Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.os.linux.misc > #24528 > unrolled thread

Good example why business emails should be PGP'ed

Back to article view | Back to comp.os.linux.misc

Contents

  Good example why business emails should be PGP'ed Fritz Wuehler <fritz@spamexpire-201809.rodent.frell.theremailer.net> - 2018-09-23 19:45 +0000
    Re: Good example why business emails should be PGP'ed "Carlos E. R." <robin_listas@es.invalid> - 2018-09-23 22:03 -0400
      Re: Good example why business emails should be PGP'ed Dan Purgert <dan@djph.net> - 2018-09-24 10:27 +0000
      Re: Good example why business emails should be PGP'ed anon <noreply@mixnym.net> - 2018-09-24 07:48 -0500
        Re: Good example why business emails should be PGP'ed "Carlos E. R." <robin_listas@es.invalid> - 2018-09-24 13:18 -0400
          Re: Good example why business emails should be PGP'ed anon <noreply@mixnym.net> - 2018-09-25 08:16 -0500
            Re: Good example why business emails should be PGP'ed "Carlos E. R." <robin_listas@es.invalid> - 2018-09-25 10:26 -0400
              Re: Good example why business emails should be PGP'ed Wouter Verhelst <w@uter.be> - 2018-09-25 17:17 +0200
                Re: Good example why business emails should be PGP'ed "Carlos E. R." <robin_listas@es.invalid> - 2018-09-26 14:16 -0400
                  Re: Good example why business emails should be PGP'ed nospam <nospam@nospam.invalid> - 2018-09-26 14:24 -0400
                    Re: Good example why business emails should be PGP'ed "Carlos E. R." <robin_listas@es.invalid> - 2018-09-26 14:47 -0400
                      Re: Good example why business emails should be PGP'ed nospam <nospam@nospam.invalid> - 2018-09-26 14:56 -0400
                        Re: Good example why business emails should be PGP'ed "Carlos E. R." <robin_listas@es.invalid> - 2018-09-26 22:20 -0400
                          Re: Good example why business emails should be PGP'ed nospam <nospam@nospam.invalid> - 2018-09-27 00:43 -0400
                            Re: Good example why business emails should be PGP'ed "Carlos E. R." <robin_listas@es.invalid> - 2018-09-27 11:21 -0400
                              Re: Good example why business emails should be PGP'ed nospam <nospam@nospam.invalid> - 2018-09-27 11:52 -0400
                                Re: Good example why business emails should be PGP'ed "Carlos E. R." <robin_listas@es.invalid> - 2018-09-27 12:10 -0400
                                  Re: Good example why business emails should be PGP'ed nospam <nospam@nospam.invalid> - 2018-09-27 12:15 -0400
                                    Re: Good example why business emails should be PGP'ed "Carlos E. R." <robin_listas@es.invalid> - 2018-09-27 14:31 -0400
                                      Re: Good example why business emails should be PGP'ed Frank Slootweg <this@ddress.is.invalid> - 2018-09-27 20:07 +0000
                                        Re: Good example why business emails should be PGP'ed nospam <nospam@nospam.invalid> - 2018-09-27 16:39 -0400
                                          Re: Good example why business emails should be PGP'ed "Carlos E. R." <robin_listas@es.invalid> - 2018-09-28 09:45 -0400
                                            Re: Good example why business emails should be PGP'ed nospam <nospam@nospam.invalid> - 2018-09-28 09:52 -0400
                                              Re: Good example why business emails should be PGP'ed "Carlos E. R." <robin_listas@es.invalid> - 2018-09-28 14:22 -0400
                                                Re: Good example why business emails should be PGP'ed nospam <nospam@nospam.invalid> - 2018-09-28 14:26 -0400
                                                  Re: Good example why business emails should be PGP'ed "Carlos E. R." <robin_listas@es.invalid> - 2018-09-28 15:43 -0400
                                                    Re: Good example why business emails should be PGP'ed nospam <nospam@nospam.invalid> - 2018-09-28 15:54 -0400
                          Re: Good example why business emails should be PGP'ed The Natural Philosopher <tnp@invalid.invalid> - 2018-09-27 06:52 +0100
                            Re: Good example why business emails should be PGP'ed "Carlos E. R." <robin_listas@es.invalid> - 2018-09-27 11:22 -0400
    Re: Good example why business emails should be PGP'ed Jean-David Beyer <jeandavid8@verizon.net> - 2018-09-25 11:35 -0400
      Re: Good example why business emails should be PGP'ed Grant Taylor <gtaylor@tnetconsulting.net> - 2018-09-25 14:35 -0600
        Re: Good example why business emails should be PGP'ed "Carlos E. R." <robin_listas@es.invalid> - 2018-09-26 14:50 -0400
      Re: Good example why business emails should be PGP'ed "Carlos E. R." <robin_listas@es.invalid> - 2018-09-26 14:25 -0400

