On Tue, Jan 11, 2011 at 10:04 AM, jimbob palmer <[email protected]> wrote: > In Firefox I can sign or encrypt or encrypt+sign an e-mail. > > In what case would I want my encrypted emails also signed? Does it > provide any additional benefit over a pure encrypted email?
It is, in fact, trivial to 'forge' email - that is to send email pretending to be someone else. All you need to do is tell your computer to send out email with a different "From:" line. Most smtp servers will forward an email from an authenticated user (or from anyone on the network) without checking that the From line matches their approved email address. This is, for the most part, a feature, not a bug. There are various schemes to prevent this from being possible (or at least undetectable) and OpenPGP offers one way - albeit one that places a great demand on the sysadmin or the user or both. In fact, email is forged every day in just this way - but most of it is such obvious spam that it is easier for the human eye to weed out than it is to set up an OpenPGP, which is why so few people have ever done so. Back when I was a student a friend of a friend of a friend got very drunk and started forging emails in this way pretending to be the Dean. But even these were such obvious forgeries, and the other email headers were so detailed, that it did not require OpenPGP to detect him. Best wishes, Nicholas _______________________________________________ Gnupg-users mailing list [email protected] http://lists.gnupg.org/mailman/listinfo/gnupg-users
