[lamps] S/MIME fix

[Phillip Hallam-Baker <[e-mail]>]

Looking at eFail, surely the simplest fix is to require that an HTML
message body be presented in a single CMS envelope presented in a single
MIME part?

This would simplify the code substantially. While it is conceivable someone
has worked out a way to make use of this mis-feature, I for one cannot
imagine why Outlook, Thunderbird or the like would ever do anything of the
sort.


Separately, we have interest in CAA for S/MIME. Surely we should do ACME
for S/MIME as well. If we are going to do that, surely we should have a
discussion of what it would take to make end to end security the default
for SMTP.

I am not necessarily thinking of this as a LAMPS thing because we also need
to get CAs, probably CABForum involved and maybe the OpenPGP folk.


The model we have right now is that we have a lot of different camps
offering technology. Some of that technology meets the needs of a
particular community. What we do not have is a general solution or a mass
deployment strategy.

And this is really important because email security breaches have changed
the course of history in the past few months.