Re: [perpass] Mail encryption as an example

There is a technique for protecting the subject line for S/MIME, but the recipients MUST be exposed for the mail to b delivered.  This exposure can be limited to the clients and various mail servers if SMTP/POP/IMAP are run over TLS.

Russ

On Aug 17, 2013, at 7:51 AM, Yaron Sheffer wrote:

> Hi,
> 
> Stephen mentioned that S/MIME is not good enough because headers (to/from) are still exposed. But there's still tons of benefit when the content is encrypted, even if the metadata is exposed (provided users know that it is exposed, of course). E.g. I would like all my internal company email to be encrypted, even if tracing recipients is trivial for the attacker.
> 
> In other words, is the scope of the mailing list/solutions limited to security of individuals, as opposed to organizations?
> 
> From a deployment perspective, I think we know how to provide privacy ("identity protection") only by using heavyweight solutions, such as onion routing. But there's a whole lot of important things we could do (make S/MIME usable, standardize OTR, revive IPsec OE) if we remove this constraint. Are such items in scope of this discussion?
> 
> Thanks,
>    Yaron
> _______________________________________________
> perpass mailing list
> perpass@ietf.org
> https://www.ietf.org/mailman/listinfo/perpass