Date: Wed, 30 Nov 2016 03:03:33 +0000
From: "brian m. carlson" <sandals@crustytoothpaste.net>
To: openpgp@ietf.org
Message-ID: <20161130030333.72yj7jrva7gbp432@genre.crustytoothpaste.net>
References: <20161129091837.GA25812@littlepip.fritz.box>
MIME-Version: 1.0
Content-Type: multipart/signed; micalg=pgp-sha512;
 protocol="application/pgp-signature"; boundary="z7355oubydrcavoh"
Content-Disposition: inline
In-Reply-To: <20161129091837.GA25812@littlepip.fritz.box>
User-Agent: NeoMutt/20161104 (1.7.1)
Archived-At: <https://mailarchive.ietf.org/arch/msg/openpgp/WYovPO3nOvgufeKCTX6SqWPnP70>
Subject: Re: [openpgp] On Signed-Only Mails
Precedence: list


--z7355oubydrcavoh
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

On Tue, Nov 29, 2016 at 10:18:37AM +0100, Vincent Breitmoser wrote:
> Hi all,
>=20
> (cross-posting on openpgp and messaging mls)
>=20
> during my work on bringing OpenPGP to K-9 Mail, I found myself
> reevaluating a lot of things. This time it's about signed-only mails.
>=20
> In short, my conclusion so far is that signed-only mails are very rarely
> useful, they are holding OpenPGP back as a solution for encrypted
> e-mail, and in the interest of usability we should not roll them out in
> email crypto solutions on equal terms with encryption.
>=20
> In some more detail:
> https://k9mail.github.io/2016/11/24/OpenPGP-Considerations-Part-I.html
>=20
> I received positive as well as negative feedback about this, and I'd
> love to hear more thoughts about it.

I work for a company where all mail needs to be signed.  If someone
wants me to install an SSH public key on a server, I need to be certain
that the person is who they say they are.  Furthermore, if one of the
system administrators sends an announcement email to the all-users list,
encrypting it to all possible employees at the company is not practical.
Signing it is still useful, especially if it includes something like a
Wi-Fi configuration file that people might use on their systems.

I use K-9 Mail for personal and work purposes, and I rely immensely on
the ability to send signed-only emails, often to mailing lists.  I think
that's an extremely common and important use case that we shouldn't
forget about.  Integrity is important even in cases where
confidentiality is not.
--=20
brian m. carlson / brian with sandals: Houston, Texas, US
+1 832 623 2791 | https://www.crustytoothpaste.net/~bmc | My opinion only
OpenPGP: https://keybase.io/bk2204

--z7355oubydrcavoh
Content-Type: application/pgp-signature; name="signature.asc"

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.1.16 (GNU/Linux)

iQIzBAABCgAdFiEEX8OngXdrJt+H9ww3v1NdgR9S9osFAlg+QYUACgkQv1NdgR9S
9osDYg/8D2Y7B3VtrTOw4vgQHKaEBU0Z79Ys4VP3Lj8gfDumevu2T3Wqr7ZTRAHD
zgLjYr0LmDNG9+DPna9fQmQrkkDASqj8fkeYDth1tR4SMB6Smsq8Bm2yURB818D4
1h212uwGbz0pPfbvmv/meVN1Lejko7qUO2MV5ghQWPJqXYgWc2N9mGTml0QL9E+b
JUZ/2ZaTXFevk+ACKf6R/3P3mBcDwHnPmfDKiee9g+ahf9RLjQDbDgW/fYDNT3B2
PHOU26FALriHBnUOJBIuKbz3N8wHd1KFIicpqrM61ywE/xE7tPBAXYNNybjVPYZz
3bE9z5/92cAwPmmOOJKhSWwlolTy50AMT+QLduQASlqfBFXSRT8JTIy6ry3gRzIZ
Imgsy+WL2jJqQeFHnY+j5kA0TGgLsWMDp3NeiJ9DbJfC7VL2DL1SndTjusE2xuw8
wWp3poxZtwleH9T2tKbQ+l4tSHk+6WkUpzvOKM9PuixaGYNbSIKCPlEtuGiWEOaj
unMZ8r154Wd6N1r+rs7hOiU70UnYPhd0yRpUGj36s4H3zex+HzpKiwSPyZFVn47r
P3F0z5DzSX54BBTeZRsJzMQllTy72lExZ8PJEuUaSOQlzeI96t0amS8UmHMSj1wR
7TBckV71VqQvejqLY3Y6R89p/0YBUwto/p7bqMpPd2We01KtviY=
=eLtN
-----END PGP SIGNATURE-----

--z7355oubydrcavoh--