Page 2 of 2 — ← Prev page 1 [2]

#24602

In article <pojkai.ar4.1@ID-201911.user.individual.net>, Frank Slootweg
<this@ddress.is.invalid> wrote:

> 
> > >>>> He needs to pay someone that says "yes, this is safe". With a contract.
> > >>>
> > >>> not if he uses a free service that states that, which i said exist.
> 
>   A *lawyer*, trusting a *free* service saying "yes, this is safe"!?

there are several encrypted email services which guarantees that nobody
other than the sender or recipient can read the contents, which are
used by lawyers and many others who want secure transit. some are free,
some offer paid tiers above free and some are paid only, depending on
various options such as number of mailboxes, email volume, custom
domain, etc. some are open source and can be audited. at least one
lists gdpr compliance.

don't dismiss it because of your own unfamiliarity with the products.

[toc] | [prev] | [next] | [standalone]

#24608

On 27/09/2018 16.39, nospam wrote:
> In article <pojkai.ar4.1@ID-201911.user.individual.net>, Frank Slootweg
> <this@ddress.is.invalid> wrote:
> 
>>
>>>>>>> He needs to pay someone that says "yes, this is safe". With a contract.
>>>>>>
>>>>>> not if he uses a free service that states that, which i said exist.
>>
>>   A *lawyer*, trusting a *free* service saying "yes, this is safe"!?
> 
> there are several encrypted email services which guarantees that nobody
> other than the sender or recipient can read the contents, which are
> used by lawyers and many others who want secure transit. some are free,
> some offer paid tiers above free and some are paid only, depending on
> various options such as number of mailboxes, email volume, custom
> domain, etc. some are open source and can be audited. at least one
> lists gdpr compliance.
> 
> don't dismiss it because of your own unfamiliarity with the products.

Does that include setting PGP on his own? Or does it assume that his IT
professional hired by the bureau sets that or some other service?

-- 
Cheers,
       Carlos E.R.

[toc] | [prev] | [next] | [standalone]

#24609

In article <g16pklFgl3U1@mid.individual.net>, Carlos E. R.
<robin_listas@es.invalid> wrote:

> >>>>>>> He needs to pay someone that says "yes, this is safe". With a
> >>>>>>> contract.
> >>>>>>
> >>>>>> not if he uses a free service that states that, which i said exist.
> >>
> >>   A *lawyer*, trusting a *free* service saying "yes, this is safe"!?
> > 
> > there are several encrypted email services which guarantees that nobody
> > other than the sender or recipient can read the contents, which are
> > used by lawyers and many others who want secure transit. some are free,
> > some offer paid tiers above free and some are paid only, depending on
> > various options such as number of mailboxes, email volume, custom
> > domain, etc. some are open source and can be audited. at least one
> > lists gdpr compliance.
> > 
> > don't dismiss it because of your own unfamiliarity with the products.
> 
> Does that include setting PGP on his own?

no.

> Or does it assume that his IT
> professional hired by the bureau sets that or some other service?

no.

this applies to you too:
> > don't dismiss it because of your own unfamiliarity with the products.

[toc] | [prev] | [next] | [standalone]

#24611

On 28/09/2018 09.52, nospam wrote:
> In article <g16pklFgl3U1@mid.individual.net>, Carlos E. R.
> <robin_listas@es.invalid> wrote:
> 
>>>>>>>>> He needs to pay someone that says "yes, this is safe". With a
>>>>>>>>> contract.
>>>>>>>>
>>>>>>>> not if he uses a free service that states that, which i said exist.
>>>>
>>>>   A *lawyer*, trusting a *free* service saying "yes, this is safe"!?
>>>
>>> there are several encrypted email services which guarantees that nobody
>>> other than the sender or recipient can read the contents, which are
>>> used by lawyers and many others who want secure transit. some are free,
>>> some offer paid tiers above free and some are paid only, depending on
>>> various options such as number of mailboxes, email volume, custom
>>> domain, etc. some are open source and can be audited. at least one
>>> lists gdpr compliance.
>>>
>>> don't dismiss it because of your own unfamiliarity with the products.
>>
>> Does that include setting PGP on his own?
> 
> no.
> 
>> Or does it assume that his IT
>> professional hired by the bureau sets that or some other service?
> 
> no.
> 

Then it does not apply for a law bureau.

