On Apr 28, 2017, at 12:32 PM, Jonathan Fletcher <[email protected] <mailto:[email protected]>> wrote:
> I am sure that many (not all, or may not even a majority) companies have all > kinds of encryption in place, but when you get an email from your CEO that > tells you to wire a large chunka change to a vendor in China, you better have > other procedures in place to confirm that that actually came from your CEO. Most people think encryption is only about hiding information; it’s also about ensuring the veracity of messages. All the major encryption schemes (PGP, S/MIME, …) include the capacity for digital signatures. If your CEO has a key pair and you know his public key, then you can be sure a message came from him, if he signed it using his private key. If even a single bit does not match when the message is received, then it will not be verified. Almost all the emails I send are signed in this way and those who have my public key know the emails actually come from me. Those who don’t have my public key, or who have no software to verify a message, just see it as a regular email. L^2 PS/ I signed this one with my S/MIME key. I prefer to use my PGP key, but that involves the recipient installing a mail plug-in <https://gpgtools.org/> that knows how to handle PGP keys. My family members and many of my friends use PGP. --- Lee Larson [email protected] <mailto:[email protected]> Suppose you were an idiot and suppose you were a member of Congress… but I repeat myself. — Mark Twain
_______________________________________________ MacGroup mailing list Posting address: [email protected] Archive: <http://www.mail-archive.com/[email protected]/> Answers to questions: <http://erdos.math.louisville.edu/macgroup/>
