem is it, that you want to solve, that isn't yet solved by the current implementation? Ease of use, understandability of the process for the average user. Average users fills a form, and that's

Re: Announcing an experimental public S/MIME keyserver

2011-06-10 Thread Kai Engert
On 10.06.2011 13:33, Jean-Marc Desperrier wrote: Kai Engert wrote: I'm thinking the following could solve the problem Please help me: which problem is it, that you want to solve, that isn't yet solved by the current implementation? Ease of use, understandability of the process for the

Re: Announcing an experimental public S/MIME keyserver

2011-06-10 Thread Robert Relyea
On 06/10/2011 06:54 AM, Kai Engert wrote: On 10.06.2011 13:33, Jean-Marc Desperrier wrote: Kai Engert wrote: I'm thinking the following could solve the problem Please help me: which problem is it, that you want to solve, that isn't yet solved by the current implementation? Ease of use,

Re: Announcing an experimental public S/MIME keyserver

2011-06-08 Thread Kai Engert
On 03.06.2011 00:12, Kai Engert wrote: In short, go to http://kuix.de/smime-keyserver/ and give it a try. ... (as of today, the keyserver accepts the same signing roots as Mozilla software. It also allows certs from cacert.org) In addition it will also accept the certs from

Re: Announcing an experimental public S/MIME keyserver

2011-06-08 Thread Jean-Marc Desperrier
Kai Engert wrote: Another short note: The problem with solely distributing the S/MIME certs is that a MUA does not have the S/MIME capabilities of the cert owner's MUA. So the sender MUA might choose a weak symmetric cipher. ... So the safest way is still to send a signed e-mail for

Re: Announcing an experimental public S/MIME keyserver

2011-06-08 Thread Kai Engert
On 08.06.2011 13:51, Jean-Marc Desperrier wrote: Is the script smart enough to identify and extract the encryption certificate in the mail when the sender uses separate signature and encryption certificates ? (and of course the S/MIME properties are correctly set to identify this, and propagate

Re: Announcing an experimental public S/MIME keyserver

2011-06-08 Thread Kai Engert
On 08.06.2011 14:15, Jean-Marc Desperrier wrote: This seems to be solved with my implementation, because my keyserver can forward the original signed message. But it's not really a great solution. Why not? I'm thinking the following could solve the problem Please help me: which problem

Re: Announcing an experimental public S/MIME keyserver

2011-06-06 Thread Kai Engert
How are cert renewals handled? Will you send an e-mail about certs soon to be expired to encourage the user to send in a newer cert? Not yet, but it wouldn't be a lot of work to setup a daily cronjob that walks through the list of stored certs. Also note that one of the issues is that the

Re: Announcing an experimental public S/MIME keyserver

2011-06-04 Thread Michael Ströder
Kai Engert wrote: In short, go to http://kuix.de/smime-keyserver/ and give it a try. I proposed such an idea in 2001 but never got the time to implement it. Glad you did! http://www.terena.org/activities/tf-lsd/docs/tf-lsd-4-tpp-certcollect.ppt How are cert renewals handled? Will you send an

Re: Announcing an experimental public S/MIME keyserver

2011-06-04 Thread Michael Ströder
Michael Ströder wrote: Kai Engert wrote: In short, go to http://kuix.de/smime-keyserver/ and give it a try. I proposed such an idea in 2001 but never got the time to implement it. Glad you did! http://www.terena.org/activities/tf-lsd/docs/tf-lsd-4-tpp-certcollect.ppt Another short note:

Announcing an experimental public S/MIME keyserver

2011-06-02 Thread Kai Engert
In short, go to http://kuix.de/smime-keyserver/ and give it a try. Although I can't guarantee that this service will continue to run, I will try to keep it up, and I would like to see many people using it. Longer explanation: The GPG/PGP world has long known the concept of keyservers -