> this applies to you too:
>>> don't dismiss it because of your own unfamiliarity with the products.


-- 
Cheers,
       Carlos E.R.

[toc] | [prev] | [next] | [standalone]

#24612

In article <g179rsF3oilU1@mid.individual.net>, Carlos E. R.
<robin_listas@es.invalid> wrote:

> >>> there are several encrypted email services which guarantees that nobody
> >>> other than the sender or recipient can read the contents, which are
> >>> used by lawyers and many others who want secure transit. some are free,
> >>> some offer paid tiers above free and some are paid only, depending on
> >>> various options such as number of mailboxes, email volume, custom
> >>> domain, etc. some are open source and can be audited. at least one
> >>> lists gdpr compliance.
> >>>
> >>> don't dismiss it because of your own unfamiliarity with the products.
> >>
> >> Does that include setting PGP on his own?
> > 
> > no.
> > 
> >> Or does it assume that his IT
> >> professional hired by the bureau sets that or some other service?
> > 
> > no.
> 
> Then it does not apply for a law bureau.

it does not disqualify it for being used.

you don't speak for all law bureaus nor are you familiar with all
available options.

[toc] | [prev] | [next] | [standalone]

#24613

On 28/09/2018 14.26, nospam wrote:
> In article <g179rsF3oilU1@mid.individual.net>, Carlos E. R.
> <robin_listas@es.invalid> wrote:
> 
>>>>> there are several encrypted email services which guarantees that nobody
>>>>> other than the sender or recipient can read the contents, which are
>>>>> used by lawyers and many others who want secure transit. some are free,
>>>>> some offer paid tiers above free and some are paid only, depending on
>>>>> various options such as number of mailboxes, email volume, custom
>>>>> domain, etc. some are open source and can be audited. at least one
>>>>> lists gdpr compliance.
>>>>>
>>>>> don't dismiss it because of your own unfamiliarity with the products.
>>>>
>>>> Does that include setting PGP on his own?
>>>
>>> no.
>>>
>>>> Or does it assume that his IT
>>>> professional hired by the bureau sets that or some other service?
>>>
>>> no.
>>
>> Then it does not apply for a law bureau.
> 
> it does not disqualify it for being used.
> 
> you don't speak for all law bureaus nor are you familiar with all
> available options.
> 

And you do? ROTFL!  X'-)

-- 
Cheers,
       Carlos E.R.

[toc] | [prev] | [next] | [standalone]

#24614

In article <g17ej9F4p2jU1@mid.individual.net>, Carlos E. R.
<robin_listas@es.invalid> wrote:

> >>>>> there are several encrypted email services which guarantees that nobody
> >>>>> other than the sender or recipient can read the contents, which are
> >>>>> used by lawyers and many others who want secure transit. some are free,
> >>>>> some offer paid tiers above free and some are paid only, depending on
> >>>>> various options such as number of mailboxes, email volume, custom
> >>>>> domain, etc. some are open source and can be audited. at least one
> >>>>> lists gdpr compliance.
> >>>>>
> >>>>> don't dismiss it because of your own unfamiliarity with the products.
> >>>>
> >>>> Does that include setting PGP on his own?
> >>>
> >>> no.
> >>>
> >>>> Or does it assume that his IT
> >>>> professional hired by the bureau sets that or some other service?
> >>>
> >>> no.
> >>
> >> Then it does not apply for a law bureau.
> > 
> > it does not disqualify it for being used.
> > 
> > you don't speak for all law bureaus nor are you familiar with all
> > available options.
> 
> And you do? ROTFL!  X'-)

i'm not the one making the decision to use any particular system.

i'm simply telling you of their existence, which you refuse to
acknowledge.

[toc] | [prev] | [next] | [standalone]

#24591

On 27/09/18 03:20, Carlos E. R. wrote:
> On 26/09/2018 14.56, nospam wrote:
>> In article <g122hjF19bmU1@mid.individual.net>, Carlos E. R.
>> <robin_listas@es.invalid> wrote:
>>
>>>>> People with which I needed to use encryption were unable to set any
>>>>> encryption method up. A lawyer, for instance. I would have to go to his
>>>>> office and teach him.
>>>>
>>>> use an encrypted email service. there's nothing to set up. all they
>>>> need is a browser or an app on their phone.
>>>
>>> That would require a binding contract and spend money, which they did
>>> not want to do.
>>
>> no it wouldn't. it only needs a mutual agreement to use an encrypted
>> medium. there are free options as well as paid ones. choose whichever
>> one works best for all parties involved.
> 
> Not for a lawyer, it wouldn't. He would be directly liable if the email
> gets intercepted or somehow compromised.
> 
>>
>> lawyers should be using such a system anyway because they are required
>> to keep certain information confidential.
> 
> Good old paper and couriers.
> 
> 
A lawuer recently requitred me to use a secure logon to download email 
because at some level their mail system identifed that I wasnt using TLS 
or something.



