Re: Bruce Schneier's Proposal to dedicate November meeting to saving the Internet from the NSA

jnc@mercury.lcs.mit.edu (Noel Chiappa) Fri, 06 September 2013 03:39 UTC

Return-Path: <jnc@mercury.lcs.mit.edu>
X-Original-To: ietf@ietfa.amsl.com
Delivered-To: ietf@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 15A6F11E823C for <ietf@ietfa.amsl.com>; Thu, 5 Sep 2013 20:39:42 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -6.46
X-Spam-Level:
X-Spam-Status: No, score=-6.46 tagged_above=-999 required=5 tests=[AWL=0.139, BAYES_00=-2.599, RCVD_IN_DNSWL_MED=-4]
Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id IPZCVzTSUShm for <ietf@ietfa.amsl.com>; Thu, 5 Sep 2013 20:39:35 -0700 (PDT)
Received: from mercury.lcs.mit.edu (mercury.lcs.mit.edu [18.26.0.122]) by ietfa.amsl.com (Postfix) with ESMTP id 842D611E823B for <ietf@ietf.org>; Thu, 5 Sep 2013 20:39:35 -0700 (PDT)
Received: by mercury.lcs.mit.edu (Postfix, from userid 11178) id F1EC418C126; Thu, 5 Sep 2013 23:39:34 -0400 (EDT)
To: ietf@ietf.org
Subject: Re: Bruce Schneier's Proposal to dedicate November meeting to saving the Internet from the NSA
Message-Id: <20130906033934.F1EC418C126@mercury.lcs.mit.edu>
Date: Thu, 05 Sep 2013 23:39:34 -0400
From: jnc@mercury.lcs.mit.edu
Cc: jnc@mercury.lcs.mit.edu
X-BeenThere: ietf@ietf.org
X-Mailman-Version: 2.1.12
Precedence: list
List-Id: IETF-Discussion <ietf.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/ietf>, <mailto:ietf-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/ietf>
List-Post: <mailto:ietf@ietf.org>
List-Help: <mailto:ietf-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/ietf>, <mailto:ietf-request@ietf.org?subject=subscribe>
X-List-Received-Date: Fri, 06 Sep 2013 03:39:42 -0000

    > From: Phillip Hallam-Baker <hallam@gmail.com>

    > S/MIME is almost what we need to secure email.

If by "secure email" you mean 'render email impervious to being looked at
while on the wire', perhaps. If, however, you mean 'render it secure from
ever being looked at by anyone else', no way.

Even if it's stored on the destination host in encrypted form, if that host is
compromised, the contents of that email are now at risk. Even if the key is
not stored on that machine, the next time it's entered into that machine (or,
more broadly, the encrypted email and the key are brought near each other), it
can be lifted, _if that computer has been compromised_.

This whole 'surveillance of online activity' is a lot bigger problem than the
IETF's work domain. For us to think we can 'solve' it is massively hubristic.

	Noel