Re: [perpass] Another mail-related proposal

[Jim Fenton <[e-mail]>]

On 08/17/2013 02:25 PM, Paul Wouters wrote:
> On Sat, 17 Aug 2013, Jim Fenton wrote:
>
>> There might be times when I'm interested in sending a message that I'd
>> rather not be in the clear on the wire, and I'd rather that the message
>> bounce rather than be sent in the clear. How about an SMTP option that
>> allows a sender to specify whether the message transmission requires (1)
>> TLS and (2) that the receiving MTA also enforce this option. It could
>> also specify whether the recipient MTA is required to have a certificate
>> trusted (e.g., via trust chain) by the sending MTA, or whether any TLS
>> negotiation (e.g., self-signed cert) is OK.
>
> I'd argue it the other way. If you publish a OPENPGPKEY/SMIMEKEY record,
> then you ONLY want to receive encrypted email. The problem is trying to
> prevent receiving it, as most email servers are message based and they
> have to accept the full message before rejecting it, at which point the
> cleartext has gone over the network and the NSA has a copy even if you
> don't.
>
> The postfix TLSA record fails hard for this reason - but that's the
> transport security, not data security.

I was, in fact, thinking about transport security, not data security. 
And I was thinking about being to set the preference on a
message-by-message basis. If I'm sending a message to my neighbors
announcing a block party, I would want the (existing) bias toward
message delivery. OTOH, if I'm sending a message to my accountant, I
might want to make sure it goes over a TLS-encrypted transport.

I'm having more trouble coming up with use cases where I'd want to
reject messages that don't use PGP or S/MIME. The originator of a
message is in a better position to decide whether it contains sensitive
information. And as the receiver you can't generally protect against the
message traversing the network in the clear -- SMTP is often more than
one hop and an earlier hop (or submission) could have been in the clear,
even if you did require TLS for the last hop.

-Jim