-- 
"In our post-modern world, climate science is not powerful because it is 
true: it is true because it is powerful."

Lucas Bergkamp

[toc] | [prev] | [next] | [standalone]

#24593

On 27/09/2018 01.52, The Natural Philosopher wrote:
> On 27/09/18 03:20, Carlos E. R. wrote:
>> On 26/09/2018 14.56, nospam wrote:
>>> In article <g122hjF19bmU1@mid.individual.net>, Carlos E. R.
>>> <robin_listas@es.invalid> wrote:
>>>
>>>>>> People with which I needed to use encryption were unable to set any
>>>>>> encryption method up. A lawyer, for instance. I would have to go
>>>>>> to his
>>>>>> office and teach him.
>>>>>
>>>>> use an encrypted email service. there's nothing to set up. all they
>>>>> need is a browser or an app on their phone.
>>>>
>>>> That would require a binding contract and spend money, which they did
>>>> not want to do.
>>>
>>> no it wouldn't. it only needs a mutual agreement to use an encrypted
>>> medium. there are free options as well as paid ones. choose whichever
>>> one works best for all parties involved.
>>
>> Not for a lawyer, it wouldn't. He would be directly liable if the email
>> gets intercepted or somehow compromised.
>>
>>>
>>> lawyers should be using such a system anyway because they are required
>>> to keep certain information confidential.
>>
>> Good old paper and couriers.
>>
>>
> A lawuer recently requitred me to use a secure logon to download email
> because at some level their mail system identifed that I wasnt using TLS
> or something.

Google might say that thing, too. I read something about it.


-- 
Cheers,
       Carlos E.R.

[toc] | [prev] | [next] | [standalone]

#24556

[Multipart message — attachments visible in raw view] — view raw

On 09/23/2018 03:45 PM, Fritz Wuehler wrote:
> Hackers target real estate deals, with devastating impact
> 
> <https://www.yahoo.com/news/hackers-target-real-estate-deals-devastating-impact-015558592.html>
>
>  Here is a very simple PGP client that will automatically set itself
> up and is simple to use.  You should insist a company you are dealing
> with uses PGP.  I refused to buy precious metals once from a company
> because they wouldn't communicate with me using PGP.  They were
> foolishly fearful that the IRS would think they were doing something
> illegal.  So they opened their customers to being revealed and
> endangered.
> 
> https://sourceforge.net/projects/gentlegpg/
> 
My attorney sends e-mail in clear text, so it does not matter if I have
PGP or not. And she is in a small firm: one attorney, one paralegal, one
secretary. No IT people at all.

For her to use PGP, she would have to hire a consultant to  install PGP
and enigmail and Thunderbird, and have to learn it. And now she uses a
web browser on Windows for e-mail purposes.

Furthermore, she would need to get all her clients to do the  same.  Out
 of the  question.

And that ignores distributing her public key safely to her clients, and
perhaps getting their public keys back to her safely as well.

Fortunately, I live only about a mile from  my attorney and she has a
large parking lot, so anything sensitive, I just drive there. Were we
needing encrypted e-mail, I could just bring a thumb drive with my
public key on it to her, or even type out my entire fingerprint and get
hers. But could she get all her clients to do this? I doubt it.


-- 
  .~.  Jean-David Beyer          Registered Linux User 85642.
  /V\  PGP-Key:166D840A 0C610C8B Registered Machine  1935521.
 /( )\ Shrewsbury, New Jersey    http://linuxcounter.net
 ^^-^^ 10:30:01 up 11 days, 18:55, 2 users, load average: 4.38, 4.28, 4.20

[toc] | [prev] | [next] | [standalone]

#24570

On 09/25/2018 09:35 AM, Jean-David Beyer wrote:
> My attorney sends e-mail in clear text, so it does not matter if I have 
> PGP or not. And she is in a small firm: one attorney, one paralegal, 
> one secretary. No IT people at all.

So, your attorney is a good example of the "typical end user".

> For her to use PGP, she would have to hire a consultant to  install PGP 
> and enigmail and Thunderbird, and have to learn it. And now she uses a 
> web browser on Windows for e-mail purposes.

Thankfully, S/MIME is not quite that bad.  At least most relatively 
modern email clients support it.  (Outlook has had support for 15+ years.)

> Furthermore, she would need to get all her clients to do the  same. 
> Out of the  question.

She would need to get the clients that want to use it to do so.  She 
doesn't (and can't realistically) force clients to use something they 
want to not use.

> And that ignores distributing her public key safely to her clients, 
> and perhaps getting their public keys back to her safely as well.

IMHO the issue of distributing the (a) public key is relatively easy to 
do.  Send a signed message.  That is enough to provide the public key 
and allow recipients to reply with encrypted messages.

DANE comes to mind.  ;-)

> Fortunately, I live only about a mile from  my attorney and she has 
> a large parking lot, so anything sensitive, I just drive there. Were 
> we needing encrypted e-mail, I could just bring a thumb drive with my 
> public key on it to her, or even type out my entire fingerprint and get 
> hers. But could she get all her clients to do this? I doubt it.

There are mechanisms for distributing public keys.  I think it really 
depends on what the objective of S/MIME or PGP is.  Authenticating the 
sender requires establishing trust of the sender's key.  Simply 
encrypting contents in transit is less problematic.

Think of the self-signed SSL certificates vs certificates from a well 
known CA.



-- 
Grant. . . .
unix || die

[toc] | [prev] | [next] | [standalone]

#24583

On 25/09/2018 16.35, Grant Taylor wrote:
> On 09/25/2018 09:35 AM, Jean-David Beyer wrote:
>> My attorney sends e-mail in clear text, so it does not matter if I
>> have PGP or not. And she is in a small firm: one attorney, one
>> paralegal, one secretary. No IT people at all.
> 
> So, your attorney is a good example of the "typical end user".
> 
>> For her to use PGP, she would have to hire a consultant to  install
>> PGP and enigmail and Thunderbird, and have to learn it. And now she
>> uses a web browser on Windows for e-mail purposes.
> 
> Thankfully, S/MIME is not quite that bad.  At least most relatively
> modern email clients support it.  (Outlook has had support for 15+ years.)
> 
>> Furthermore, she would need to get all her clients to do the  same.
>> Out of the  question.
> 
> She would need to get the clients that want to use it to do so.  She
> doesn't (and can't realistically) force clients to use something they
> want to not use.
> 
>> And that ignores distributing her public key safely to her clients,
>> and perhaps getting their public keys back to her safely as well.
> 
> IMHO the issue of distributing the (a) public key is relatively easy to
> do.  Send a signed message.  That is enough to provide the public key
> and allow recipients to reply with encrypted messages.

Not with PGP... a man in the middle could send a faked key.

-- 
Cheers,
       Carlos E.R.

[toc] | [prev] | [next] | [standalone]

#24581

On 25/09/2018 11.35, Jean-David Beyer wrote:
> On 09/23/2018 03:45 PM, Fritz Wuehler wrote:
>> Hackers target real estate deals, with devastating impact
>>
>> <https://www.yahoo.com/news/hackers-target-real-estate-deals-devastating-impact-015558592.html>
>>
>>  Here is a very simple PGP client that will automatically set itself
>> up and is simple to use.  You should insist a company you are dealing
>> with uses PGP.  I refused to buy precious metals once from a company
>> because they wouldn't communicate with me using PGP.  They were
>> foolishly fearful that the IRS would think they were doing something
>> illegal.  So they opened their customers to being revealed and
>> endangered.
>>
>> https://sourceforge.net/projects/gentlegpg/
>>
> My attorney sends e-mail in clear text, so it does not matter if I have
> PGP or not. And she is in a small firm: one attorney, one paralegal, one
> secretary. No IT people at all.
> 
> For her to use PGP, she would have to hire a consultant to  install PGP
> and enigmail and Thunderbird, and have to learn it. And now she uses a
> web browser on Windows for e-mail purposes.
> 
> Furthermore, she would need to get all her clients to do the  same.  Out
>  of the  question.
> 
> And that ignores distributing her public key safely to her clients, and
> perhaps getting their public keys back to her safely as well.
> 

Right.

PKCS is a bit easier.

-- 
Cheers,
       Carlos E.R.

[toc] | [prev] | [standalone]

Page 2 of 2 — ← Prev page 1 [2]

Back to top | Article view | comp.os.linux.misc

csiph-web