Re: S/MIME verification, marking of encryped

[jens.lechtenboerger@fsfe.org]

Greg Troxel <gdt@lexort.com> writes:

> jens.lechtenboerger@fsfe.org writes:
>
> Your blog post conflates the common PKI model and the S/MIME standard
> itself

I hope not.  I explain that you need a notion of trust, and I also
mention the case of the monopoly.

> - which I realize is how normal people come to this.

Come to what?

> Some organizations use S/MIME but only configure their own CAs as
> trust anchors.  This is quite sane.  But I agree that that vast CA
> list is goofy and inflicted on most people.

Using just your own CA conflicts with the decentralized model of e-mail.

>> My recommendation is to stay away from openssl.  Use gpgsm.
>
> So perhaps the defaults should be flipped in gnus, so that epg/gpgsm is
> used, throwing an error if not found (or silently not decoding merely
> signed?), unless someone has explicitly asked for the openssl version?

Yes, I agree.  Actually, I plan to propose that later this month.
Currently, I’m working on the refactoring of encryption related code in
Gnus that I proposed more than a year ago on this list.

>> My advice is to go for OpenPGP :-)
>
> You vastly overestimate my status as world dictator :-)

Too bad.  Definitely worth a try.

Best wishes
Jens