Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

Great, if you trust your middle man email provider to get this right and want no visibility on the message's authenticity.

DKIM is much more a spam fighting tool than a substitute for E2E authenticity validation.



If you don't trust your send gateway then you are without a doubt hosed anyway, as they can just strip your signature anyway (or, replace it with one linked to a key they generated in your name on the fly). Yes, if your correspondant is super on the ball and notices that you didn't sign/encrypt this specific message, maybe you win. But if I were a bad MITM I'd just put "Sent from my iPhone" at the bottom and there is the plausible explanation.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: